Transmission path encryption method, device, equipment and storage medium

Abstract

The application provides a transmission path encryption method, device, equipment and storage medium, the method comprises the following steps: extracting the address identifier of the source address from the first packet header of the received data packet; querying the pre-configuration key and the cyclic shift parameter of the address identifier of the source address from the configuration table; extracting the seed key generated by the node of the source address; decrypting the forwarding path data in the segment list based on the pre-configuration key, the seed key, and the cyclic shift parameter to obtain the original text of the forwarding path; updating the address identifier of the target address in the original text of the forwarding path based on the next node, and updating the address identifier of the source address based on the current node; randomly generating the seed key of the current node; encrypting the original text of the forwarding path based on the seed key, the pre-configuration key, and the cyclic shift parameter; updating the encrypted original text of the forwarding path in the segment list as the forwarding path data; and updating the seed key in the second packet header of the data packet. The application improves the security of the transmission path.

Description

Technical Field

[0001] This invention relates to the field of communications, and more specifically, to methods, apparatus, devices, and storage media for encrypting transmission paths. Background Technology

[0002] The SRv6 (Segment Routing IPv6) protocol, a source-based segmented routing protocol, provides an efficient and flexible management and control method for the Internet. It features simple deployment and flexible expansion, enabling better traffic scheduling and path optimization, and significantly improving network bandwidth utilization. Furthermore, SRv6's programmable and customizable transmission paths can be leveraged across numerous industries to meet business needs. SR (Segment Routing) simplifies networks and offers excellent scalability.

[0003] SRv6 guides forwarding devices to follow a specified forwarding path by inserting an ordered segment list into the SRH header. SRv6 forwards packets through multiple network devices along this path. Network nodes widely deploy DPI devices to analyze incoming and outgoing data packets, and the Segment List in the SRH header clearly marks the forwarding path. However, for certain industries and applications where transmission security is critical, such as finance and logistics, the exposure of customized transmission paths poses potential risks.

[0004] Therefore, how to prevent the transmission path from being exposed during transmission in order to protect the security of the transmission path is a technical problem that urgently needs to be solved by those skilled in the art.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of the present invention, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] In view of the problems in the prior art, the purpose of the present invention is to provide a transmission path encryption method, apparatus, device and storage medium, which overcomes the difficulties of the prior art and avoids the exposure of the transmission path during the transmission process, so as to protect the security of the transmission path.

[0007] Embodiments of the present invention provide a transmission path encryption method, wherein, in response to the current node being an intermediate node in the transmission path, the transmission path encryption method includes:

[0008] Extract the source address identifier from the first header of the received data packet;

[0009] The pre-configured key and loop offset parameters of the address identifier of the source address are retrieved from the configuration table, which stores the address identifier, pre-configured key and loop offset parameters of each node.

[0010] The seed key generated by the node that extracts the source address from the second header of the received data packet;

[0011] Based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, the forwarding path data in the segment list of the second header of the data packet is decrypted to obtain the original forwarding path.

[0012] The address identifier of the target address in the first packet header is updated based on the next node in the original text of the forwarding path, and the address identifier of the source address in the first packet header is updated based on the current node;

[0013] Randomly generate the seed key for the current node;

[0014] The forwarding path plaintext is encrypted based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter;

[0015] The encrypted forwarding path plaintext is used as forwarding path data to update the segment list in the second header of the data packet;

[0016] Update the seed key of the current node in the second header of the data packet.

[0017] In some embodiments of this application, the data packet is an SRv6 data packet, the first header is an IPv6 header, and the second header is an SRH header.

[0018] In some embodiments of this application, the seed key is stored in the OptionalTLVs field in the SRH header.

[0019] In some embodiments of this application, encrypting the forwarding path plaintext based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter includes:

[0020] Generate the encryption key for the current node based on the seed key and the pre-configured key of the current node;

[0021] The quasi-forwarding path data is obtained by encrypting the original text of the forwarding path based on the encryption key of the current node.

[0022] Each bit of the quasi-forwarding path data is cyclically shifted along the first cyclic shift direction according to the cyclic shift parameters of the current node to obtain the forwarding path data.

[0023] In some embodiments of this application, generating the encryption key for the current node based on the seed key and the pre-configured key of the current node includes:

[0024] Perform an XOR operation on the seed key and the pre-configured key of the current node to generate the encryption key of the current node.

[0025] In some embodiments of this application, the encryption algorithm for the original forwarding path is the RC4 encryption algorithm.

