A method and apparatus for querying routing paths

Abstract

This application provides a method and apparatus for querying routing paths, applied to the third switching layer of a quantum secure communication network. The method includes: acquiring a message to be transmitted; querying the minimum domain containing the IP address of the destination node in a link-state database, and using this minimum domain as a first target domain; querying the sibling domain at the same level as the first target domain containing the IP address of the source node in the link-state database, and using this sibling domain as a second target domain; calculating the shortest path from the second target domain to the first target domain, and finding the IP address of the boundary node between the second target domain and the first target domain; if the IP address of the source node equals the IP address of the boundary node, using the boundary node as a first-hop node; and routing the message to be transmitted to the first-hop node. This approach achieves the technical effect of accurately determining the routing path.

Description

Technical Field

[0001] This application belongs to the field of communication network technology, and in particular relates to a method and apparatus for querying routing paths. Background Technology

[0002] Internet technology has become the most important infrastructure supporting modern socio-economic development, social progress, and technological innovation, and its operation and service models have matured. With the continuous development of quantum technology in recent years, quantum secure communication systems have also emerged.

[0003] Unlike existing internet technologies, the data transmitted in quantum secure communication networks uses quantum keys. The operation mode, service mode, and user network construction of quantum secure communication networks are fundamentally different from the current internet. Based on this, a switching network comprising a first, second, and third switching layer has been established. This network enables the construction of a rationally designed, secure, and efficient operation and service mode within the quantum secure communication network architecture, supporting users' quantum secure communication network needs.

[0004] However, the third switching layer of the switching network in this quantum secure communication network is user-oriented and requires message routing. Currently, there is no effective solution for how to quickly query the message routing path. Summary of the Invention

[0005] The purpose of this application is to provide a method and apparatus for querying routing paths, which can accurately and efficiently query the routing paths of messages.

[0006] This application provides a method and apparatus for querying routing paths, implemented as follows:

[0007] A routing path lookup method, applied to the third switching layer of a quantum secure communication network, includes:

[0008] Obtain the message to be transmitted, wherein the message to be transmitted carries the IP address of the source node and the IP address of the destination node;

[0009] The minimum domain containing the IP address of the destination node is queried in the link state database, and the minimum domain containing the IP address of the destination node obtained in the query is taken as the first target domain;

[0010] The link state database is queried to find the sibling domain at the same level as the first target domain where the IP address of the source node is located, and this domain is used as the second target domain.

[0011] Calculate the shortest path from the second target domain to the first target domain, and find the IP address of the boundary node of the second target domain from the second target domain to the first target domain;

[0012] Determine whether the IP address of the source node is equal to the IP address of the boundary node;

[0013] If the IP address of the source node is equal to the IP address of the boundary node, the boundary node is used as the first hop node.

[0014] The message to be transmitted is routed to the first hop node.

[0015] A routing path query device, comprising:

[0016] The acquisition module is used to acquire a message to be transmitted, wherein the message to be transmitted carries the IP address of the source node and the IP address of the destination node;

[0017] The first query module is used to query the minimum domain of the IP address of the destination node in the link state database, and take the minimum domain of the IP address of the destination node obtained by the query as the first target domain.

[0018] The second query module is used to query the link state database for the sibling domain at the same level as the first target domain where the IP address of the source node is located, and use it as the second target domain;

[0019] The lookup module is used to calculate the shortest path from the second target domain to the first target domain, and to find the IP address of the boundary node of the second target domain from the second target domain to the first target domain;

[0020] A determination module is used to determine whether the IP address of the source node is equal to the IP address of the boundary node;

[0021] A generation module is used to designate the boundary node as the first hop node when the IP address of the source node is equal to the IP address of the boundary node.

[0022] The routing module is used to route the message to be transmitted to the first hop node.

[0023] An electronic device includes a processor and a memory for storing processor-executable instructions, wherein the processor, when executing the instructions, implements the steps of the method described above.

[0024] A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0025] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the above-described method.

