Method for encrypting and decrypting ipv6 message based on quantum key application mechanism

Abstract

The application provides an IPv6 message encryption and decryption method based on a quantum key application mechanism, which is realized by a sending end and a receiving end in cooperation, and the sending end and the receiving end exchange roles when transmitting back to realize the encryption transmission of messages in the opposite direction by the same processing procedure; the messages are directly encrypted by using quantum keys, and the message encapsulation uses the extensible characteristics of the IPv6 protocol, and a new extension message header is added in the header of the IPv6 message to record the parameters used for message encryption. The combination of the quantum key encryption and the message of the IPv6 is the innovation point in the application, the quantum key is directly used for encryption when the message is encrypted and decrypted, other key negotiation methods are not needed, and other network protocol negotiation keys are not needed, so that the scheme is safer and simpler. The application encapsulates the encrypted message by using the extensible characteristics of the IPv6 protocol, so that the encrypted message is still a standard IPv6 message, and the messages of the whole scheme follow the IPv6 protocol without additional protocol overhead.

Description

Technical Field

[0001] This invention relates to the field of quantum communication, and specifically to an IPv6 message encryption and decryption method based on a quantum key distribution mechanism. Background Technology

[0002] QKD-based IPSec combines quantum key distribution (QKD) technology with the IPsec protocol to enable the establishment of secure tunnels over traditional IP networks. Quantum Secure Socket Layer (QSSL) is a secure communication protocol based on quantum key distribution, using quantum keys to protect the consistency and privacy of data transmission.

[0003] There are currently no specific application solutions for IPv6. Existing traditional VPN technologies achieve similar message encryption, but the key to VPN technology is key sharing. Traditional key sharing methods mainly use pre-shared keys, Diffie-Hellman key exchange, or asymmetric key exchange to achieve key sharing. Well-known IPSec protocols like IKE and SSL combine Diffie-Hellman key exchange and asymmetric encryption algorithms to negotiate and exchange temporary symmetric encryption keys between communicating parties. The security of these traditional methods relies heavily on the chosen encryption algorithm and key management method. If the algorithm or key has vulnerabilities, it may lead to data leakage or breaches.

[0004] Existing quantum VPNs borrow from traditional cryptographic protocols and modify them, such as IPSec to support quantum key distribution (QKD) access or embedding quantum keys into SSL protocols to achieve SSL key negotiation with quantum key concepts. Traditional protocols are not designed for quantum keys, and some technical details inevitably require forced application. Furthermore, bundling them with traditional key protocols increases the complexity and redundancy of applications, hindering subsequent maintenance and upgrades.

[0005] With the rapid development of the internet, cybersecurity issues have become increasingly prominent. Existing encryption schemes often rely on complex mathematical algorithms, which may be vulnerable to attacks from future quantum computers. To address this problem, quantum key distribution has become a highly anticipated encryption technology. It utilizes the principles of quantum mechanics to achieve secure key distribution during transmission.

[0006] On the other hand, IPv6, as the next-generation Internet protocol, is gradually replacing IPv4 due to its flexible scalability and powerful address space. Compared to IPv4, IPv6 headers introduce the concept of extended headers, which can be inserted as needed to expand the functionality of IPv6 headers. This allows for the flexible addition of custom or standardized extensions without changing the basic header structure. This makes IPv6 easily support new functions and protocols. Summary of the Invention

[0007] To address the aforementioned issues and ensure transmission security, network applications often encrypt and protect network traffic. This invention provides an IPv6 packet encryption and decryption method based on a quantum key distribution mechanism, aiming to improve the security of IPv6 packet transmission and protect the confidentiality and integrity of data during transmission.

[0008] This invention provides an IPv6 packet encryption and decryption method based on a quantum key distribution mechanism. The method is implemented collaboratively by the sender and receiver. Upon return, the sender and receiver exchange roles and perform the same processing steps to achieve reverse packet encryption. Packet encryption is performed using a combination of symmetric encryption and HMAC verification based on a quantum key generated through quantum communication. The quantum key is directly used to encrypt the packet. The quantum key generated by QKD distribution is stored in a security module, which can be a hardware security module or a software key container. Encrypting the packet involves using an encryption key identifier and a specified encryption algorithm. The IPv6 packets are encrypted using the encryption service interface of the security module. The verification code is generated by calling the verification service interface of the security module using the verification key identifier. Packet encapsulation utilizes the inherent extensibility of the IPv6 protocol, adding a new extended packet header to the IPv6 packet header to record the parameters used for packet encryption. The new IPv6 payload consists of the verification code calculated using quantum key distribution and the original payload ciphertext. In this way, the packets before and after encryption and encapsulation still conform to the IPv6 packet format definition, so the IPv6 packets can be transmitted through the original link, realizing the encrypted transmission process of IPv6 packets between the two endpoints.