[0026] In some embodiments of this application, the step of decrypting the forwarding path data in the segment list of the second header of the data packet based on the pre-configured key, seed key, and cyclic offset parameter of the previous node to obtain the original forwarding path includes:

[0027] Each bit of the forwarding path data is cyclically shifted along the second cyclic shift direction according to the cyclic shift parameter of the previous node to obtain quasi-forwarding path data. The second cyclic shift direction is opposite to the first cyclic shift direction.

[0028] The encryption key of the previous node is generated based on the seed key and the pre-configured key of the previous node.

[0029] The quasi-forwarding path data is decrypted using the encryption key of the previous node to obtain the original forwarding path.

[0030] In some embodiments of this application, in response to the current node being the starting node in the transmission path, the transmission path encryption method includes:

[0031] The address identifier of the target address in the first packet header is updated based on the next node in the original forwarding path, and the address identifier of the source address in the first packet header is updated based on the current node;

[0032] Randomly generate the seed key for the current node;

[0033] The forwarding path plaintext is encrypted based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter;

[0034] The encrypted forwarding path plaintext is used as forwarding path data to update the segment list in the second header of the data packet;

[0035] Update the seed key of the current node in the second header of the data packet.

[0036] In some embodiments of this application, in response to the current node being a terminating node in the transmission path, the transmission path encryption method includes:

[0037] Extract the source address identifier from the first header of the received data packet;

[0038] The pre-configured key and loop offset parameters of the address identifier of the source address are retrieved from the configuration table, which stores the address identifier, pre-configured key and loop offset parameters of each node.

[0039] The seed key generated by the node that extracts the source address from the second header of the received data packet;

[0040] Based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, the forwarding path data in the segment list of the second header of the data packet is decrypted to obtain the original forwarding path.

[0041] According to another aspect of this application, a transmission path encryption apparatus is also provided, the transmission path encryption method apparatus comprising:

[0042] The first extraction module is configured to extract the address identifier of the source address from the first packet header of the received data packet;

[0043] The first query module is configured to query the pre-configured key and loop offset parameters of the address identifier of the source address from the configuration table. The configuration table stores the address identifier, pre-configured key and loop offset parameters of each node.

[0044] The second extraction module is configured to extract the seed key generated by the node with the source address from the second header of the received data packet;

[0045] The first decryption module is configured to decrypt the forwarding path data in the segment list in the second header of the data packet based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, so as to obtain the original forwarding path text.

[0046] The first update module is configured to update the address identifier of the target address in the first packet header based on the next node in the original text of the forwarding path, and update the address identifier of the source address in the first packet header based on the current node;

[0047] The seed key generation module is configured to randomly generate the seed key for the current node;

[0048] The first encryption module is configured to encrypt the original text of the forwarding path based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter.

[0049] The second update module is configured to update the segment list in the second header of the data packet by using the encrypted forwarding path plaintext as forwarding path data.

[0050] The third update module is configured to update the seed key of the current node in the second header of the data packet.

[0051] According to another aspect of the present invention, a transmission path encryption processing device is also provided, comprising:

[0052] processor;

[0053] A memory in which executable instructions of the processor are stored;

[0054] The processor is configured to perform the steps of the transmission path encryption method described above by executing the executable instructions.

[0055] Embodiments of the present invention also provide a computer-readable storage medium for storing a program, which, when executed, implements the steps of the above-described transmission path encryption method.

[0056] Compared with the prior art, the purpose of this invention is:

[0057] Each intermediate node decrypts the forwarding path data based on the seed key, pre-configured key, and cyclic offset parameters of the previous node to obtain the original forwarding path text, determining the address of the next node. It then encrypts the original forwarding path text using the current node's seed key, pre-configured key, and cyclic offset parameters to obtain the forwarding path data. Simultaneously, it updates the relevant headers of the data packets to ensure that the packets are sent to the next node while the next node can decrypt the forwarding path data. Therefore, on the one hand, the pre-configured key and cyclic offset parameters provide dual protection for the encryption of the original forwarding path text; on the other hand, the encryption protection method designed in this application involves segmented decryption followed by encryption, increasing the difficulty for potential attackers to intercept and parse it; furthermore, the seed key ensures that the encryption key is different each time, further improving the security of the original forwarding path text. Attached Figure Description

[0058] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings.

[0059] Figure 1 This is a flowchart of an embodiment of the transmission path encryption method applied to intermediate nodes according to the present invention.

