Information protection method, communication method, network device, communication system and storage medium

Abstract

The present application discloses an information protection method, a communication method, a network device, a communication system and a computer-readable storage medium based on SRv6 technology. The information protection method includes: obtaining a quantum key. Encrypting the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information to protect the segment identification information. In this way, the network device encrypts the segment identification information in the segment routing header by the quantum key to obtain the quantum segment identification information. The quantum key has extremely strong confidentiality, and the attacker cannot steal data without being detected. The quantum segment identification information obtained in this way has good confidentiality and can safely and efficiently store and transmit the information required for segment routing.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to an information protection method, communication method, network equipment, communication system, and computer-readable storage medium based on SRv6 technology. Background Art

[0002] The segment routing header used in the Internet Protocol version 6 (IPv6) can precisely control the data forwarding path. However, because the segment routing header does not adequately protect the segment list in the segment routing, attackers can manipulate the forwarding path of data packets by tampering with the segment identification information in the segment list, causing them to reach network devices controlled or monitored by the attacker as desired, thereby achieving the purpose of packet hijacking. Summary of the Invention

[0003] The present application provides an information protection method, a communication method, a network device, a communication system, and a computer-readable storage medium based on SRv6 technology.

[0004] The present application provides an information protection method based on SRv6 technology, which is used in a network device. The method includes:

[0005] Obtaining quantum keys;

[0006] The segment identification information in the segment routing message header is encrypted according to the quantum key to obtain quantum segment identification information, so as to protect the segment identification information.

[0007] In this way, the quantum segment identification information is encrypted using a quantum key, which provides strong confidentiality and prevents attackers from stealing data without detection. The resulting quantum segment identification information is highly confidential and can securely and efficiently store and transmit the information required for segment routing.

[0008] In some embodiments, the network device is communicatively connected to the controller and the quantum key management system, respectively, and obtaining the quantum key includes:

[0009] Initiating a quantum key application to the quantum key management system through the controller;

[0010] receiving first key information distributed by the quantum key management system according to the quantum key application;

[0011] The first key information is decrypted to obtain the quantum key and a quantum key identifier corresponding to the quantum key.

[0012] In this way, the controller initiates a quantum key request to the quantum key management system. It then receives the first key information distributed by the quantum key management system based on the quantum key request. Finally, it decrypts the first key information to obtain the quantum key and its corresponding quantum key identifier. Quantum keys offer extremely strong confidentiality, preventing attackers from stealing data without detection. Quantum key identifiers facilitate the management and use of quantum keys. The resulting quantum key and quantum key identifier can be used in subsequent communication processes to enhance confidentiality.

[0013] In some embodiments, initiating, by the controller, a quantum key application to the quantum key management system includes:

[0014] The controller initiates a quantum key application to the quantum key management system at every preset period.

[0015] In this way, network devices set a preset period and then initiate quantum key requests to the quantum key management system through the controller at each preset period. This regular initiation of quantum key requests ensures that the key is regularly updated. Even if the quantum key is illegally obtained at some point in time, regular updates will render the illegally obtained key invalid in the near future, reducing the risk of key leakage.

[0016] In certain embodiments, the quantum key application includes a security device identifier of the network device, the first key information is obtained by the quantum key management system by encrypting the second key information according to the quantum master key, the second key information is randomly generated by the quantum key management system, and the quantum master key is pre-filled in the network device and determined according to the security device identifier.

[0017] In this way, the quantum key application sent by the network device includes the network device's security device identifier. The security device identifier is used to determine the quantum master key to be used when the quantum key management system subsequently encrypts the second key information using the quantum master key. The quantum key management system encrypts the first key information received by the network device using the quantum master key, thereby obtaining the second key information. This allows the second key information to be sent to the network device under the protection of the quantum master key. The second key information is randomly generated by the quantum key management system, and the quantum master key is pre-charged in the network device and determined based on the security device identifier. The network device is pre-charged with the quantum master key for use by the network device.

[0018] In some embodiments, the quantum key application further includes the number of quantum keys, and the second key information further includes a number of initial quantum keys corresponding to the number of quantum keys; and / or

[0019] The quantum key application also includes a quantum key length, and the second key information also includes an initial quantum key corresponding to the quantum key length.

[0020] In this case, the quantum key application also includes the number of quantum keys, and the second key information also includes a number of initial quantum keys corresponding to the number of quantum keys. The number of quantum keys is determined based on the actual needs of the network equipment to ensure the reasonable allocation and use of quantum resources; and / or

[0021] The quantum key application also includes the quantum key length, and the second key information also includes the initial quantum key corresponding to the quantum key length. The quantum key length is determined according to the actual needs of the network device to ensure that it is consistent with the key length required by the network device.

[0022] In some embodiments, the information protection method further includes:

[0023] A registration request is initiated to the controller, where the registration request includes the security device identification of the network device, so as to perform security authentication on the quantum key management system through the controller.

[0024] In this way, the network device initiates a registration request to the controller, which includes its secure device identifier, for authentication with the quantum key management system via the controller. This secure authentication is performed with the quantum key management system using the controller as a relay station, ensuring that the authenticated network device can obtain quantum keys.

