Quantum encryption network device with isolation function

Abstract

The application discloses a quantum encryption network device with an isolation function, which comprises an intranet communication area, an extranet communication area and a secure data processing area; the secure data processing area acts as a buffer layer between the intranet and the extranet, and all data transmission between the intranet and the extranet must pass through the area; the secure data processing area has data filtering function and quantum encryption and decryption function, and can effectively identify and intercept illegal data; in this way, unsafe data can be intercepted before reaching the intranet; meanwhile, quantum encryption technology is introduced, and since quantum encryption technology is considered as a highly secure encryption means, any attempt to crack is extremely difficult, and even theoretically impossible; quantum encryption technology is applied in the data transmission channel, and even if the data is intercepted in the transmission process, the security of the data can be better guaranteed.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a quantum encryption network device with isolation function. Background Technology

[0002] Intranets and extranets are two common network types, differing significantly in access control, purpose, and scope. An intranet is a restricted network that uses Internet Protocol (IP) technologies (such as TCP / IP) to build a private network environment. This type of network is typically within a company, organization, or institution, aiming to share company resources and information, improve work efficiency, and facilitate collaboration among employees. The extranet, or the Internet, is a global public network composed of countless interconnected small and large networks. Unlike intranets, it is not restricted, providing people with the ability to access global information from anywhere. In terms of security, data transmission on the Internet can be subject to eavesdropping, attacks, or other security threats, requiring additional security measures such as data encryption, antivirus software, and other security protocols to protect data and devices.

[0003] In related technologies, devices used to protect the security of data transmitted between intranets and extranets are mentioned. For example, the Chinese patent application text with number CN202223595433.5 mentions: This utility model discloses a quantum-safe industrial internet gateway and platform, relating to the field of quantum-safe industrial internet technology, including: a processing module, a communication module, and a security module; the processing module is connected to the communication module, and the security module has an SPI interface, which is connected to the communication module. Based on the universal gateway SPI interface, without modifying the original gateway interface, by organically combining the security module with the SPI interface, the quantum-safe service platform, and the IoT platform, there is no need to customize the gateway device interface supporting SIM cards, and it can be directly applied to industrial internet gateways.

[0004] In the network devices of the above solution, the industrial internet gateway encrypts and transmits the collected data to the IoT platform. After receiving the encrypted business data and session key identifier, the IoT platform applies for the corresponding session key from the quantum security service platform and uses the corresponding session key to decrypt the encrypted data to obtain the plaintext business data. Finally, the plaintext business data is sent to the MES system to complete the secure transmission of business data. Simultaneously, during encryption, it needs to apply for a key from the quantum security service platform, then decrypt the data using the applied key to obtain the key used for encryption, and then use the decrypted session key to encrypt the data. The system relies on the quantum security service platform during operation. If the network environment is abnormal, such as a communication failure or significant delay between the security module and the quantum security service platform, it will directly affect the data encryption process. Furthermore, since its security module only has the function of key application, it is difficult to determine the data type, such as distinguishing between secure and insecure data; therefore, its security needs to be improved. Summary of the Invention

[0005] To address the aforementioned technical problems, this application discloses a quantum encryption network device with isolation function. The device includes an intranet communication area, an extranet communication area, and a secure data processing area, consisting of a forwarding module, a switching module, an isolation module, a quantum encryption / decryption module, a first wireless interface module, a second wireless interface module, a first wired interface module, and a second wired interface module. The forwarding module includes an intranet forwarding unit and an extranet forwarding unit.

[0006] The intranet communication area establishes a data transmission channel with the extranet communication area through the secure data processing area. The secure data processing area is used to filter and perform quantum encryption and decryption on the data transmitted in the data transmission channel.

[0007] The intranet forwarding unit of the forwarding module is connected to the first wireless interface module and the switching module, respectively. The switching module is connected to the first wired interface module, thereby forming an intranet communication area. The second wireless interface module, the second wired interface module, and the extranet forwarding unit of the forwarding module form an extranet communication area. In the extranet communication area, the second wireless interface module is connected to the extranet forwarding unit of the forwarding module. The isolation module and the quantum encryption / decryption module form a secure data processing area. In the secure data processing area, the isolation module is connected to the extranet forwarding unit, the quantum encryption / decryption module, the switching module, and the second wired interface module of the forwarding module, respectively.