[0060] Figure 2 This is a structural diagram of the data packet in the transmission path encryption method of the present invention.

[0061] Figure 3 This is a schematic diagram of the configuration table for the transmission path encryption method of the present invention.

[0062] Figure 4This is the definition of the forwarding path in the segment list of the transmission path encryption method of the present invention.

[0063] Figure 5 This is a schematic diagram of the transmission path encryption method of the present invention.

[0064] Figure 6 This is a flowchart of an embodiment of the transmission path encryption method applied to the starting node of the present invention.

[0065] Figure 7 This is a flowchart of an embodiment of the transmission path encryption method applied to a termination node according to the present invention.

[0066] Figure 8 This is a block diagram of one embodiment of the transmission path encryption device of the present invention.

[0067] Figure 9 This is a block diagram of the transmission path encryption system of the present invention.

[0068] Figure 10 This is a schematic diagram of the transmission path encryption device of the present invention.

[0069] Figure 11 This is a schematic diagram of the structure of a computer-readable storage medium according to an embodiment of the present invention. Detailed Implementation

[0070] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that the invention will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar structures, and therefore repeated descriptions of them will be omitted.

[0071] See below. Figure 1 , Figure 1 This is a flowchart of an embodiment of the transmission path encryption method of the present invention. In response to the current node being an intermediate node in the transmission path, an embodiment of the present invention provides a transmission path encryption method, including the following steps:

[0072] Step S110: Extract the address identifier of the source address from the first header of the received data packet;

[0073] Step S120: Query the pre-configured key and loop offset parameters of the address identifier of the source address from the configuration table. The configuration table stores the address identifier, pre-configured key and loop offset parameters of each node.

[0074] Step S130: Extract the seed key generated by the node with the source address from the second header of the received data packet;

[0075] Step S140: Based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, decrypt the forwarding path data in the segment list of the second header of the data packet to obtain the original forwarding path text;

[0076] Step S150: Update the address identifier of the target address in the first packet header based on the next node in the original text of the forwarding path, and update the address identifier of the source address in the first packet header based on the current node;

[0077] Step S160: Randomly generate the seed key for the current node;

[0078] Step S170: Encrypt the original text of the forwarding path based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter.

[0079] Specifically, the encryption steps may include: generating an encryption key for the current node based on the seed key and the pre-configured key of the current node; encrypting the original text of the forwarding path based on the encryption key of the current node to obtain quasi-forwarding path data; and cyclically shifting each bit of the quasi-forwarding path data along the first cyclic shift direction according to the cyclic shift parameters of the current node to obtain forwarding path data.

[0080] Specifically, the encryption key for the current node can be generated by performing an XOR operation on the seed key and the pre-configured key of the current node. The encryption algorithm for the original forwarding path can be the RC4 encryption algorithm.

[0081] Correspondingly, the above decryption steps may include: cyclically shifting each bit of the forwarding path data along the second cyclic shift direction according to the cyclic shift parameters of the previous node to obtain quasi-forwarding path data, wherein the second cyclic shift direction is opposite to the first cyclic shift direction; generating an encryption key for the previous node based on the seed key and the pre-configured key of the previous node; and decrypting the quasi-forwarding path data based on the encryption key of the previous node to obtain the original forwarding path data.

[0082] Step S180: Update the segment list in the second header of the data packet with the encrypted forwarding path plaintext as forwarding path data;

[0083] Step S190: Update the seed key of the current node in the second header of the data packet.

[0084] Specifically, the data packet can be an SRv6 data packet, the first header can be an IPv6 header, and the second header is an SRH header. The seed key can be stored in the OptionalTLVs field of the SRH header.

[0085] Therefore, each intermediate node decrypts the forwarding path data based on the seed key, pre-configured key, and cyclic offset parameters of the previous node to obtain the original forwarding path text, determine the address of the next node, and encrypts the original forwarding path text using the seed key, pre-configured key, and cyclic offset parameters of the current node to obtain the forwarding path data. Simultaneously, it updates the relevant data headers of the data packets so that the packets can be sent to the next node while the next node can decrypt the forwarding path data. Thus, on the one hand, the pre-configured key and cyclic offset parameters provide dual protection for the encryption of the original forwarding path text; on the other hand, the encryption protection method designed in this application involves segmented decryption followed by encryption, increasing the difficulty for potential attackers to intercept and parse it; furthermore, the seed key ensures that the encryption key is different each time, further improving the security of the original forwarding path text.