[0025] In some embodiments, the information protection method further includes:

[0026] The quantum key identifier and the quantum segment identifier information are stored in a preset field in a segment routing message header.

[0027] In this way, network devices store the quantum key identifier and quantum segment identifier information in pre-defined fields within the segment routing message header. The quantum key identifier can be used to verify the integrity of the data packet, while the quantum segment identifier indicates the specific network segment the data packet must traverse. By storing the quantum key identifier and quantum segment identifier information in the segment routing message header, network devices can securely and precisely control the forwarding path of data packets.

[0028] In some embodiments, encrypting the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information to protect the segment identification information includes:

[0029] The segment identification information is encrypted according to the quantum key and a preset encryption algorithm to obtain quantum segment identification information, so as to protect the segment identification information.

[0030] In this way, network devices encrypt the segment identification information using the quantum key and a pre-set encryption algorithm to obtain quantum segment identification information, thereby protecting the segment identification information. By encrypting the segment identification information using the quantum key and encryption algorithm, even if the data is intercepted, it cannot be easily decrypted and understood, ensuring the security of the segment identification information during transmission.

[0031] An embodiment of the present application provides a communication method, which is used for the network device, and includes:

[0032] Receiving data information sent by a previous network device in the communication link where the network device is located, the data information including a segment routing message header obtained by processing based on the above-mentioned information protection method based on SRv6 technology;

[0033] Parsing the data information to obtain a quantum key identifier;

[0034] Performing security verification on the data information according to the quantum key identification;

[0035] When the security verification is passed, the data information is sent to the next network device in the communication link where the network device is located.

[0036] In this way, within a communication link, a network device uses the quantum key identifier to parse the data sent by the previous network device to obtain the quantum key identifier. The network device then performs security verification on the data based on the obtained quantum key identifier. If the security verification passes, the network device transmits the data to the next network device in the communication link. This ensures the security of the communication link while improving data forwarding efficiency.

[0037] In some embodiments, the performing security verification on the data information according to the quantum key identification includes:

[0038] querying the quantum key corresponding to the quantum key identifier in the network device according to the quantum key identifier;

[0039] When a quantum key corresponding to the quantum key identifier is found in the network device, the data information security is confirmed by using the quantum key.

[0040] In this way, the network device searches for the quantum key corresponding to the quantum key identifier in the network device. If the quantum key corresponding to the quantum key identifier is found in the network device, the network device uses the quantum key to confirm the security of the data information. After the quantum key corresponding to the quantum key identifier is found in the network device, the network device verifies whether the segment routing message header has been tampered with based on the found quantum key, thereby confirming the security of the data information.

[0041] In some embodiments, the performing security verification on the data information according to the quantum key identification includes:

[0042] If the quantum key corresponding to the quantum key identifier is not found in the network device, querying the quantum key corresponding to the quantum key identifier from the quantum key management system according to the quantum key identifier;

[0043] When a quantum key corresponding to the quantum key identifier is found in the quantum key management system, the data information security is confirmed by using the quantum key;

[0044] When the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, it is confirmed that the data information security is abnormal.

[0045] In this way, if the network device fails to find the quantum key corresponding to the quantum key identifier, it queries the quantum key management system for the quantum key corresponding to the quantum key identifier based on the quantum key identifier. If the quantum key corresponding to the quantum key identifier is found in the quantum key management system, the network device confirms the security of the data information. If the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, a data information security anomaly is determined. By querying the quantum key corresponding to the quantum key identifier in the quantum key management system, the segment routing message header is verified to be tampered with based on the found quantum key, thereby confirming the security of the data information. If the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, a data information security anomaly is determined.

[0046] An embodiment of the present application provides a network device, which includes a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the above-mentioned information protection method and communication method are implemented.

[0047] An embodiment of the present application provides a communication system, which includes the network device, controller and quantum key management system as described above, and the network device is communicatively connected to the controller and the quantum key management system respectively.

[0048] An embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium memory stores a computer program, and when the computer program is executed by one or more processors, the above method is implemented.

[0049] Additional aspects and advantages of the embodiments of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0051] Figure 1 This is one of the flow charts of the information protection method according to the embodiment of the present application;

[0052] Figure 2 is a schematic diagram of an example of an information protection method according to an embodiment of the present application;

[0053] Figure 3 This is a schematic diagram of data transmission based on SRv6 in an embodiment of the present application;

[0054] Figure 4 This is the second flow chart of the information protection method according to the embodiment of the present application;

[0055] Figure 5 This is the third flow chart of the information protection method according to the embodiment of the present application;

[0056] Figure 6 This is the fourth flow chart of the information protection method according to the embodiment of the present application;

[0057] Figure 7 This is the fifth flow chart of the information protection method according to the embodiment of the present application;

[0058] Figure 8 This is a schematic diagram of HMAC TLV field information in an embodiment of the present application;

[0059] Figure 9 is a schematic structural diagram of an SRH according to an embodiment of the present application;

[0060] Figure 10 This is the sixth flowchart of the information protection method according to the embodiment of the present application;

[0061] Figure 11 This is one of the flow charts of the communication method according to the embodiment of the present application;

[0062] Figure 12is a schematic diagram of an example of a communication method according to an embodiment of the present application;

[0063] Figure 13 This is the second flow chart of the communication method according to the embodiment of the present application;

[0064] Figure 14 This is the third flow chart of the communication method according to the embodiment of the present application. DETAILED DESCRIPTION

[0065] The embodiments of the present application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of the present application, and should not be understood as limiting the embodiments of the present application.