[0008] In the above scheme, the first wireless interface module and the first wired interface module establish a first intranet data transmission channel through the intranet forwarding unit and the switching module of the forwarding module;

[0009] The physical interfaces in the first wired interface module establish a second intranet data transmission channel through the switching module;

[0010] The communication ports of the first wireless interface module establish a third intranet data transmission channel through the intranet forwarding unit of the forwarding module;

[0011] The first wireless interface module and the second wired interface module establish a first secure data transmission channel through the intranet forwarding unit, switching module, isolation module and the intranet forwarding unit of the forwarding module;

[0012] The first wireless interface module and the second wireless interface module establish a second secure data transmission channel through the intranet forwarding unit, switching module, isolation module and the extranet forwarding unit of the forwarding module;

[0013] A third secure data transmission channel is established between the first wired interface module and the second wired interface module through a switching module and an isolation module;

[0014] The first wired interface module and the second wireless interface module establish a fourth secure data transmission channel through an external network forwarding unit consisting of a switching module, an isolation module, and a forwarding module.

[0015] In the above scheme, the intranet forwarding unit of the forwarding module is configured with a first data forwarding table, and the forwarding module determines the forwarding of data on the first wireless interface module and the switching module side through the first data forwarding table;

[0016] The external network forwarding unit of the forwarding module is configured with a second data forwarding table, and the forwarding module determines the forwarding of data on the second wireless interface module and the switching module side through the second data forwarding table.

[0017] The switching module is configured with a third data forwarding table, which is used to determine the forwarding of data from the first wired interface module, the intranet forwarding unit of the forwarding module, the extranet forwarding unit of the forwarding module, and the second wired interface module.

[0018] In the above scheme, when the forwarding module and the switching module query the forwarding table, they query the corresponding destination physical port information based on the destination MAC address.

[0019] In the above scheme, the quantum encryption / decryption module in the secure data processing area is used to perform quantum encryption / decryption processing on the data transmitted between the intranet communication area and the extranet communication area; when the isolation module filters the data, it transparently transmits the link layer protocols involved in the switching module and the forwarding module.

[0020] In the above scheme, whether the data transmitted between the intranet communication area and the extranet communication area is encrypted or decrypted is determined by the port configuration of the quantum encryption network device. The port configuration includes the configuration between the source port of the quantum encryption network device receiving data and the destination port corresponding to the quantum encryption network device forwarding data.

[0021] In the above scheme, the quantum encryption / decryption module is further used to determine the corresponding encryption type based on the source physical port of the data. The encryption type includes quantum encryption and dual encryption combining quantum encryption and national cryptographic encryption.

[0022] In the above scheme, the encryption process of the quantum encryption / decryption module includes:

[0023] Based on the source physical port information and destination physical port information of the data, the switching module queries the encryption configuration table. If it is determined that the data needs to be encrypted, it generates a corresponding encryption identifier and sends the encryption identifier and the source physical port information corresponding to the data to the isolation module.

[0024] When the isolation module determines that data needs to be encrypted based on the encryption identifier, it forwards the data and source physical port information to the quantum encryption / decryption module.

[0025] When the quantum encryption / decryption module determines that encryption processing is required based on the encryption identifier, it matches the corresponding encryption type in its stored encryption type table according to the source physical port information, encrypts the data according to the encryption type, obtains encrypted data, carries the corresponding encryption type information in the data header of the encrypted data, and then sends the encrypted data to the isolation module.

[0026] The isolation module forwards the received encrypted data and source physical port information to the switching module;

[0027] The switching module queries the third forwarding table based on the source physical port information to determine the destination physical port information corresponding to the encrypted data. Based on the destination physical port information, the encrypted data is forwarded through the isolation module and the forwarding module.

[0028] In the above scheme, the decryption process of the quantum encryption / decryption module includes:

[0029] The isolation module receives external network data from the forwarding module and sends the encrypted data that conforms to the encryption characteristics from the external network data to the switching module; the data header of the encrypted data carries encryption type information and destination MAC address;

[0030] The switching module queries the third-party forwarding table based on the destination MAC address to determine the destination physical port information. Based on the port configuration in the encryption configuration table, it determines whether decryption is required. If decryption is required, it generates the corresponding decryption identifier and sends the encrypted data with the decryption identifier to the isolation module.

[0031] The isolation module forwards the ciphertext data with the decryption identifier to the quantum encryption / decryption module;

[0032] When the quantum encryption / decryption module determines that decryption is required based on the decryption identifier, it obtains the encryption type of the data from the data header in the data ciphertext, decrypts the data ciphertext accordingly, and then sends the decrypted plaintext data to the isolation module.