[0086] Further, see Figure 6 , Figure 6 This is a flowchart illustrating an embodiment of the transmission path encryption method applied to a starting node according to the present invention. In response to the current node being the starting node in the transmission path, the transmission path encryption method includes:

[0087] Step S311: Update the address identifier of the target address in the first packet header based on the next node in the original forwarding path, and update the address identifier of the source address in the first packet header based on the current node;

[0088] Step S312: Randomly generate the seed key for the current node;

[0089] Step S313: Encrypt the original text of the forwarding path based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter;

[0090] Step S314: Update the segment list in the second header of the data packet with the encrypted forwarding path plaintext as forwarding path data;

[0091] Step S315: Update the seed key of the current node in the second header of the data packet.

[0092] Further, see Figure 7 , Figure 7 This is a flowchart of an embodiment of the transmission path encryption method applied to a terminating node according to the present invention. In response to the current node being a terminating node in the transmission path, the transmission path encryption method includes:

[0093] Step S321: Extract the address identifier of the source address from the first header of the received data packet;

[0094] Step S322: Query the pre-configured key and loop offset parameters of the address identifier of the source address from the configuration table. The configuration table stores the address identifier, pre-configured key and loop offset parameters of each node.

[0095] Step S323: Extract the seed key generated by the node with the source address from the second header of the received data packet;

[0096] Step S324: Based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, decrypt the forwarding path data in the segment list of the second header of the data packet to obtain the original forwarding path.

[0097] The SRv6 packet header adds an SRH packet after the original IPv6 packet header, such as... Figure 2 As shown. Figure 2 The SRv6 packet header data structure 210 shown consists of an IPv6 header followed by an SRH header. Within the SRH header, the SegmentList field contains a series of SIDs. These SIDs define each forwarding device in the IPv6 packet's forwarding path. In a normal SRv6 packet, all SIDs in the SegmentList are in plaintext. Each time a packet passes through a forwarding node, that node extracts the next SID from the SegmentList, replaces it with the target IPv6 address, and forwards it. During this entire forwarding process, all SIDs in the List can be intercepted, posing a security risk.

[0098] Therefore, this application allows configuring pre-configured keys on network devices participating in SRv6 forwarding, and each network forwarding device stores the pre-configured keys of other devices. These pre-configured keys are used for encryption protection of the time SID, decryption, and forwarding. Each device stores an SRv6 forwarding configuration table, such as... Figure 3 As shown. The SR device identifier in configuration table 220 is the network address identifier (Locator) of this device, and the SID in the Segment List is as follows. Figure 4As shown in the SID definition 230, the Function and Args fields define the function and parameters of the SRv6 packet processed by the node, respectively. They may not have routing information or identification functions. The Locator is the network address of the device, serving as the basis for routing and forwarding, and acts as the identifier of the SR device. The SR device is identified and located through the Locator information in the table. The pre-configured key in configuration table 220 is used to generate the SID encryption key, while the loop shift parameter performs a loop shift on the target SID to protect the original information. In some specific implementations, Pre_Key_i and LoopSft_Par_i can both be 128 bits, and the value of LoopSft_Par_i can be between 0 and 127.

[0099] In one specific embodiment, the SID encryption protection method 240 in the Segment List is as follows: Figure 5 As shown, the methods for starting nodes, intermediate nodes, and ending nodes are described below:

[0100] If the current node is the starting node:

[0101] 1) After setting the SRv6 forwarding path, the starting node first generates a random key seed, Seed_key. This seed can be 128 bits and will be used for the encryption of all SIDs in this operation. The encryption of each SID in the Segment List is accomplished using the pre-configured key Pre_Key_i of this node and the loop shift parameter LoopSft_Par_i.

[0102] 2) Perform an XOR operation between Pre_Key_i and Seed_key to generate an encryption key, which ensures that the encryption key used for each operation is different;

[0103] 3) The SID is cyclically shifted according to the value of the LoopSft_Par_i parameter. That is, the SID is shifted to the right according to the value of LoopSft_Par_i, and the shifted binary content is filled into the left header of the SID to form a new SID value SID', thus protecting and hiding the SID value from the plaintext.

[0104] 4) Use the encryption key generated in step 2) to encrypt SID' using the RC4 stream cipher encryption algorithm. The length of the encrypted SID remains unchanged at 128 bits. A 128-bit RC4 encryption key is usually secure.