[0066] With the rapid development of the internet, Internet protocols are constantly being updated and iterated. The most widely used version of the Internet Protocol is IPv6, which not only addresses the limited IPv4 address space in the Internet Protocol version 4 but also provides a more secure, efficient, and flexible communication protocol for the future development of the internet. With its widespread deployment, IPv6 will play a vital role in promoting the advancement of internet technology and expanding its applications.

[0067] One approach to applying IPv6 is Segment Routing (SR) over IPv6 (SRv6), a network routing technology that combines Segment Routing (SR) with the IPv6 protocol. This technology encapsulates a segment list (SID list) in the SR header (SRH) of an IPv6 packet to control the packet forwarding path. This provides a flexible and efficient routing solution. Segment Routing (SR) is a source routing protocol, also known as a segment routing protocol. The source node specifies the forwarding path and converts the path into an ordered segment list (SID list) that is encapsulated in the packet header. SRv6 converts the path into an ordered segment list (SID list) and encapsulates it in the packet header. SRv6 converts the path into an ordered segment list (SID list) and encapsulates it in the packet header. This is done by inserting an ordered segment list into the packet header to guide the processing and forwarding of received packets, thereby enabling traffic scheduling and orchestration, and achieving refined SLA service assurance for services.

[0068] Although SRv6 network routing technology provides a flexible and efficient routing solution, packets sent using SRv6 can be intercepted by attackers on the network. Attackers can tamper with the SID list encapsulated in the SR header of an IPv6 packet, forcing the packet to be sent to a network device of their choice. This allows the data carried in the packet to be hijacked or used to attack the designated network device. This compromises the security of the packet transmission on network communication links and undermines the foundation of trust in the network.

[0069] Based on the above questions, please refer to Figure 1 The present application provides an information protection method based on SRv6 technology. The information protection method is used for a network device and includes the following steps:

[0070] 011: Obtain quantum key;

[0071] 012: Encrypt the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information to protect the segment identification information.

[0072] The present application also provides a network device including a memory and a processor. The information protection method of the present application can be implemented by the network device of the present application. Specifically, the memory stores a computer program, and the processor is configured to obtain a quantum key and encrypt segment identification information in a segment routing message header using the quantum key to obtain quantum segment identification information, thereby protecting the segment identification information.

[0073] The embodiments of the present application also provide an information protection device. The information protection method of the embodiments of the present application can be implemented by the information protection device of the embodiments of the present application. Specifically, the information protection device includes an acquisition module and an encryption module. The acquisition module is used to obtain a quantum key. The encryption module is used to encrypt the segment identification information in the segment routing message header using the quantum key to obtain quantum segment identification information, thereby protecting the segment identification information.

[0074] The present application provides a communication system, which includes the network device of the above embodiment, as well as a controller and a quantum key management system, wherein the network device is communicatively connected to the controller and the quantum key management system respectively.

[0075] Specifically, network devices provide information protection, offering data encapsulation and segment routing header encryption and decryption capabilities to ensure the confidentiality and integrity of segment routing header information. The controller manages network device registration and acts as a quantum key application agent. The controller also controls the configuration and distribution of quantum keys, encryption algorithms, and authentication algorithms. The quantum key management system applies for and distributes quantum keys through the controller and network devices, and also connects directly to network devices to inject quantum master keys. The quantum key management system provides quantum key-based national secret algorithm capabilities, unified cryptographic access specifications for controllers and network devices, and enables multi-level cryptographic security applications.

[0076] In certain embodiments, see Figure 2 , the network device in the above-mentioned communication system is a quantum-safe SRv6 device. The quantum-safe SRv6 device and the quantum key management system communicate through the controller, such as for key application and key distribution. When the quantum-safe SRv6 device sends a quantum key application, the controller receives the quantum key application and performs a series of processing, and then sends the processed quantum key application to the quantum key management service. When the quantum key application is approved, the controller obtains the quantum key distributed by the quantum key management system, and then distributes the quantum key to the quantum-safe SRv6 device. In addition, the secure medium in the quantum-safe SRv6 device is also directly connected to the quantum key management service, and is pre-filled with quantum keys from the quantum key management service. The secure medium is a certificate issued by the relevant unit that complies with relevant standards and has security protection capabilities. In the embodiment of this application, the secure medium is a security chip such as a secure SIM card or a secure TF card.