[0026] The routing path query method and apparatus provided in this application obtain a message to be transmitted, wherein the message to be transmitted carries the IP address of a source node and the IP address of a destination node; query the smallest domain containing the IP address of the destination node in a link state database, and use the smallest domain containing the IP address of the destination node as a first target domain; query the link state database for a sibling domain at the same level as the first target domain containing the IP address of the source node, and use it as a second target domain; calculate the shortest path from the second target domain to the first target domain, and find the IP address of the boundary node from the second target domain to the first target domain; determine whether the IP address of the source node is equal to the IP address of the boundary node; if the IP address of the source node is equal to the IP address of the boundary node, use the boundary node as a first hop node; and route the message to be transmitted to the first hop node. This method achieves accurate determination of the next-hop node of the message, thereby solving the problem of inaccurate message routing path determination in existing methods and achieving the technical effect of accurately determining the message routing path. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a schematic diagram of the key synchronization process provided in this application;

[0029] Figure 2 This is a schematic diagram illustrating the working principle of key synchronization provided in this application;

[0030] Figure 3 This is a schematic diagram of the general layered structure of the quantum secure communication network provided in this application;

[0031] Figure 4 This is a schematic diagram of one embodiment of the network architecture of the quantum secure communication network provided in this application;

[0032] Figure 5 This is a schematic diagram of the QKX-I network switching layer provided in this application;

[0033] Figure 6 This is a schematic diagram of the routing configuration and forwarding of the QKX-I network switching layer provided in this application;

[0034] Figure 7This is a schematic diagram of the IF and VQI of the QKX-I network switching layer provided in this application;

[0035] Figure 8 This is a schematic diagram of routing lookup at the QKX-I network switching layer provided in this application;

[0036] Figure 9 This is a network topology diagram of the QKX-II network switching layer provided in this application;

[0037] Figure 10 This is a diagram illustrating the hierarchical relationship of the District provided in this application;

[0038] Figure 11 This is a schematic diagram of the virtual link establishment process provided in this application;

[0039] Figure 12 This is a network topology diagram of the QKX-III network switching layer provided in this application;

[0040] Figure 13 This is a diagram illustrating the hierarchical relationship of the Area provided in this application;

[0041] Figure 14 This is the network topology diagram formed by the LSDB of R1 provided in this application;

[0042] Figure 15 This is a flowchart of one embodiment of the routing path query method provided in this application;

[0043] Figure 16 This is a hardware structure block diagram of an electronic device for a routing path query method provided in this application;

[0044] Figure 17 This is a schematic diagram of the module structure of one embodiment of the routing path query device provided in this application. Detailed Implementation

[0045] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0046] To better explain this application, some terms used in this specification are explained as follows:

[0047] The Quantum Secure Communication Network (QSCSN) is a quantum key distribution secure communication network built based on quantum communication technology.

[0048] Quantum key distribution (QKD) is a process in which two communicating parties achieve secure key distribution by transmitting quantum states. Any eavesdropping will be detected in time due to the disturbance of the quantum states.

[0049] A quantum key (QK) is a theoretically secure key generated by quantum key distribution in a quantum secure communication network. Its security is guaranteed by the fundamental laws of quantum mechanics.

[0050] Cryptographic Application System (CAS) is a business application system that uses cryptographic technology for security protection in the user's business network; it is also known as a cryptographic application or APP.

[0051] The Quantum Key Service System (QKS) is located between the quantum secure communication network and the user business network, providing functions such as secure quantum key output for cryptographic applications in the user business network.

[0052] A quantum key exchange system (QKX) is a system in a quantum secure communication network that enables key synchronization between remote nodes based on key exchange between neighboring nodes. The remote nodes refer to non-adjacent network nodes.

[0053] A quantum key distribution (QKD) system is a system in a quantum secure communication network that enables quantum key distribution between adjacent nodes.

[0054] A key pool is a buffer used to store consistent quantum keys between neighboring nodes or distant nodes (i.e., non-neighboring nodes).

[0055] A link (LK) represents a connection between network nodes (including adjacent and non-adjacent nodes).

[0056] An interface is a network interface through which adjacent network nodes exchange data, similar to the interface of a router, and is often abbreviated as IF.

[0057] The key pools are divided into Neighbor Pool (NP) and Application Pool (AP) based on the different quantum key pairing relationships. NP is a pair of key pools built between adjacent exchange nodes (QKX). Key synchronization can ensure that the quantum keys in the key pools of adjacent exchange nodes are completely consistent. AP is a pair of key pools built between service nodes (QKS). The keys in this pair of APs are directly provided to the quantum keys used by the cryptographic application (APP). That is, the quantum keys in APs do not need to be exchanged again, but are provided to the final keys used by the APP.