[0009] In one implementation, an IPv6 packet encryption / decryption method based on a quantum key distribution mechanism is provided. This method is implemented collaboratively by the sending and receiving ends. Upon return, the sending and receiving ends exchange roles and perform the same processing steps to achieve reverse packet encryption. Packet encryption is performed using a combination of symmetric encryption and HMAC verification based on a quantum key generated through quantum communication. The quantum key is directly used to encrypt the packet. The quantum key generated by QKD distribution is stored in a security module, which can be a hardware security module or a software key container. Encrypting the packet involves using the encryption key identifier and a specified encryption algorithm. The IPv6 packets are encrypted using the encryption service interface of the security module. The verification code is generated by calling the verification service interface of the security module using the verification key identifier. Packet encapsulation utilizes the inherent extensibility of the IPv6 protocol, adding a new extended packet header to the IPv6 packet header to record the parameters used for packet encryption. The new IPv6 payload consists of the verification code calculated using quantum key distribution and the original payload ciphertext. In this way, the packets before and after encryption and encapsulation still conform to the IPv6 packet format definition. Thus, the entire process of IPv6 packet encryption transmission using quantum key distribution realizes the encrypted transmission process of IPv6 packets between two endpoints.

[0010] In one embodiment, the method includes the following steps: Step 1: Quantum communication generates quantum keys. Quantum key distribution is achieved using a quantum secure communication line and a QKD device. Consistent quantum keys are generated at the sender and receiver. A key storage pool is used to store the generated quantum keys. Optional key storage methods include hardware security modules or software key containers. Step 2: Message encryption. IPv6 protocol messages are extracted from the network device. Then, the IPv6 channel identifier is determined based on the IPv6 source address, destination address, and flow label. Two quantum key identifiers are randomly obtained from the security module and bound to the IPv6 channel. One of the two quantum key identifiers is an encryption key identifier used to encrypt the message; the other is a verification key identifier used to calculate the message verification code. Then, the quantum key is used to directly encrypt the message. The message encryption process is completed, and the encryption key identifier, verification key identifier, message ciphertext, and encrypted key identifier are encrypted. Step 1: Transmit the verification code and encryption algorithm information to the subsequent message encapsulation stage for IPv6 message encapsulation; Step 2: Message encapsulation, complete the IPv6 ciphertext message encapsulation, the encapsulated IPv6 message is the IPv6 tunnel message; Step 3: Send message, push the IPv6 tunnel message back to the protocol stack, the protocol stack is responsible for sending the message in the original sending method; Step 4: Receive message, the receiving end receives network messages from the network device, and hooks out the custom IPv6 protocol header type of this method for subsequent decapsulation processing; Step 5: Message decapsulation, parse the extended message header of the IPv6 tunnel message, extract the encryption key identifier, verification key identifier, encryption algorithm identifier and verification algorithm identifier from the extended message header, and parse the verification code and message ciphertext from the payload; Step 6: Receiver message decryption, decrypt and verify the encrypted message according to the message decapsulation information and restore the original IPv6 payload.

[0011] In one implementation, the message encapsulation process in step 3 above is as follows:

[0012] Step 1: Add a new extended header. The extended header follows the IPv6 packet format definition, and its fields are shown in the table below:

[0013]

[0014] Step 2: The new extended header is inserted before the first extended header in the IPv6 header;

[0015] Step 3: Encapsulate the payload. The new payload consists of an HMAC verification code and a concatenation of the ciphertext. The new payload is placed after the IPv6 header.

[0016] Step 4: Recalculate the IPv6 packet payload length according to the IPv6 protocol and update the payload length in the packet header;

[0017] Step 5: Complete the IPv6 encrypted packet encapsulation. The encapsulated IPv6 packet is the IPv6 tunnel packet.

[0018] In one implementation, in step 7 above, the message decryption process at the receiving end is as follows:

[0019] Step 1: Quantum Key Retrieval: Retrieve the quantum key of the quantum key from the security module based on the decapsulated encryption key identifier and verification key identifier;

[0020] Step 2: Ciphertext Data Verification: Based on the verification algorithm identifier, use the corresponding algorithm and the retrieved verification key identifier to call the verification service interface of the security module to verify the message. If it is confirmed that it is consistent with the verification code parsed in the payload, the verification is successful.

[0021] Step 3: Payload Recovery: Based on the encryption algorithm identifier, use the corresponding decryption algorithm and the retrieved quantum key identifier to call the decryption service interface of the security module to decrypt the message and recover the original message.