[0077] Specifically, in the embodiments of the present application, the segment routing message header is used to store and transmit path information, including multiple segment identification information. The segment identification information is used to guide the forwarding path of the data. The network device obtains a quantum key and then encrypts the segment identification information in the segment routing message header using the quantum key to obtain quantum segment identification information, thereby protecting the segment identification information.

[0078] The following example illustrates the information protection method used in the embodiments of this application. In this embodiment, the quantum-safe SRv6 device is a network device. SRv6 refers to the use of Segment Routing in IPv6 networks, using IPv6 addresses as SIDs. SRv6 nodes forward packets based on segments. SRv6 encapsulates a SID list in the SR header (SRH) of an IPv6 packet to control the packet forwarding path. The SR header is the Segment Routing Header, hereinafter referred to as the SRH. The Segment List (SID List) is segment identification information, hereinafter referred to as the SID List. The SRH includes the SID List.

[0079] See also Figure 3 The diagram of SRv6-based data transmission is shown in the figure. This diagram is for reference only. Different implementations may use different data transmission methods, which are determined according to actual needs and are not limited here. There are four network devices in the figure: network device A, network device B, network device C, and network device D. Network device A is the starting point of the IPv6 message, and network device D is the end point of the IPv6 message. The IPv6 message carries an SRH, which contains a SID list. The SID is used to guide the forwarding path of the IPv6 message, and the SL is used to indicate the number of remaining network devices that the IPv6 message needs to pass through.

[0080] Please refer again Figure 2 , the quantum security SRv6 device obtains the quantum key, and then encrypts the SID list in the SRH according to the quantum key to obtain the quantum SID list to protect the SID list.

[0081] In summary, in the information protection method, communication method, network device, and communication system of the embodiments of this application, the network device encrypts the segment identification information in the segment routing header using a quantum key to obtain quantum segment identification information. Quantum keys offer extremely strong confidentiality, preventing attackers from stealing data without detection. The resulting quantum segment identification information maintains excellent confidentiality and enables secure and efficient storage and transmission of information required for segment routing.

[0082] See also Figure 4 In some embodiments, the network device is respectively connected to the controller and the quantum key management system in communication, and step 011 (obtaining the quantum key) includes the steps of:

[0083] 0111: Initiate a quantum key application to the quantum key management system through the controller;

[0084] 0112: Receive the first key information distributed by the quantum key management system according to the quantum key application;

[0085] 0113: Decrypt the first key information to obtain a quantum key and a quantum key identifier corresponding to the quantum key.

[0086] In certain embodiments, the application module is configured to initiate a quantum key application to a quantum key management system via a controller. The receiving module is configured to receive first key information distributed by the quantum key management system in response to the quantum key application. The decryption module is configured to decrypt the first key information to obtain a quantum key and a quantum key identifier corresponding to the quantum key.

[0087] In some embodiments, the processor is further configured to initiate a quantum key application to a quantum key management system through a controller, receive first key information distributed by the quantum key management system based on the quantum key application, and decrypt the first key information to obtain a quantum key and a quantum key identifier corresponding to the quantum key.

[0088] Specifically, a quantum key application includes the network device's security device identifier, which includes the network device's integrated security medium identifier and network device identifier. The quantum key management system encrypts the second key information using the quantum master key to obtain the first key information. The second key information is randomly generated by the quantum key management system. The quantum master key is pre-filled in the network device and determined based on the security device identifier. The network device initiates a quantum key application to the quantum key management system via a controller. The network device then receives the first key information distributed by the quantum key management system based on the quantum key application.

[0089] The second key information includes a number of initial quantum keys corresponding to the number of quantum keys and an initial quantum key corresponding to the length of the quantum key. Finally, the network device decrypts the first key information to obtain the quantum key and its corresponding quantum key identifier. Quantum keys offer extremely strong confidentiality, preventing attackers from stealing data without detection. The quantum key identifier facilitates the management and use of quantum keys. The resulting quantum key and quantum key identifier can be used in subsequent communication processes to enhance confidentiality.

[0090] Continuing with the above example, please refer again to Figure 2The secure medium used to store quantum keys is typically a secure SIM card or secure TF card, but other devices or equipment capable of storing quantum keys may also be used. This is determined based on actual needs and is not limited here. The quantum-safe SRv6 device initiates a quantum key request to the quantum key management system through the controller. The quantum key request includes the ID of the secure medium integrated with the quantum-safe SRv6 device, the number of quantum keys required by the quantum-safe SRv6 device, and the required quantum key length (an integer multiple of 16 bytes). The quantum-safe SRv6 device then receives the first key information distributed by the quantum key management system based on the quantum key request. The first key information is obtained by the quantum key management system by encrypting the second key information using the quantum master key. The second key information is randomly generated by the quantum key management system. The quantum master key is pre-filled in the network device and determined based on the security device identifier.

[0091] The second key information includes a number of initial quantum keys corresponding to the number of quantum keys required by the quantum-safe SRv6 device and an initial quantum key of a length corresponding to the quantum key length required by the quantum-safe SRv6 device. The quantum key management system pre-fills the secure media ID integrated with the quantum-safe SRv6 device with the quantum master key through filling software. The quantum master key is used to encrypt the second key message to obtain the first key message, protecting the security of the second key message during transmission.