[0033] The isolation module forwards the received plaintext data to the switching module. The switching module queries the third-party forwarding table based on the destination MAC address and forwards the plaintext data out from the matched destination physical port.

[0034] The beneficial effects of this application are as follows: In the scheme of this application, the secure data processing area acts as a buffer layer between the internal network and the external network, which is a key component of this architecture; all data transmission between the internal network and the external network must pass through this area; the secure data processing area has data filtering and quantum encryption / decryption functions, which can effectively identify and intercept illegal data; in this way, insecure data can be blocked before reaching the internal network; at the same time, quantum encryption / decryption technology is introduced. Quantum encryption technology is considered a highly secure encryption method because it relies on the principles of quantum mechanics, which makes any attempt to crack it extremely difficult, or even theoretically impossible; applying quantum encryption in the data transmission channel means that even if the data is intercepted during transmission, the security of the data is guaranteed. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a schematic diagram of a quantum encryption network device with isolation function in this embodiment;

[0037] Figure 2 This is a schematic diagram of another quantum encryption network device with isolation function in this embodiment;

[0038] Figure 3 This is a schematic diagram of the data structure of the encrypted configuration table in this embodiment;

[0039] Figure 4 This is a flowchart of the data encryption method in this embodiment;

[0040] Figure 5This is a flowchart of the data decryption method in this embodiment. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0042] Example: A quantum encryption network device with isolation function includes an internal network communication area, an external network communication area, and a secure data processing area, which are composed of a forwarding module, a switching module, an isolation module, a quantum encryption / decryption module, a first wireless interface module, a second wireless interface module, a first wired interface module, and a second wired interface module;

[0043] The intranet communication area establishes a secure data transmission channel with the extranet communication area through the secure data processing area. The secure data processing area is used to filter and perform quantum encryption and decryption on the data transmitted in the secure data transmission channel.

[0044] Composition of the internal network communication area, the external network communication area, and the quantum-safe data processing area:

[0045] See Figure 1 The forwarding module includes an intranet forwarding unit and an extranet forwarding unit;

[0046] The first wireless interface module, the intranet forwarding unit of the forwarding module, the switching module, and the first wired interface module constitute the intranet communication area;

[0047] The second wireless interface module, the second wired interface module, and the external network forwarding unit of the forwarding module constitute the external network communication area;

[0048] The isolation module and the quantum encryption / decryption module constitute a secure data processing area;

[0049] In the intranet communication area, the forwarding module is connected to the switching module, the isolation module, the first wireless interface module, and the second wireless interface module respectively; the first wired interface module includes one or more physical interfaces;

[0050] See Figure 2In one possible implementation, the forwarding module and the quantum encryption / decryption module are processing modules using an ARM / X86 architecture; the isolation module can be an FPGA (Field Programmable Gate Array), PAL, GAL, or other modules with the same function; the first wireless interface module is a WIFI module; the second wireless interface module is a 4G / 5G module; the first wired interface module is a LAN interface including one or more physical interfaces; the first wired interface module is a WAN interface; wherein, the forwarding module logically divides into two functional units, namely an intranet forwarding unit for forwarding data between the first wired interface module and the switching module, and an extranet forwarding unit for transmitting data between the second wireless interface module and the switching module;

[0051] The first and second wireless interface modules communicate with the forwarding module via a PCIe interface. The forwarding module communicates with the switching module via an RGMII / SERDES data interface. The first and second wired interface modules communicate with the switching module via a PHY chip. The switching module communicates with the isolation module via a UARI / SPI / PCIe interface. The isolation module communicates with the quantum encryption / decryption module via a UARI / SPI / PCIe interface.

[0052] Based on the above connection relationship, the network device in this embodiment includes the following data transmission channels:

[0053] The first wireless interface module and the first wired interface module establish a first intranet data transmission channel through the intranet forwarding unit and the switching module of the forwarding module;

[0054] The physical interfaces in the first wired interface module establish a second intranet data transmission channel through the switching module;

[0055] The communication ports of the first wireless interface module establish a third intranet data transmission channel through the intranet forwarding unit of the forwarding module;

[0056] The first wireless interface module and the second wired interface module establish a first secure data transmission channel through the intranet forwarding unit, switching module, isolation module and the intranet forwarding unit of the forwarding module;

[0057] The first wireless interface module and the second wireless interface module establish a second secure data transmission channel through the intranet forwarding unit, switching module, isolation module and the extranet forwarding unit of the forwarding module;

[0058] A third secure data transmission channel is established between the first wired interface module and the second wired interface module through a switching module and an isolation module;

[0059] A fourth secure data transmission channel is established between the first wired interface module and the second wireless interface module through an external network forwarding unit consisting of a switching module, an isolation module, and a forwarding module.