[0058] Key synchronization is the secure transmission of a quantum key from one network node (source node) to another remote network node (destination node), ensuring that the keys between the two nodes are completely identical. The NP of the source node is the sending key pool, and the NP of the destination node is the receiving key pool.

[0059] Assuming a quantum secure communication network is divided into M layers, then the NP key pool of layer N depends on the key synchronization of layer N-1, such as... Figure 1 As shown, between node A and node B, the QKX key synchronization at layer N needs to be secured and transmitted via QKX at layer N-1. Typically, the key is split into key fragments and transmitted hop-by-hop to the destination node (node ​​B) using the NP key pool of the intermediate node.

[0060] The key pool synchronization process includes:

[0061] S1: To limit the size of the key data packets that the network can transmit, a maximum transmission unit (MTU) is set. According to the size of the MTU, the key in the NP of the N-1 layer QKX is divided into several fragments.

[0062] S2: Node A queries the forwarding table (Forward) to find the next hop on the path to the destination node. After protecting the key fragment with the key in the NP of the (N-1)th layer QKX, it transmits it to the next hop intermediate node. After receiving the key fragment, the intermediate node decrypts it to obtain the plaintext key fragment, and then protects it with the key in its own and the next hop node's NP before continuing to transmit it to the next hop. This process is repeated iteratively until the destination node (i.e., node B) is reached.

[0063] S3: After receiving the key fragment, the (N-1)th layer QKX of node B decrypts it to obtain the plaintext key fragment. After confirming that the key fragment transmission is correct, it stores the key fragment in the key pool NP corresponding to the Nth layer QKX of node B.

[0064] Furthermore, considering that key pools appear in pairs among network nodes—that is, each sending key pool has a corresponding receiving key pool—the synchronization, transmission, and distribution of keys among the network nodes corresponding to the key pools constitute a quantum key network. However, the key pool itself does not have network interface functionality; in actual network links, a specific routing protocol is needed to determine the network path for key synchronization. Based on this, the concepts of Interface (IF) and Link (LK) are proposed in this example. Based on IF and LK, on ​​the one hand, key pools appearing in pairs can be constructed; on the other hand, layered design of network structure and routing protocols can be implemented.

[0065] The IF (Intense Link Function) is similar to a router's network interface, but unlike it, the IF is a virtual network interface. Its construction relies on the underlying QKX's LK (Link Key), which represents a virtual link association between remote (i.e., non-adjacent) network nodes. The synchronization process of the upper-layer IF quantum key can be achieved through the LK. Based on the IF and LK, it can be implemented as follows... Figure 2 Key synchronization is performed in this way. Figure 2 In the Nth layer, node A and node B are adjacent nodes, while in the (N-1)th layer, node A and node B are remote nodes. The key synchronization process is as follows:

[0066] S1: When the NP key pool of QKX at layer N is insufficient (usually below a certain threshold), a key synchronization request is sent to the LK at the next lower layer (i.e., layer N-1). LK identifies the association between two remote nodes A and B. Correspondingly, IF marks the network interface, pointing to the next adjacent relay node. If we use a train journey as an analogy, LK is the journey consisting of the starting station and the destination station, such as "City 1 - City N", while IF is the other nodes adjacent to node A, which can be compared to "City 3, City 4, City 5", etc.

[0067] S2: After LK receives the key request from QKX at layer N, it queries the Forward table for paths that meet the conditions and determines the corresponding IF (i.e., the next adjacent node) through the path. If we use a train journey as an analogy, the network interface identified by the IF at this time points to the first station passed when going to city N. It can be "city 3" or "city 4", depending on the specific network path planned by the routing protocol during routing by the Route module.

[0068] S3: After passing through the QKX relay node at layer N-1, the key is transmitted hop by hop to the destination node. The IF of the destination node receives the protected key fragments, decrypts them, and hands them over to the Forward module to determine which LK to process.

[0069] S4: LK transmits the key to the IF of the upper layer (Nth layer) QKX, and the IF stores the key in the corresponding NP key pool.