[0092] Finally, the quantum secure SRv6 device decrypts the first key information to obtain quantum keys and quantum key identifiers corresponding to the number of quantum keys required by the SRv6 device.

[0093] This allows the quantum-safe SRv6 device to obtain the quantum keys and quantum key identifiers corresponding to the number of quantum keys required by the SRv6 device. Quantum keys provide strong confidentiality, preventing attackers from stealing data without detection. Quantum key identifiers facilitate the management and use of quantum keys. These quantum keys and quantum key identifiers can be used in subsequent communications to enhance confidentiality.

[0094] See also Figure 5 In some embodiments, step 0111 (initiating a quantum key application to a quantum key management system via a controller) includes the following steps:

[0095] 01111: Initiate a quantum key request to the quantum key management system through the controller at every preset interval.

[0096] In some embodiments, the initiating module is configured to initiate a quantum key application to the quantum key management system through the controller at every preset period.

[0097] In some embodiments, the processor is further configured to initiate a quantum key application to the quantum key management system through the controller at every preset period.

[0098] Specifically, network devices set a preset period and then initiate quantum key requests to the quantum key management system through the controller at each preset period. This regular initiation of quantum key requests ensures that the key is regularly updated. Even if the quantum key is illegally obtained at some point in time, regular updates will render the illegally obtained key invalid in the near future, reducing the risk of key leakage.

[0099] Continuing with the above example, please refer again to Figure 2 The quantum-safe SRv6 device sets a preset period, and then initiates a quantum key request to the quantum key management system through the controller every preset period. The above preset period can be any time interval such as 24 hours, 12 hours, 8 hours, etc., which is determined according to actual communication needs and is not limited here.

[0100] In this way, quantum-safe SRv6 devices can ensure regular key updates by regularly initiating quantum key requests. Even if a quantum key is illegally obtained at some point in time, regular updates can render the illegally obtained key invalid, reducing the risk of key leakage to a certain extent.

[0101] See also Figure 6 In some embodiments, the information protection method further comprises the steps of:

[0102] 013: Initiate a registration request to the controller. The registration request includes the security device identifier of the network device so that the controller can perform security authentication with the quantum key management system.

[0103] In some embodiments, the initiating module is configured to initiate a registration request to the controller, where the registration request includes a security device identifier of the network device, so as to perform security authentication with the quantum key management system through the controller.

[0104] In some embodiments, the processor is further configured to initiate a registration request to the controller, where the registration request includes a security device identifier of the network device, so as to perform security authentication with the quantum key management system through the controller.

[0105] Specifically, the secure device identifier includes the network device identifier and the secure medium identifier integrated into the network device. The network device initiates a registration request to the controller, including its secure device identifier, for security authentication with the quantum key management system via the controller. This secure device identifier is used to authenticate the quantum key management system, using the controller as a transit point. This ensures that the authenticated network device can obtain quantum keys.

[0106] Continuing with the above example, please refer again to Figure 2 The quantum-safe SRv6 device initiates a registration request to the controller. The registration request includes the quantum-safe SRv6 device SN and the quantum-safe SRv6 device's integrated secure media ID, so that the controller can authenticate the quantum key management system through the controller. After receiving the registration request, the controller stores the relationship between the quantum-safe SRv6 device SN and the quantum-safe SRv6 device's integrated secure media ID, and uses the received quantum-safe SRv6 device SN and quantum-safe SRv6 device's integrated secure media ID information to authenticate the quantum key management system.

[0107] In this way, through the quantum-safe SRv6 device SN and the secure media ID integrated in the quantum-safe SRv6 device, the controller is used as a transit station to perform security authentication on the quantum key management system, ensuring that network devices that have passed the security authentication can obtain quantum keys.

[0108] See also Figure 7 In some embodiments, the information protection method further comprises the steps of:

[0109] 014: Store the quantum key identifier and quantum segment identifier information in a preset field in the segment routing message header.

[0110] In some embodiments, the storage module is used to store the quantum key identifier and quantum segment identifier information in a preset field in the segment routing message header.

[0111] In some embodiments, the processor is further configured to store the quantum key identifier and the quantum segment identifier information in a preset field in the segment routing message header.

[0112] Specifically, network devices store the quantum key identifier and quantum segment identifier information in pre-defined fields within the segment routing header. The quantum key identifier can be used to verify the integrity of the data packet, while the quantum segment identifier indicates the specific network segment the data packet must traverse. By storing these two information within the segment routing header, network devices can securely and precisely control the forwarding path of data packets.

[0113] Continuing with the above example, the HMAC TLV field is a default field. Please refer to Figure 2 , a quantum-safe SRv6 device stores the quantum key identity and quantum SID list in the HMAC TLV field in the SRH.