[0105] 5) The encryption protection of the second SID is completed according to steps 2) to 4), and so on;

[0106] 6) After all SIDs are encrypted, they are pushed into the Segment List in sequence, and the Seed_key is stored in the OptionalTLVs field of the SRH, thus completing the encapsulation of the entire SRH. At the same time, the plaintext of the first SID is pushed into the destination address segment of the IPv6 header as the IPv6 address, and the forwarding of SRv6 packets begins.

[0107] If the current node is an intermediate node:

[0108] The intermediate nodes involve both decryption and re-encryption. If it is the last node, no encryption or decryption is required; the target IPv6 address can be directly extracted for a match operation.

[0109] 1) After receiving the SRv6 data packet sent by the previous node, the intermediate node extracts the source IPv6 address from the IPv6 packet header and extracts the Locator value from it.

[0110] 2) Search the SRv6 forwarding configuration table stored locally to obtain the pre-configuration key Pre_Key_i and the loop offset parameter LoopSft_Par_i corresponding to the Locator. At the same time, extract the OptionalTLVs value from the SRH header. This is the Seed_key.

[0111] 3) Perform an XOR operation on the key Pre_Key_i and Seed_key corresponding to the source Locator to obtain the decryption key, and perform RC4 stream cipher decryption operation on all encrypted SIDs in the Segment List to obtain the value of each SID'.

[0112] 4) The loop shift parameter LoopSft_Par_i of the above nodes performs a reverse loop shift operation on all SIDs', and finally obtains the original SIDs in all Segment Lists;

[0113] 5) Extract the SID value of the next node, replace the target IPv6 address range in the IPv6 packet header, and replace the source IPv6 address range in the IPv6 packet header with the SID value of this node;

[0114] 6) Generate a new Seed_key using the local random seed key generator, and extract the pre-configured key Pre_Key_i and the loop shift parameter LoopSft_Par_i from this node. Using the local pre-configured key, loop shift parameter, and seed key, encrypt all SID values ​​in the Segment List to generate a new encrypted Segment List, push it into the SRH header, and simultaneously push the new Seed_key into the OptionalTLVs field of the SRH.

[0115] 7) The intermediate node forwards the encapsulated new data packet to the next node.

[0116] Therefore, this application proposes encryption and protection for the forwarding path table of the Segment List in the SRv6 protocol. This is particularly suitable and meaningful for scenarios that wish to leverage the programmable and customizable forwarding path advantages of the SRv6 protocol while also protecting path information, including fields such as finance and logistics. While designing the method and apparatus, this application considers that SRv6 is a network layer protocol, and all operations are best performed at the network layer rather than with the involvement of the CPU and operating system software. Therefore, the designed method and apparatus architecture can be implemented in the ASIC architecture of the network interface card to avoid forwarding latency.

[0117] The above is merely an illustrative description of the specific implementation of the present invention, and the present invention is not intended to be limited thereto. The splitting, merging, and execution order of steps, the splitting and merging of modules, and the changes in information transmission are all within the protection scope of the present invention.

[0118] Figure 8 This is a block diagram of one embodiment of the transmission path encryption device of the present invention. The transmission path encryption device 400 of the present invention, as shown... Figure 8 As shown, it includes, but is not limited to, the first extraction module 410, the first query module 420, the second extraction module 430, the first decryption module 440, the first update module 450, the seed key generation module 460, the first encryption module 470, the second update module 480, and the third update module 490.

[0119] The first extraction module 410 is configured to extract the address identifier of the source address from the first packet header of the received data packet;

[0120] The first query module 420 is configured to query the pre-configured key and cyclic offset parameters of the address identifier of the source address from the configuration table. The configuration table stores the address identifier, pre-configured key and cyclic offset parameters of each node.

[0121] The second extraction module 430 is configured to extract the seed key generated by the node with the source address from the second header of the received data packet;

[0122] The first decryption module 440 is configured to decrypt the forwarding path data in the segment list in the second header of the data packet based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, so as to obtain the original forwarding path text.

[0123] The first update module 450 is configured to update the address identifier of the target address in the first packet header based on the next node in the original text of the forwarding path, and update the address identifier of the source address in the first packet header based on the current node;

[0124] The seed key generation module 460 is configured to randomly generate the seed key for the current node;

[0125] The first encryption module 470 is configured to encrypt the original text of the forwarding path based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter.

[0126] The second update module 480 is configured to update the segment list in the second header of the data packet with the encrypted forwarding path plaintext as forwarding path data.