[0070] Because QKX can undergo multi-level iterations, a general hierarchical structure for quantum secure communication networks can be obtained, such as... Figure 3 As shown, n layers of switching nodes (1≤n≤N) can be designed according to actual needs. The NP key between QKX in the nth layer is achieved through key synchronization between remote nodes in the (n-1)th layer based on IF and LK. The key synchronization of the AP key pool is achieved through key synchronization between QKX-N in the Nth layer of switching nodes.

[0071] Based on this, this example presents a quantum secure communication network. Addressing the practical needs of network operators, network service providers, and user network construction, this network employs a three-layer quantum secure communication network switching structure suitable for network infrastructure developers, network operators, and user network construction. Network infrastructure developers, network operators, and users can construct, operate, and build user networks at different network layers, achieving a loosely coupled layered design for the quantum secure communication network. This quantum secure communication network can dynamically increase or decrease the number of quantum network switching layers according to actual needs without affecting network switching, demonstrating strong versatility and adaptability.

[0072] like Figure 4 As shown, the switching network of this quantum secure communication network is used to realize the networking and routing switching functions of the network. Depending on the networking technology, the switching network of this quantum secure communication network can be divided into three layers: QKX-I, QKX-II, and QKX-III. QKX-I and the links between them constitute the QKX-I switching network; QKX-II and the links between them constitute the QKX-II switching network; and QKX-III and the links between them constitute the QKX-III switching network. The QKX-III switching network is built on the basis of the QKX-II switching network, which in turn is built on the basis of the QKX-I switching network. The QKX-I switching network is built on the basis of the QKD (Quantum Key Distribution) system. Wherein:

[0073] 1) QKX-I:

[0074] QKX-I is the first-layer switching layer built on top of QKD. It is a low-level switching network built by network infrastructure developers. QKX-I sets up network nodes according to the actual needs of quantum key distribution services. The types of network nodes in QKX-I include: switching nodes and relay nodes. Switching nodes are connected to ≥3 links, that is, switching nodes have 3 or more Interfaces (IFs, network interfaces for data exchange between adjacent network nodes). Relay nodes are connected to two links, one in and one out, that is, relay nodes have only two Interfaces (IFs).

[0075] like Figure 5 As shown, taking "City 1 - City 2 - City 3" as an example, a QKD relay is set up at the City 2 station to extend the quantum transmission distance. However, if both City 1 and City 3 have quantum key requirements, while City 2 does not, then the transmission link that needs to be built in QKX-I is "City 1 - City 3," with City 2 only used for quantum key relay. The QKX-I link "City 1 - City 3" relies on the QKD link "City 1 - City 2 - City 3." In other words, it is a "virtual link," equivalent to building a direct QKD QKX-I link in "City 1 - City 3." Therefore, this virtual link is called Link (abbreviated as LK), and LK is assigned a VQI (Virtual QKDIdentifier, the virtual QKD's identifier).

[0076] Taking the "City 1 - City 10" segment as an example, route configuration, route distribution, and route lookup can be performed as follows:

[0077] The QKX-I switching layer uses static routing, where routes are pre-established manually by the network management system. Regardless of whether a user terminal initiates a service, the route remains unchanged. That is, the route configuration is completed by the network management system in one go and distributed to each switching node and relay node until the route is no longer used, at which point it is manually released by the network management system.

[0078] like Figure 6 As shown, the network management system collects information, plans routes, and distributes routes across the entire QKX-I network through the routing computation center. First, the network management system analyzes the quantum key requirements of each network node and between nodes, collecting information such as key production rate, key consumption rate, and key freshness. Then, the routing computation center calculates the optimal path for key routing according to a predetermined routing algorithm, providing the network management system with a routing scheme. The network management system then plans the entire QKX-I switching layer's routing based on the actual situation. Finally, the network management system distributes the planned QKX-I routing information to each network switching node and relay node in the form of a "forwarding table."

[0079] QKX-I nodes determine how messages are forwarded by querying the forwarding table, the structure of which is shown in Table 1 below:

[0080] Table 1

[0081] IF-I VQI-I IF-O VQI-O

[0082] The forwarded document can contain the following four items:

[0083] (1) IF_I: Represents the ID of the input direction (i.e., IN direction) IF. For messages from LK, its IF_I is 0;

[0084] (2) VQI_I: Represents the VQI (virtual quantum key distribution number) in the input direction (i.e., the IN direction);

[0085] (3) IF_O: Represents the ID of the output direction (i.e., OUT direction) IF. For messages from LK, its IF_I is 0;

[0086] (4) VQI_O: Represents the VQI (virtual quantum key distribution number) of the output direction (i.e., the OUT direction).