[0022] The innovation of this invention lies in the direct combination of quantum key encryption and IPv6 message delivery. Its specific technological innovation is also reflected in two aspects.

[0023] 1. Quantum key encryption is used directly for message encryption and decryption, eliminating the need for other key negotiation methods or other network protocols, making the solution more secure and simpler.

[0024] 2. A message encapsulation method based on the IPv6 protocol. This method utilizes the extensibility of the IPv6 protocol to encapsulate encrypted messages, ensuring that the encrypted messages are still standard IPv6 messages. The entire solution follows the IPv6 protocol without any additional protocol overhead.

[0025] The method of this invention is based on quantum key distribution technology, which uses the key distributed by quantum key distribution to encrypt IPv6 packets. Its advantages are mainly reflected in the following aspects:

[0026] Higher level of security: Compared with traditional key negotiation schemes, the key used in this method is obtained by quantum key distribution. Quantum key distribution provides advantages such as unconditional security, the ability to detect eavesdropping, and encryption using quantum mechanical principles, making the key distribution and communication process more secure and reliable.

[0027] Simplified Communication Process: By employing quantum key distribution technology, leveraging the principles of no-cloning and no-eavesdropping in quantum mechanics, the security of key distribution is ensured, allowing both communicating parties to directly encrypt within the IPv6 protocol using the distributed quantum key. Compared to traditional SSL or IPSec solutions, direct encryption on the IPv6 protocol simplifies the communication process. Traditional solutions require handshakes, negotiations, and the establishment of secure tunnels to achieve encrypted communication, while this invention eliminates these handshake and establishment processes, thereby reducing protocol overhead and simplifying the process.

[0028] Better compatibility: IPv6 is an internationally recognized standard protocol. Encryption directly within the IPv6 protocol allows for more transparent and seamless integration of encryption functionality into existing network devices and protocol stacks. This means that neither network devices nor applications can utilize the encryption capabilities of the IPv6 protocol without additional configuration or modification.

[0029] By combining quantum key distribution with the IPv6 protocol, the encrypted transmission of IPv6 packets is achieved. Because it utilizes quantum encryption technology, which leverages the principles of quantum mechanics and employs quantum-based encryption algorithms and protocols, it provides a higher level of security than traditional encryption. Quantum encryption possesses unbreakability and information leakage detection capabilities, effectively resisting attack methods that traditional computers cannot handle, such as attacks and cracking by quantum computers.

[0030] Quantum encryption, as an emerging encryption technology, has brought innovation to the field of network security. Designing and implementing an IPv6 messaging system based on quantum encryption will promote the development of related technology research and applications, and drive the advancement of network security technology as a whole.

[0031] On the other hand, the IPv6 protocol possesses flexible scalability and a vast address space, making it suitable for various network environments and application scenarios. However, due to the current context of network evolution, IPv6 has not been widely adopted. Designing and implementing an IPv6 messaging system based on quantum encryption will promote the application and further development of IPv6 technology in the security field. This will accelerate the popularization and promotion of IPv6, laying the foundation for building a more secure and reliable Internet. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1This is a schematic diagram illustrating the IPv6 packet encryption implementation principle of the present invention;

[0034] Figure 2 This is a schematic diagram of the IPv6 encrypted message encapsulation of the present invention;

[0035] Figure 3 This is a schematic diagram of the encrypted IPv6 message format of the present invention. Detailed Implementation

[0036] To enable those skilled in the art to better understand the technical solutions in this application, the present invention will be further described below with reference to embodiments. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application. The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0037] like Figure 1 As shown, this method is implemented collaboratively by the sending and receiving ends. The diagram illustrates the process of encrypting and transmitting an IPv6 packet using this method once. Upon return, the sending and receiving ends switch roles and perform the same processing to achieve encrypted transmission of the packet in the reverse direction. The implementation process is described step by step below:

[0038] 1. Quantum communication generates quantum keys

[0039] Quantum key distribution (QKD) using quantum secure communication lines and QKD devices generates a consistent quantum key between the sender and receiver. The key generation and key usage processes are asynchronous. A key storage pool is used to store the generated quantum keys. To protect the keys from unauthorized access and theft, a suitable key protection method must be chosen to ensure the security of key storage and use. Optional key storage methods include hardware security modules (HSMs) or software key containers. After storage, the quantum keys provide the necessary encryption and decryption keys for subsequent message encryption and decryption processes.