[0127] The third update module 490 is configured to update the seed key of the current node in the second header of the data packet.

[0128] When the transmission path encryption device 400 is located at an intermediate node of the forwarding path, the first extraction module 410, the first query module 420, the second extraction module 430, the first decryption module 440, the first update module 450, the seed key generation module 460, the first encryption module 470, the second update module 480, and the third update module 490 of the transmission path encryption device 400 all perform the corresponding steps.

[0129] When the transmission path encryption device 400 is located at the starting node of the forwarding path, only the first update module 450, the seed key generation module 460, the first encryption module 470, the second update module 480, and the third update module 490 perform the corresponding steps.

[0130] When the transmission path encryption device 400 is located at the end node of the forwarding path, only the first extraction module 410, the first query module 420, the second extraction module 430, and the first decryption module 440 perform the corresponding steps.

[0131] The implementation principle of the above modules can be found in the relevant introduction in the transmission path encryption method, and will not be repeated here.

[0132] The transmission path encryption device of the present invention, on the one hand, involves each intermediate node decrypting the forwarding path data based on the seed key, pre-configured key, and cyclic offset parameters of the previous node to obtain the original forwarding path text, determine the address of the next node, and encrypt the original forwarding path text according to the seed key, pre-configured key, and cyclic offset parameters of the current node to obtain the forwarding path data. Simultaneously, the relevant data headers of the data packets are updated so that the data packets can be sent to the next node while the next node can decrypt the forwarding path data. Thus, on the one hand, the pre-configured key and cyclic offset parameters provide dual protection for the encryption of the original forwarding path text; on the other hand, the encryption protection method designed in this application involves segmented decryption followed by encryption, increasing the difficulty for potential attackers to intercept and analyze it; and thirdly, the seed key ensures that the encryption key is different each time, further improving the security of the original forwarding path text.

[0133] Figure 8 The transmission path encryption device 400 provided by this invention is merely illustrative. Without departing from the inventive concept, the splitting, merging, and addition of modules are all within the scope of protection of this invention. The transmission path encryption device 400 provided by this invention can be implemented by software, hardware, firmware, plugins, and any combination thereof; this invention is not limited thereto.

[0134] Figure 9 This is a block diagram of the transmission path encryption system 500 of the present invention. The transmission path encryption system 500 includes:

[0135] SRv6 packet encryption control module 520: Responsible for controlling and allocating the entire SRv6 encryption / decryption process and business requirements based on the operational status of the service, and coordinating and managing the operation of other modules.

[0136] SRv6 forwarding node configuration database 540: This database persistently stores key information data for each forwarding node, including the device's Locator identifier, pre-configured key, and cyclic shift parameters. The corresponding pre-configured key and cyclic shift parameters can be retrieved by using the device's Locator identifier.

[0137] SRv6 Packet Processing Engine 570: This engine parses and encapsulates packets according to the IPv6 and SRv6 protocols, extracts the SID value of the Segment List from the SRH header, and encapsulates new packets after processing.

[0138] Random seed key generator 530: used to generate Seed_key, which, together with the pre-configured key, generates an encryption key;

[0139] RC4 Encryption Algorithm Engine 550: This module, under the coordination of the SRv6 forwarding path encryption control module, completes the encryption or decryption operation of the SID in the Segment List;

[0140] Circular Shift Algorithm Module 560: This module uses the circular shift algorithm and the LoopSft_Par_i parameter to perform circular shift operations or reverse operations on the SID content in order to protect and hide the plaintext of the SID.

[0141] The above is merely an illustrative representation of the transmission path encryption system 500 provided in this application. The splitting, merging, and other changes of the modules are all within the scope of protection of this application.

[0142] This invention also provides a transmission path encryption processing device, including a processor and a memory storing executable instructions for the processor. The processor is configured to execute steps of a transmission path encryption method by executing the executable instructions.

[0143] As shown above, in this embodiment of the transmission path encryption processing device of the present invention, each intermediate node decrypts the forwarding path data based on the seed key, pre-configured key, and cyclic offset parameters of the previous node to obtain the original forwarding path text to determine the address of the next node. Then, it encrypts the original forwarding path text according to the seed key, pre-configured key, and cyclic offset parameters of the current node to obtain the forwarding path data. Simultaneously, it updates the relevant data header of the data packet so that while the data packet is sent to the next node, the next node can decrypt the forwarding path data. Therefore, on the one hand, the pre-configured key and cyclic offset parameters provide dual protection for the encryption of the original forwarding path text; on the other hand, the encryption protection method designed in this application involves segmented decryption followed by encryption, increasing the difficulty for potential attackers to intercept and analyze it; furthermore, the seed key ensures that the encryption key is different each time, further improving the security of the original forwarding path text.