[0060] The aforementioned data transmission channel specifically determines data forwarding through a forwarding table, which includes:

[0061] The first data forwarding table configured in the intranet forwarding unit of the forwarding module; the forwarding module determines the forwarding of data on the first wireless interface module and the switching module side through the first data forwarding table;

[0062] The forwarding module uses the second data forwarding table configured in the external network forwarding unit to determine the forwarding of data between the second wireless interface module and the switching module; the first data forwarding table is maintained and updated by the forwarding module.

[0063] The switching module is configured with a third data forwarding table, and the switching module uses the third data forwarding table to determine the forwarding of data from the first wired interface module, the intranet forwarding unit of the forwarding module, the extranet forwarding unit of the forwarding module, and the second wired interface module.

[0064] During the forwarding process, the corresponding forwarding table is queried based on the destination MAC address to determine the destination physical port information;

[0065] Forwarding tables can be created in two ways: one is through self-learning, and the other is by manually configuring static entries.

[0066] The self-learning process includes:

[0067] When a port of the gateway receives a data frame, it saves the source MAC address of the data frame and the physical port number of the receiving data frame as a self-learning forwarding entry in its forwarding table, and resets the aging timer of this entry when the data frame is received.

[0068] If, within the aging period, the gateway receives a data frame containing the same source MAC address from the same port again, the switch updates the aging timer of the previously established self-learning forwarding entry to ensure that active entries do not age out.

[0069] However, if no data frame matching the previous self-learning forwarding entry is received within the aging time, the switch will delete the self-learning forwarding entry from its forwarding table.

[0070] Manually configure static entries:

[0071] Static entries can be manually added to the gateway's forwarding table through the forwarding module. Static MAC address entries are forwarded before dynamically learned entries, but static entries have no aging time and will be stored in the gateway's forwarding table indefinitely.

[0072] The secure handling of data transmission between the intranet communication zone and the extranet communication zone includes the following:

[0073] The isolation module filters the transmitted data in the first, second, third, and fourth secure data transmission channels.

[0074] In one possible implementation, the filtering rules include encryption features. If data from the external network communication zone does not meet the encryption features, the data from the external network communication zone is intercepted. For example, when data is received from the internal network communication zone to the external network communication zone, the data header is used to determine if it is encrypted. If so, the data is allowed to be transmitted to the external network communication zone; otherwise, the data is intercepted. The data encryption method is IP payload encryption, meaning that only the payload following the IP protocol is encrypted, not the IP protocol itself (i.e., the outer protocol). For example, the data frame header carries encryption type information and data type information. The isolation module determines whether the data is sensitive data, such as user data, based on the data type information in the data frame header. If it is sensitive data and is determined to be unencrypted based on the encryption type, the data is intercepted to prevent it from passing, thereby ensuring data security.

[0075] Data sent from the intranet communication zone to the extranet communication zone, and vice versa, must be processed through the isolation module. This makes it difficult for insecure data, such as unencrypted data, in the intranet communication zone to be transmitted outwards, and difficult for insecure data from the extranet communication zone to enter the intranet communication zone.

[0076] The quantum encryption / decryption module in the secure data processing area is used to perform quantum encryption / decryption on data transmitted between the intranet communication area and the extranet communication area; when filtering data, the isolation module transparently transmits the link layer protocols involved in the switching module and the forwarding module so that the network can discover devices and interfaces normally.