[0114] See also Figure 8The general structure of the HMAC TLV field is shown in the figure. This diagram is for reference only. Different implementations may use different structures based on actual needs and are not limited here. Type represents the type of the HMAC TLV field. Length represents the length of the HMAC TLV field, namely Type, Length, RESERVED, HMAC Key ID, and the total length of the HMAC message. RESERVED represents an extension field of the HMAC TLV field. HMAC Key ID represents the quantum key identifier. HMAC represents the quantum SID list obtained by encrypting the SID list using a hash algorithm and a quantum key.

[0115] See also Figure 9 The standard location of the HMAC TLV field in the SRH is shown in the figure. This diagram is for reference only. Different implementations may use different locations based on actual needs and are not limited here. Segment List is the Segment list, i.e., the SID list; Payload represents the IPv6 payload, i.e., the actual IPv6 data.

[0116] Because the quantum key identifier can be used to verify the integrity of the data packet, and the quantum segment identifier indicates the specific network segment the data packet needs to pass through, by storing the quantum key identifier and quantum SID list in the segment routing message header, the quantum-safe SRv6 device can securely and precisely control the forwarding path of the data packet.

[0117] See also Figure 10 In some embodiments, step 012 (encrypting the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information to protect the segment identification information) includes the steps of:

[0118] 0121: Encrypt the segment identification information according to the quantum key and a preset encryption algorithm to obtain quantum segment identification information to protect the segment identification information.

[0119] In some embodiments, the encryption module is used to encrypt the segment identification information according to the quantum key and a preset encryption algorithm to obtain quantum segment identification information, so as to protect the segment identification information.

[0120] In some embodiments, the processor is further configured to encrypt the segment identification information according to the quantum key and a preset encryption algorithm to obtain quantum segment identification information, so as to protect the segment identification information.

[0121] Specifically, the network device encrypts the segment identification information using a quantum key and a pre-set encryption algorithm to obtain quantum segment identification information, thereby protecting the segment identification information. By encrypting the segment identification information using a quantum key and encryption algorithm, even if the data is intercepted, it cannot be easily decrypted or understood, ensuring the security of the segment identification information during transmission.

[0122] Continuing with the above example, the default encryption algorithm is the HMAC algorithm. In other implementations, encryption functions such as the AES encryption algorithm, the DES algorithm, and the secure hash algorithm can also be used. This is determined based on actual needs and is not limited here. Please refer to Figure 2 The quantum-safe SRv6 device encrypts the SID list using the quantum key and the preset encryption algorithm to obtain the quantum SID list to protect the SID list. Figure 8 ,The encryption process of SID list and quantum key is shown in the figure.

[0123] In this way, the quantum-safe SRv6 device encrypts the segment identification information by using quantum keys and encryption algorithms. In this way, even if the data is intercepted, the segment identification information cannot be easily obtained, ensuring the security of the segment identification information during transmission.

[0124] See also Figure 11 The embodiment of the present application provides a communication method, which is used for a network device and includes the following steps:

[0125] 021: receiving data information sent by a previous network device in a communication link where the network device is located, the data information including a segment routing message header processed based on any of the above information protection methods;

[0126] 022: Analyze the data information and obtain the quantum key identification;

[0127] 023: Securely verify data information based on quantum key identification;

[0128] 024: If the security verification is passed, the data information is sent to the next network device in the communication link where the network device is located.

[0129] In certain embodiments, the receiving module is further configured to receive data information sent by a previous network device in the communication link where the network device resides, the data information including a segment routing message header processed using any of the aforementioned information protection methods. The parsing module is configured to parse the data information to obtain a quantum key identifier. The verification module is further configured to perform security verification on the data information based on the quantum key identifier. The sending module is configured to send the data information to the next network device in the communication link where the network device resides, if the security verification passes.

[0130] In certain embodiments, the processor is further configured to receive data information sent by a previous network device in a communication link where the network device is located, the data information including a segment routing message header obtained by processing based on any of the above-mentioned information protection methods, and to parse the data information to obtain a quantum key identifier, and to perform security verification on the data information based on the quantum key identifier, and to send the data information to the next network device in the communication link where the network device is located if the security verification passes.

[0131] Specifically, a communication link is a physical or logical connection between network devices for transmitting data. A network device receives data information sent by the previous network device in its communication link. The data information includes a segment routing message header processed using any of the aforementioned information protection methods. The network device parses the data information to obtain a quantum key identifier. The network device then performs security verification on the data information based on the quantum key identifier. If the security verification passes, the network device sends the data information to the next network device in its communication link.

[0132] Continuing with the above example, see Figure 12 All quantum-secure SRv6 devices in the communication link where quantum-secure SRv6 device B resides are identical to quantum-secure SRv6 device B and are connected to the quantum key management system and controller, respectively. Quantum-secure SRv6 device B receives data information sent by quantum-secure SRv6 device A in the communication link where quantum-secure SRv6 device B resides. The data information includes the SRH obtained through processing using the information protection method described in the above embodiment. Quantum-secure SRv6 device B parses the data information and obtains a quantum key identifier. Quantum-secure SRv6 device B then performs security verification on the data information based on the quantum key identifier. If the security verification passes, quantum-secure SRv6 device B sends the data information to quantum-secure SRv6 device C in the communication link where quantum-secure SRv6 device B resides.