[0144] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "platform."

[0145] Figure 10 This is a schematic diagram of the transmission path encryption processing device of the present invention. See below for reference. Figure 10 To describe an electronic device 800 according to this embodiment of the present invention. Figure 10 The electronic device 800 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0146] like Figure 10 As shown, the electronic device 800 is presented in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different platform components (including storage unit 820 and processing unit 810), a display unit 840, etc.

[0147] The storage unit stores program code, which can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in the above-described transmission path encryption method section of this specification, according to various exemplary embodiments of the present invention. For example, the processing unit 810 can perform, as follows: Figure 2 The steps are shown in the figure.

[0148] Storage unit 820 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 8201 and / or cache memory 8202, and may further include a read-only memory (ROM) 8203.

[0149] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0150] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0151] Electronic device 800 can also communicate with one or more external devices 8001 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 800, and / or with any device that enables electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. Network adapter 860 can communicate with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms.

[0152] This invention also provides a computer-readable storage medium for storing a program, which, when executed, implements the steps of a transmission path encryption method. In some possible implementations, various aspects of this invention can also be implemented as a program product comprising program code that, when run on a terminal device, causes the terminal device to perform the steps described in the transmission path encryption method section of this specification according to various exemplary embodiments of the invention.

[0153] As shown above, in the computer-readable storage medium used to perform transmission path encryption in this embodiment, each intermediate node decrypts the forwarding path data based on the seed key, pre-configured key, and cyclic offset parameters of the previous node to obtain the original forwarding path text, determine the address of the next node, and encrypts the original forwarding path text according to the seed key, pre-configured key, and cyclic offset parameters of the current node to obtain the forwarding path data. Simultaneously, it updates the relevant data header of the data packet so that while the data packet is sent to the next node, the next node can decrypt the forwarding path data. Therefore, on the one hand, the pre-configured key and cyclic offset parameters provide dual protection for the encryption of the original forwarding path text; on the other hand, the encryption protection method designed in this application involves segmented decryption followed by encryption, increasing the difficulty for potential attackers to intercept and parse it; furthermore, the seed key ensures that the encryption key is different each time, further improving the security of the original forwarding path text.

[0154] Figure 11 This is a schematic diagram of the structure of the computer-readable storage medium of the present invention. (Reference) Figure 11As shown, a program product 900 for implementing the above-described method according to an embodiment of the present invention is described. It may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0155] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0156] Computer-readable storage media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable storage medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0157] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0158] In summary, each intermediate node decrypts the forwarding path data based on the seed key, pre-configured key, and cyclic offset parameters of the previous node to obtain the original forwarding path data, determining the address of the next node. Then, it encrypts the original forwarding path data using the seed key, pre-configured key, and cyclic offset parameters of the current node, simultaneously updating the relevant header of the data packet to ensure that the packet is sent to the next node while the next node can decrypt the forwarding path data. Therefore, on the one hand, the pre-configured key and cyclic offset parameters provide dual protection for the encryption of the original forwarding path data; on the other hand, the encryption protection method designed in this application involves segmented decryption followed by encryption, increasing the difficulty for potential attackers to intercept and parse it; furthermore, the seed key ensures that the encryption key is different each time, further improving the security of the original forwarding path data.

[0159] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A transmission path encryption method, characterized in that, In response to the current node being an intermediate node in the transmission path, the transmission path encryption method includes: Extract the source address identifier from the first header of the received data packet; The pre-configured key and loop offset parameters of the address identifier of the source address are retrieved from the configuration table, which stores the address identifier, pre-configured key and loop offset parameters of each node. The seed key generated by the node that extracts the source address from the second header of the received data packet; Based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, the forwarding path data in the segment list of the second header of the data packet is decrypted to obtain the original forwarding path. The address identifier of the target address in the first packet header is updated based on the next node in the original text of the forwarding path, and the address identifier of the source address in the first packet header is updated based on the current node; Randomly generate the seed key for the current node; The forwarding path plaintext is encrypted based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter; The encrypted forwarding path plaintext is used as forwarding path data to update the segment list in the second header of the data packet; Update the seed key of the current node in the second header of the data packet.