[0077] The quantum encryption / decryption module uses a quantum key to encrypt and decrypt data. This quantum key is generated by a quantum random number generator. The quantum encryption / decryption module (QRNG) generates the quantum key. For example, during quantum encryption / decryption, the quantum encryption / decryption module can share a set of symmetric quantum key files with the data sender or receiver. When performing quantum encryption / decryption, the module selects a quantum key of the corresponding length from the shared quantum key file based on the data length, encrypts the data using an XOR operation to form quantum encrypted data, and generates an index corresponding to the quantum key used to encrypt the data. This index indicates the position of the quantum key in the quantum key file. The index and the quantum encrypted data are then sent to the receiver. The receiver determines the quantum key used for decryption from the shared quantum key file with the sender based on the index, and decrypts the received quantum encrypted data. Alternatively, the quantum key used for encryption / decryption can be a quantum key forwarded from other network devices. For example, if the sender or receiver and the quantum security module are connected to the same server, the quantum encryption / decryption module, after receiving the quantum key data, sends the quantum key used for encryption to the server, which then forwards the quantum key to the receiver. Alternatively, the server forwards the quantum key used for encryption from the sender to the quantum encryption / decryption module, which then decrypts the received quantum encrypted data based on the received quantum key.

[0078] Quantum encryption / decryption processing in the data transmission channel:

[0079] See Figure 3 Whether data transmitted between the intranet communication area and the extranet communication area is encrypted or decrypted is determined by the port configuration of the quantum encryption network device. This port configuration includes the configuration between the source port for receiving data and the destination port for forwarding data. Specifically, it can be determined by the port configuration in the encryption configuration table. For example, if ports G0 / 1 and G0 / 6 are configured for encryption, then data sent from port G0 / 1 to port G0 / 6 needs to be quantum encrypted by the quantum encryption / decryption module. If ports G0 / 8 and G0 / 5 are configured for decryption, then encrypted data sent from port G0 / 8 to port G0 / 5 needs to be quantum decrypted by the quantum encryption / decryption module before being forwarded back to port G0 / 8.

[0080] Data encryption or decryption is determined by port pair configuration, simplifying the operation. This method allows system administrators to pre-configure a set of port pairs on network devices, specifying which ports handle data requiring encryption and which require decryption. Once the port pairs are configured, all data streams passing through these ports will be automatically encrypted or decrypted without additional user intervention. For example, in an enterprise intranet, the exit port from the intranet to the extranet might be configured as an encryption port, while the entry port from the extranet to the intranet might be configured as a decryption port. When data packets pass through these ports, the security system automatically performs the appropriate security processing according to predefined rules. Furthermore, because encryption and decryption operations are performed automatically, this reduces the security risks caused by human error. Operators do not need to manually encrypt or decrypt each individual data packet, saving time and reducing operational complexity. Simultaneously, the automated process ensures that all sensitive data receives consistent and continuous protection throughout the transmission process.

[0081] When performing encryption, the quantum encryption / decryption module further determines the corresponding encryption type based on the source physical port of the data. The encryption type includes quantum encryption and dual encryption combining quantum encryption and national cryptographic encryption. In one possible implementation, the encryption methods include: quantum encryption, quantum encryption followed by national cryptographic encryption, and national cryptographic encryption followed by quantum encryption.

[0082] See Figure 4 The encryption process includes:

[0083] S101: The switching module queries the encryption configuration table based on the source physical port information and destination physical port information of the data. If it is determined that the data needs to be encrypted, the corresponding encryption identifier is generated and the encryption identifier and the source physical port information corresponding to the data are sent to the isolation module.

[0084] The data includes data forwarded from the first wireless interface module via the intranet forwarding unit of the forwarding module, and data from the first wired interface module;

[0085] S102: When the isolation module determines that data needs to be encrypted based on the encryption identifier, it forwards the data and source physical port information to the quantum encryption / decryption module;

[0086] The isolation module can be further configured to forward the data to the quantum encryption / decryption module if it determines that the data belongs to the encryption range, and then execute the next data encryption process. If the data that the isolation module determines needs to be encrypted does not carry an encryption identifier, the isolation module will generate a corresponding encryption identifier and carry it in the data frame header. By further identifying and judging the data through the isolation module, the isolation module has a security protection function. For example, if sensitive data is not sent from the corresponding encryption port, but is identified by the isolation module as data that needs to be encrypted, the encryption process will be further executed, thereby improving the overall security.

[0087] S103: When the quantum encryption / decryption module determines that encryption processing is required based on the encryption identifier, it matches the corresponding encryption type in its stored encryption type table according to the source physical port information, encrypts the data according to the encryption type, obtains encrypted data, carries the corresponding encryption type information in the data header of the encrypted data, and then sends the encrypted data to the isolation module.

[0088] The encryption type table establishes corresponding encryption types based on the physical port information of each source. The specific encryption types include the following: quantum encryption, quantum encryption followed by Chinese cryptographic encryption, and Chinese cryptographic encryption followed by quantum encryption.