[0133] In this way, within a communication link, a network device uses the quantum key identifier to parse the data sent by the previous network device to obtain the quantum key identifier. The network device then performs security verification on the data based on the obtained quantum key identifier. If the security verification passes, the network device transmits the data to the next network device in the communication link. This ensures the security of the communication link while improving data forwarding efficiency.

[0134] See also Figure 13 In some embodiments, step 023 (security verification of data information based on quantum key identification) includes the steps of:

[0135] 0231: Query the quantum key corresponding to the quantum key identifier in the network device according to the quantum key identifier;

[0136] 0232: When a quantum key corresponding to a quantum key identifier is found in a network device, the data information security is confirmed by the quantum key.

[0137] In certain embodiments, the query module is further configured to query the network device for a quantum key corresponding to the quantum key identifier based on the quantum key identifier. The confirmation module is further configured to confirm the security of the data information using the quantum key when the quantum key corresponding to the quantum key identifier is found in the network device.

[0138] In some embodiments, the processor is further configured to query a network device for a quantum key corresponding to the quantum key identifier based on the quantum key identifier, and to confirm data information security through the quantum key when a quantum key corresponding to the quantum key identifier is found in the network device.

[0139] Specifically, the network device searches for the quantum key corresponding to the quantum key identifier in the network device based on the quantum key identifier. If the quantum key corresponding to the quantum key identifier is found in the network device, the network device uses the quantum key to confirm the security of the data information. After the quantum key corresponding to the quantum key identifier is found in the network device, the retrieved quantum key is used to verify whether the segment routing message header has been tampered with, thereby confirming the security of the data information.

[0140] Continuing with the previous example, the quantum-safe SRv6 device uses the quantum key identifier to query the secure medium integrated with the quantum-safe SRv6 device for the quantum key corresponding to the quantum key identifier. If the quantum key corresponding to the quantum key identifier is found in the secure medium, the quantum-safe SRv6 device verifies the security of the data information using the quantum key.

[0141] In this way, after the quantum key corresponding to the quantum key identifier is queried in the quantum security SRv6 device, the SRH is verified to see if it has been tampered with based on the queried quantum key, thereby confirming the security of the data information.

[0142] See also Figure 14 In some embodiments, step 023 (security verification of data information based on quantum key identification) includes the steps of:

[0143] 0233: If the quantum key corresponding to the quantum key identifier is not found in the network device, the quantum key corresponding to the quantum key identifier is queried from the quantum key management system according to the quantum key identifier;

[0144] 0234: When a quantum key corresponding to a quantum key identifier is found in the quantum key management system, the data information security is confirmed by the quantum key;

[0145] 0235: When the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, a data information security anomaly is confirmed.

[0146] In certain embodiments, the query module is further configured to, if the quantum key corresponding to the quantum key identifier is not found in the network device, query the quantum key corresponding to the quantum key identifier from the quantum key management system based on the quantum key identifier. The confirmation module is configured to, if the quantum key corresponding to the quantum key identifier is found in the quantum key management system, confirm the security of the data information using the quantum key. The confirmation module is further configured to, if the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, confirm that the data information security is abnormal.

[0147] In certain embodiments, the processor is further configured to, if a quantum key corresponding to the quantum key identifier is not found in the network device, query the quantum key corresponding to the quantum key identifier from the quantum key management system according to the quantum key identifier; and, if a quantum key corresponding to the quantum key identifier is found in the quantum key management system, confirm the security of the data information through the quantum key; and, if a quantum key corresponding to the quantum key identifier is not found in the quantum key management system, confirm that the data information security is abnormal.

[0148] Specifically, if the network device fails to find the quantum key corresponding to the quantum key identifier, the network device queries the quantum key management system for the quantum key corresponding to the quantum key identifier based on the quantum key identifier. If the quantum key corresponding to the quantum key identifier is found in the quantum key management system, the network device verifies the security of the data information using the quantum key. If the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, a data information security anomaly is determined. Thus, by finding the quantum key corresponding to the quantum key identifier in the quantum key management system, the segment routing message header is verified to be tampered with based on the found quantum key, thereby confirming the security of the data information. If the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, a data information security anomaly is determined.

[0149] Continuing with the above example, if the quantum key corresponding to the quantum key identifier is not found in the quantum-safe SRv6 device's secure medium, the quantum-safe SRv6 device queries the quantum key management system for the quantum key corresponding to the quantum key identifier based on the quantum key identifier. If the quantum key corresponding to the quantum key identifier is found in the quantum key management system, the quantum-safe SRv6 device verifies the security of the data information using the quantum key. If the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, the quantum-safe SRv6 device determines that the data information security is abnormal. In this way, the quantum-safe SRv6 device verifies whether the SRH has been tampered with based on the found quantum key by querying the quantum key corresponding to the quantum key identifier in the quantum key management system, thereby confirming the security of the data information. If the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, the quantum-safe SRv6 device determines that the data information has been tampered with or viewed.