[0040] 2. Message encryption

[0041] Message encryption is based on quantum communication-generated quantum keys, employing a combination of symmetric encryption and HMAC verification for both encryption and verification. First, IPv6 protocol packets are extracted from network devices. Then, the IPv6 channel identifier is determined based on the IPv6 source address, destination address, and flow label. Two quantum key identifiers (one for encryption and the other for verification, used to calculate the verification code) are randomly obtained from the key storage pool and bound to the channel. The number of times the quantum key is used or the duration of its use depends on the channel's quantum key update strategy (the threshold for quantum key updates can be set based on channel traffic or usage duration). Finally, the quantum key is used to directly encrypt the packet. The quantum key generated by QKD distribution is stored in a security module such as a hardware security module or a software key container. Encrypting the packet involves using the encryption key identifier and a specified encryption algorithm to call the security module's encryption service interface to encrypt the IPv6 packet. Similarly, the verification code (HMAC verification code) is calculated using the verification key identifier by calling the security module's verification service interface. After the message encryption process is completed, the encryption key identifier, verification key identifier, message ciphertext, ciphertext verification code, and encryption algorithm information used for encryption are transmitted to the subsequent message encapsulation group for IPv6 message encapsulation.

[0042] 3. Message encapsulation

[0043] Message encapsulation utilizes the inherent extensibility of the IPv6 protocol by adding new extension headers to the IPv6 message header to record the parameters used for message encryption. This ensures that the message still conforms to the IPv6 message format definition before and after encryption and encapsulation.

[0044] like Figure 2 As shown, the table above displays the IPv6 packet header, while the table below displays the extended packet headers added in this scheme. The arrows in the diagram... <1> The arrow indicates that the original IPv6 "Next Header" has been changed to the custom type value 0x89 of this scheme; <2> The arrow indicates that the original IPv6 "Next Header" value will be recorded in the "Next Header" field of the newly added extension header; <3> "Instructs the entire newly added extended header to be placed in the position of the original IPv6 header."

[0045] The specific encapsulation process of the message is as follows:

[0046] 3.1. Add a new extended header. The extended header conforms to the IPv6 packet format definition, and its fields are shown in the table below:

[0047]

[0048]

[0049] Table (1) New Extended Header Format

[0050] 3.2. The new extended header is inserted before the first extended header in the IPv6 header.

[0051] 3.3. Encapsulation load, such as Figure 3 As shown, the new message payload consists of an HMAC verification code and a concatenation of the message ciphertext, and the new message payload is placed after the IPv6 message header.

[0052] 3.4. Recalculate the IPv6 packet payload length according to the IPv6 protocol and update the payload length in the packet header.

[0053] 3.5. Complete the IPv6 encrypted packet encapsulation; the new IPv6 packet is the IPv6 tunnel packet. The encapsulated packet is then handed over to the packet sending stage for further processing.

[0054] 4. Send message

[0055] The encapsulated IPv6 tunnel message is pushed back onto the protocol stack, which then sends the message using the original sending method. At this point, the sending end's processing is complete, and the encrypted message arrives at the receiving end, where it is decrypted and restored.

[0056] 5. Receiving messages

[0057] The receiving end receives network packets from the network device and uses a hook to extract the custom IPv6 protocol header type 0x89 for subsequent decapsulation processing.

[0058] 6. Message decapsulation

[0059] The process involves parsing the "Next Header" and the extended header corresponding to type 0x89 in the IPv6 tunnel message. From the extended header, the encryption key identifier, verification key identifier, encryption algorithm identifier, and verification algorithm identifier are extracted. The verification code and ciphertext are then parsed from the payload. The extracted information is then passed to the subsequent message decryption stage for decryption.

[0060] 7. Decryption of receiver messages

[0061] The encrypted message is decrypted and verified based on the message decapsulation information, and the original IPv6 payload is recovered. The decryption process is as follows:

[0062] 7.1. Quantum Key Retrieval: Retrieve the quantum key of the quantum key from the security module based on the decapsulated encryption key identifier and verification key identifier.

[0063] 7.2. Encrypted Data Verification: Based on the verification algorithm identifier, the corresponding algorithm and the retrieved verification key identifier are used to call the verification service interface of the security module to verify the message. If the message is confirmed to be consistent with the verification code parsed in the payload, the verification is successful.

[0064] 7.3. Payload Recovery: Based on the encryption algorithm identifier, the corresponding decryption algorithm and the retrieved quantum key identifier are used to call the decryption service interface of the security module to decrypt the message and recover the original message.

[0065] Once the above steps are completed, the entire process of transmitting IPv6 packets via quantum key encryption is finished. This method enables encrypted transmission of IPv6 packets between two endpoints.