[0089] S104: The isolation module forwards the received encrypted data and source physical port information to the switching module;

[0090] S105: The switching module queries the third forwarding table based on the source physical port information to determine the destination physical port information corresponding to the encrypted data. Based on the destination physical port information, the encrypted data is forwarded through the isolation module and the forwarding module.

[0091] See Figure 5 The decryption process includes:

[0092] S201: The isolation module receives external network data from the forwarding module and sends the encrypted data ciphertext that conforms to the encryption characteristics in the external network data to the switching module; wherein, the data header of the encrypted data ciphertext carries encryption type information and destination MAC address;

[0093] External network data includes data from the second wired interface module, and data forwarded by the second wireless interface module via the external network forwarding unit of the forwarding module;

[0094] S202: The switching module queries the third forwarding table based on the destination MAC address to determine the destination physical port information. Based on the port configuration in the encryption configuration table, it determines whether decryption is required. If decryption is required, it generates the corresponding decryption identifier and sends the encrypted data with the decryption identifier to the isolation module.

[0095] S203: The isolation module forwards the ciphertext with the decryption identifier to the quantum encryption / decryption module;

[0096] S204: When the quantum encryption / decryption module determines that decryption is required based on the decryption identifier, it obtains the encryption type of the data from the data header in the data ciphertext, decrypts the data ciphertext in this way, and then sends the decrypted plaintext data to the isolation module.

[0097] If the encryption type of the data is quantum encryption followed by national cryptographic encryption, then it will be quantum decrypted first, and then national cryptographic decryption will be performed according to the preset national cryptographic algorithm.

[0098] If the encryption type of the data is first national cryptographic encryption and then quantum encryption, then the national cryptographic decryption is performed first according to the preset national cryptographic algorithm, and then the quantum decryption is performed.

[0099] If the data is encrypted using quantum encryption, then perform the corresponding quantum decryption process directly.

[0100] S205: The isolation module forwards the received plaintext data to the switching module. The switching module queries the third-party forwarding table based on the destination MAC address and forwards the plaintext data out from the matched destination physical port.

[0101] The quantum decryption key used for decryption can be obtained through other quantum-safe devices, such as a quantum decryption key forwarded by a server.

[0102] If decryption is not required, the data ciphertext is forwarded directly from the destination physical port by querying the third-party forwarding table based on the destination MAC address.

[0103] In one possible implementation, when the isolation module receives encrypted data from the external network communication area, it forwards the encrypted data to the buffers in the switching module and the quantum encryption / decryption module, respectively. After the switching module determines that decryption is required, it responds to the corresponding decryption request from the isolation module, which then notifies the quantum encryption / decryption module to execute the corresponding decryption process. This reduces the waiting time for the isolation module to transmit the encrypted data to the quantum encryption / decryption module again, thereby improving the processing efficiency of the decryption process.

[0104] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A quantum encryption network device with isolation function, characterized in that, It includes an intranet communication area, an extranet communication area, and a secure data processing area, which are composed of a forwarding module, a switching module, an isolation module, a quantum encryption / decryption module, a first wireless interface module, a second wireless interface module, a first wired interface module, and a second wired interface module. The forwarding module includes an intranet forwarding unit and an extranet forwarding unit. The intranet communication area establishes a data transmission channel with the extranet communication area through the secure data processing area. The secure data processing area is used to filter and perform quantum encryption and decryption on the data transmitted in the data transmission channel. The intranet forwarding unit of the forwarding module is connected to the first wireless interface module and the switching module, respectively. The switching module is connected to the first wired interface module to form an intranet communication area; the second wireless interface module, the second wired interface module, and the external network forwarding unit of the forwarding module form an external network communication area, in which the second wireless interface module is connected to the external network forwarding unit of the forwarding module; the isolation module and the quantum encryption / decryption module form a secure data processing area, in which the isolation module is connected to the external network forwarding unit of the forwarding module, the quantum encryption / decryption module, the switching module, and the second wired interface module, respectively; The first wireless interface module and the first wired interface module establish a first intranet data transmission channel through the intranet forwarding unit and the switching module of the forwarding module. The physical interfaces in the first wired interface module establish a second intranet data transmission channel through the switching module; The communication ports of the first wireless interface module establish a third intranet data transmission channel through the intranet forwarding unit of the forwarding module; The first wireless interface module and the second wired interface module establish a first secure data transmission channel through the intranet forwarding unit, switching module, isolation module and the intranet forwarding unit of the forwarding module; The first wireless interface module and the second wireless interface module establish a second secure data transmission channel through the intranet forwarding unit, switching module, isolation module and the extranet forwarding unit of the forwarding module; A third secure data transmission channel is established between the first wired interface module and the second wired interface module through a switching module and an isolation module; A fourth secure data transmission channel is established between the first wired interface module and the second wireless interface module through an external network forwarding unit consisting of a switching module, an isolation module, and a forwarding module. The intranet forwarding unit of the forwarding module is configured with a first data forwarding table, and the forwarding module determines the forwarding of data on the first wireless interface module and the switching module side through the first data forwarding table; The external network forwarding unit of the forwarding module is configured with a second data forwarding table, and the forwarding module determines the forwarding of data on the second wireless interface module and the switching module side through the second data forwarding table. The switching module is configured with a third data forwarding table, which is used to determine the forwarding of data from the first wired interface module, the intranet forwarding unit of the forwarding module, the extranet forwarding unit of the forwarding module, and the second wired interface module.