2. The transmission path encryption method according to claim 1, characterized in that, The data packet is an SRv6 data packet, with the first header being an IPv6 header and the second header being an SRH header.

3. The transmission path encryption method according to claim 2, characterized in that, The seed key is stored in the OptionalTLVs field of the SRH header.

4. The transmission path encryption method according to claim 1, characterized in that, The encryption of the forwarding path plaintext based on the current node's seed key, the current node's pre-configured key, and the cyclic offset parameter includes: Generate the encryption key for the current node based on the seed key and the pre-configured key of the current node; The quasi-forwarding path data is obtained by encrypting the original text of the forwarding path based on the encryption key of the current node. Each bit of the quasi-forwarding path data is cyclically shifted along the first cyclic shift direction according to the cyclic shift parameters of the current node to obtain the forwarding path data.

5. The transmission path encryption method according to claim 4, characterized in that, The process of generating the encryption key for the current node based on the seed key and the pre-configured key of the current node includes: Perform an XOR operation on the seed key and the pre-configured key of the current node to generate the encryption key of the current node.

6. The transmission path encryption method according to claim 4, characterized in that, The encryption algorithm for the original text in the forwarding path is the RC4 encryption algorithm.

7. The transmission path encryption method according to claim 4, characterized in that, The process of decrypting the forwarding path data in the segment list of the second header of the data packet based on the pre-configured key, seed key, and cyclic offset parameters of the previous node to obtain the original forwarding path includes: Each bit of the forwarding path data is cyclically shifted along the second cyclic shift direction according to the cyclic shift parameter of the previous node to obtain quasi-forwarding path data. The second cyclic shift direction is opposite to the first cyclic shift direction. The encryption key of the previous node is generated based on the seed key and the pre-configured key of the previous node. The quasi-forwarding path data is decrypted using the encryption key of the previous node to obtain the original forwarding path.

8. The transmission path encryption method according to claim 1, wherein, in response to the current node being the starting node in the transmission path, it is characterized in that, The transmission path encryption method includes: The address identifier of the target address in the first packet header is updated based on the next node in the original forwarding path, and the address identifier of the source address in the first packet header is updated based on the current node; Randomly generate the seed key for the current node; The forwarding path plaintext is encrypted based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter; The encrypted forwarding path plaintext is used as forwarding path data to update the segment list in the second header of the data packet; Update the seed key of the current node in the second header of the data packet.

9. The transmission path encryption method according to claim 1, wherein in response to the current node being a terminating node in the transmission path, it is characterized in that, The transmission path encryption method includes: Extract the source address identifier from the first header of the received data packet; The pre-configured key and loop offset parameters of the address identifier of the source address are retrieved from the configuration table, which stores the address identifier, pre-configured key and loop offset parameters of each node. The seed key generated by the node that extracts the source address from the second header of the received data packet; Based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, the forwarding path data in the segment list of the second header of the data packet is decrypted to obtain the original forwarding path.

10. A transmission path encryption device, characterized in that, The transmission path encryption device includes: The first extraction module is configured to extract the address identifier of the source address from the first packet header of the received data packet; The first query module is configured to query the pre-configured key and loop offset parameters of the address identifier of the source address from the configuration table. The configuration table stores the address identifier, pre-configured key and loop offset parameters of each node. The second extraction module is configured to extract the seed key generated by the node with the source address from the second header of the received data packet; The first decryption module is configured to decrypt the forwarding path data in the segment list in the second header of the data packet based on the pre-configured key, seed key, and cyclic offset parameters of the previous node, so as to obtain the original forwarding path text. The first update module is configured to update the address identifier of the target address in the first packet header based on the next node in the original text of the forwarding path, and update the address identifier of the source address in the first packet header based on the current node; The seed key generation module is configured to randomly generate the seed key for the current node; The first encryption module is configured to encrypt the original text of the forwarding path based on the seed key of the current node, the pre-configured key of the current node, and the cyclic offset parameter. The second update module is configured to update the segment list in the second header of the data packet with the encrypted forwarding path plaintext as forwarding path data. The third update module is configured to update the seed key of the current node in the second header of the data packet.

11. A transmission path encryption processing device, characterized in that, include: processor; A memory in which executable instructions of the processor are stored; The processor is configured to execute the executable instructions: The transmission path encryption method according to any one of claims 1 to 9.

12. A computer-readable storage medium for storing a program, characterized in that, When the program is executed, it achieves the following: The transmission path encryption method according to any one of claims 1 to 9.

Images