[0066] It will be readily understood by those skilled in the art that the aforementioned advantageous methods can be freely combined and superimposed without conflict.

[0067] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention. The above are merely preferred embodiments of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the protection scope of the present invention.

Claims

1. An IPv6 packet encryption and decryption method based on quantum key distribution mechanism, characterized in that, The method is implemented collaboratively by the sending and receiving ends. Upon transmission return, the sending and receiving ends exchange roles and perform the same processing procedure to achieve encrypted message transmission in the reverse direction. Message encryption is based on quantum keys generated by quantum communication, using a combination of symmetric encryption and HMAC verification to encrypt and verify the messages. Messages are directly encrypted using quantum keys. The quantum keys generated by QKD distribution are stored in a security module, which can be a hardware security module or a software key container. Encrypting messages involves using an encryption key identifier and a specified encryption algorithm to call the encryption service interface of the security module to encrypt IPv6 messages. Verification codes are generated by using a verification key identifier to call the verification service interface of the security module for calculation. Encapsulation utilizes the inherent extensibility of the IPv6 protocol. A new extended header is added to the IPv6 packet header to record the parameters used for packet encryption. The new IPv6 payload consists of a verification code calculated using quantum key distribution and the original payload ciphertext. In this way, the packet still conforms to the IPv6 packet format definition before and after encryption and encapsulation, so that the IPv6 packet can be transmitted through the original link, realizing the encrypted transmission process of IPv6 packets between two endpoints. The message encapsulation process is as follows: Step 1: Add a new extended header. The extended header follows the IPv6 packet format definition, and its fields are shown in the table below: ； Step 2: The new extended header is inserted before the first extended header in the IPv6 header; Step 3: Encapsulate the payload. The new payload consists of an HMAC verification code and a concatenation of the ciphertext. The new payload is placed after the IPv6 header. Step 4: Recalculate the IPv6 packet payload length according to the IPv6 protocol and update the payload length in the packet header; Step 5: Complete the IPv6 encrypted packet encapsulation. The encapsulated IPv6 packet is the IPv6 tunnel packet.

2. The method according to claim 1, characterized in that, The method includes the following steps: Step 1: Quantum communication generates quantum keys. Quantum key distribution is achieved using quantum secure communication lines and QKD devices. Consistent quantum keys are generated at the sender and receiver. A key storage pool is used to store the generated quantum keys. Optional key storage methods include hardware security modules or software key containers. Step 2: Message Encryption. Extract the IPv6 protocol message from the network device. Then, determine the IPv6 channel identifier based on the IPv6 source address, destination address, and flow label. Randomly obtain the key identifiers of two quantum keys from the security module and bind them to the IPv6 channel. One of the two quantum key identifiers is the encryption key identifier, used to encrypt the message; the other is the verification key identifier, used to calculate the message verification code. Then, the quantum key is used to directly encrypt the message. The message encryption process is complete. The encryption key identifier, verification key identifier, ciphertext, ciphertext verification code, and encryption algorithm information used for encryption are transmitted to the subsequent message encapsulation stage for IPv6 message encapsulation. Step 3: Packet encapsulation. Complete the encapsulation of the IPv6 encrypted packet. The encapsulated IPv6 packet is the IPv6 tunnel packet. Step 4: Send the message. Push the IPv6 tunnel message back to the protocol stack, and the protocol stack will be responsible for sending the message in the original sending method. Step 5: Receive packets. The receiving end receives network packets from the network device and uses hooks to extract the custom IPv6 protocol header type for subsequent decapsulation processing. Step 6: Decapsulate the message, parse the extended header of the IPv6 tunnel message, extract the encryption key identifier, verification key identifier, encryption algorithm identifier and verification algorithm identifier from the extended header, and parse the verification code and message ciphertext from the payload; Step 7: Decrypt the received message. Based on the message decapsulation information, decrypt and verify the encrypted message and recover the original IPv6 payload.

3. The method according to claim 2, characterized in that, In step 7, the message decryption process at the receiving end is as follows: Step 1: Quantum Key Retrieval: Retrieve the quantum key of the quantum key from the security module based on the decapsulated encryption key identifier and verification key identifier; Step 2: Ciphertext Data Verification: Based on the verification algorithm identifier, use the corresponding algorithm and the retrieved verification key identifier to call the verification service interface of the security module to verify the message. If it is confirmed that it is consistent with the verification code parsed in the payload, the verification is successful. Step 3: Payload Recovery: Based on the encryption algorithm identifier, use the corresponding decryption algorithm and the retrieved quantum key identifier to call the decryption service interface of the security module to decrypt the message and recover the original message.

Images