2. The quantum encryption network device with isolation function according to claim 1, characterized in that, When the forwarding module and the switching module query the forwarding table, they query the corresponding destination physical port information based on the destination MAC address.

3. A quantum encryption network device with isolation function according to claim 1, characterized in that, The quantum encryption / decryption module in the secure data processing area is used to perform quantum encryption / decryption processing on the data transmitted between the intranet communication area and the extranet communication area; when filtering data, the isolation module transparently transmits the link layer protocols involved in the switching module and the forwarding module.

4. A quantum encryption network device with isolation function according to claim 3, characterized in that, Whether the data transmitted between the intranet communication area and the extranet communication area is encrypted or decrypted is determined by the port configuration of the quantum encryption network device. The port configuration includes the configuration between the source port for receiving data and the destination port for forwarding data.

5. A quantum encryption network device with isolation function according to claim 4, characterized in that, The quantum encryption / decryption module is further used to determine the corresponding encryption type based on the source physical port of the data. The encryption type includes quantum encryption and dual encryption combining quantum encryption and national cryptographic encryption.

6. A quantum encryption network device with isolation function according to claim 5, characterized in that, The encryption process of the quantum encryption / decryption module includes: Based on the source physical port information and destination physical port information of the data, the switching module queries the encryption configuration table. If it is determined that the data needs to be encrypted, it generates a corresponding encryption identifier and sends the encryption identifier and the source physical port information corresponding to the data to the isolation module. When the isolation module determines that data needs to be encrypted based on the encryption identifier, it forwards the data and source physical port information to the quantum encryption / decryption module. When the quantum encryption / decryption module determines that encryption processing is required based on the encryption identifier, it matches the corresponding encryption type in its stored encryption type table according to the source physical port information, encrypts the data according to the encryption type, obtains encrypted data, carries the corresponding encryption type information in the data header of the encrypted data, and then sends the encrypted data to the isolation module. The isolation module forwards the received encrypted data and source physical port information to the switching module; The switching module queries the third forwarding table based on the source physical port information to determine the destination physical port information corresponding to the encrypted data. Based on the destination physical port information, the encrypted data is forwarded through the isolation module and the forwarding module.

7. A quantum encryption network device with isolation function according to claim 6, characterized in that, The decryption process of the quantum encryption / decryption module includes: The isolation module receives external network data from the forwarding module and sends the encrypted data that conforms to the encryption characteristics from the external network data to the switching module; the data header of the encrypted data carries encryption type information and destination MAC address; The switching module queries the third-party forwarding table based on the destination MAC address to determine the destination physical port information. Based on the port configuration in the encryption configuration table, it determines whether decryption is required. If decryption is required, it generates the corresponding decryption identifier and sends the encrypted data with the decryption identifier to the isolation module. The isolation module forwards the ciphertext data with the decryption identifier to the quantum encryption / decryption module; When the quantum encryption / decryption module determines that decryption is required based on the decryption identifier, it obtains the encryption type of the data from the data header in the data ciphertext, decrypts the data ciphertext accordingly, and then sends the decrypted plaintext data to the isolation module. The isolation module forwards the received plaintext data to the switching module. The switching module queries the third-party forwarding table based on the destination MAC address and forwards the plaintext data out from the matched destination physical port.

Images