[0150] In this way, the quantum-safe SRv6 device retrieves the quantum key corresponding to the quantum key identifier from the quantum key management service. It then uses the retrieved quantum key to verify whether the segment routing message header has been tampered with, confirming the security of the data information. If no quantum key identifier is retrieved, the SRH has been tampered with or viewed. The quantum-safe SRv6 device ensures the security and confidentiality of the SRH by using quantum keys.

[0151] The present application also provides a computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, the one or more processors execute the method of the present application.

[0152] It is understood that a computer program includes computer program code. The computer program code may be in source code form, object code form, executable file, or some intermediate form. Computer-readable storage media may include any entity or device capable of carrying computer program code, recording media, USB flash drives, removable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media.

[0153] In the description of this specification, the descriptions with reference to the terms "particularly", "further", "particularly", "understandably", etc. are intended to mean that the specific features, structures, materials or characteristics described in conjunction with the embodiments or examples are included in at least one embodiment or example of the present application. In this specification, the schematic expressions of the above terms are not intended to refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, unless they are contradictory.

[0154] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0155] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. An information protection method based on SRv6 technology, characterized in that: The information protection method is used for a network device, wherein the network device is respectively connected to a controller and a quantum key management system for communication, and the quantum key management system applies for and distributes quantum keys with the network device through the controller. The method comprises: Initiate a quantum key application to the quantum key management system through the controller; receiving, by the controller, first key information distributed by the quantum key management system according to the quantum key application; Decrypting the first key information to obtain the quantum key and a quantum key identifier corresponding to the quantum key; Encrypting the segment identification information in the segment routing message header according to the quantum key and a preset encryption algorithm to obtain quantum segment identification information to protect the segment identification information, wherein the encryption algorithm includes a hash algorithm; The quantum key identifier and the quantum segment identifier information are stored in an HMAC TLV field in a segment routing message header, wherein the HMAC TLV field includes a Type unit, a Length unit, a RESERVED unit, an HMAC Key ID unit, and an HMAC unit, wherein the Type unit is used to indicate the type of the HMAC TLV field, the Length unit is used to indicate the length of the HMAC TLV field, the RESERVED unit is used to indicate an extended field of the HMAC TLV field, the HMAC Key ID unit is used to indicate the quantum key identifier, and the HMAC unit is used to indicate the quantum segment identifier information.

2. The information protection method according to claim 1, characterized in that: The initiating a quantum key application to the quantum key management system through the controller includes: A quantum key application is initiated to the quantum key management system through the controller at every preset period.

3. The information protection method according to claim 1, characterized in that: The quantum key application includes the security device identification of the network device, the first key information is obtained by the quantum key management system through encryption processing of the second key information according to the quantum master key, the second key information is randomly generated by the quantum key management system, and the quantum master key is pre-filled in the network device and determined according to the security device identification.

4. The information protection method according to claim 3, characterized in that: The quantum key application further includes the number of quantum keys, and the second key information further includes the number of initial quantum keys corresponding to the number of quantum keys; and / or The quantum key application also includes a quantum key length, and the second key information also includes an initial quantum key corresponding to the quantum key length.

5. The information protection method according to claim 1, characterized in that: The information protection method further includes: A registration request is initiated to the controller, where the registration request includes a security device identifier of the network device, so as to perform security authentication on the quantum key management system through the controller.

6. A communication method, characterized in that: The communication method is used for the network device, and the communication method includes: Receiving data information sent by a previous network device in the communication link where the network device is located, the data information comprising a segment routing message header obtained by processing the information protection method based on the SRv6 technology according to any one of claims 1 to 5; Parsing the data information to obtain a quantum key identifier; Performing security verification on the data information according to the quantum key identifier; When the security verification is passed, the data information is sent to the next network device in the communication link where the network device is located.

7. The communication method according to claim 6, characterized in that: The performing security verification on the data information according to the quantum key identification includes: According to the quantum key identifier, querying the network device for a quantum key corresponding to the quantum key identifier; When a quantum key corresponding to the quantum key identifier is queried in the network device, the data information security is confirmed by the quantum key.

8. The communication method according to claim 7, characterized in that: The performing security verification on the data information according to the quantum key identification comprises: If the quantum key corresponding to the quantum key identifier is not found in the network device, querying the quantum key corresponding to the quantum key identifier from the quantum key management system according to the quantum key identifier; When a quantum key corresponding to the quantum key identifier is found in the quantum key management system, the data information security is confirmed by using the quantum key; When the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, it is confirmed that the data information security is abnormal.

9. A network device, characterized in that: The network device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the method according to any one of claims 1 to 5 or claims 6 to 8 is implemented.

10. A communication system, characterized in that: The communication system comprises the network device, controller and quantum key management system as claimed in claim 9, and the network device is communicatively connected with the controller and the quantum key management system respectively.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium memory stores a computer program, and when the computer program is executed by one or more processors, the method according to any one of claims 1 to 8 is implemented.

Images