[0087] Similar to virtual circuits, IF represents a virtual path in a virtual circuit, and VQI represents a virtual channel in a virtual circuit, such as... Figure 7 As shown, by using the pairs (IF-I, VQI-I) and (IF-O, VQI-O) that appear in the forwarding table, the virtual path and virtual channel of data forwarding are determined, and then the data forwarding is completed. After querying the forwarding table, (IF1, VQI1) can be used to determine the forwarding path and channel as (IF1', VQI1').

[0088] The IF_O parameter specifies the forwarding direction of the network interface, while the VQI_O parameter specifies which lower-layer LK (Learning Key) will be used for forwarding. If the network node is a relay node, the direction of the IF_O is usually fixed, and its corresponding forwarding table structure is relatively simple. If the network node is a switching node, the direction of the IF_O can be multiple, requiring the forwarding table to determine the IF_O and VQI_O. For example... Figure 8 As shown, City 1 is the switching node for "City 0 - City 8" and "City 0 - City 11". Querying (IF-I, VQI-I1) in the forwarding table yields (IF-O1, VQI-O1), and querying (IF-I, VQI-I2) yields (IF-O2, VQI-O2). (IF-O1, VQI-O1) and (IF-O2, VQI-O2) determine that City 1 node has one virtual circuit leading to City 8 and City 11 respectively. Correspondingly, in the QKD layer, VQI corresponds to different LKs (LK1, LK2).

[0089] 2) QKX-II:

[0090] QKX-II is the second-layer switching network of the quantum secure communication network, configured, operated, and managed by operators. Basic operational management such as bandwidth leasing, bandwidth allocation, and bandwidth release can be easily performed through QKX-II. QKX-II primarily connects different QKX-I networks (e.g., QKX-I networks from different operators) based on users' network interconnection needs for quantum key distribution.

[0091] The QKX-II uses a hierarchical, district-based networking approach, such as... Figure 9 The diagram shows a four-layer network structure with nine districts. Each ellipse represents a district, and each district has only one network node and its connected links. Figure 10 The diagram shows the hierarchical relationship of the District.

[0092] like Figure 10 As shown, QKX-II network nodes use an addressing method similar to telephone numbers. The prefix of a child district address is the address of its parent district. In other words, the prefix of a child district address indicates its parent district, similar to how the area code of a telephone number indicates its administrative region. For example, Distinct5's address is "01083631122", and its corresponding prefix is ​​"0108363", indicating that its parent district is Distinct5. Similarly, District3's address is "0108363", and its corresponding prefix is ​​"010", indicating that its parent district is Distinct1.

[0093] QKX-II establishes a "virtual link" between the source and destination nodes using a call method, through which they transmit information. For example, ... Figure 11 As shown, when S5 of District 5 needs to communicate with S6 of District 6, a "virtual link" will be established between S5 and S6 by establishing a call, namely: S5-S3-S1-S2-S4-S6. Thereafter, all communication between S5 and S6 will utilize this "virtual link". The "virtual link" is maintained using a keep-alive mechanism, that is, S1 periodically initiates a call request to maintain the current "virtual link"; if the update time expires and the node on the "virtual link" does not receive the corresponding request message, then the "virtual link" will be torn down.

[0094] In QKX-II, any node establishes a "virtual link" with another node through a call request. During the call establishment process, a forwarding table is created for each node in the formed virtual link path. When transmitting messages subsequently, the nodes consult the forwarding table to determine how to forward the messages. The forwarding table structure of QKX-II can be shown in Table 2 below:

[0095] Table 2

[0096] IF-I VQI-I IF-O VQI-O TTL

[0097] The forwarding table structure of QKX-II may include:

[0098] (1)IF_I: Represents the IF number in the IN direction, i.e., the ID of the IF. For messages from LK, its IF_I is 0;

[0099] (2) VQI_I: Represents VQI in the IN direction;

[0100] (3) IF_O: indicates the IF number in the IN direction, i.e. the ID of the IF. For messages from LK, its IF_I is 0;

[0101] (4) VQI_O: Represents VQI in the OUT direction;

[0102] (5)TTL: Indicates the time to live of this record.

[0103] Assuming the source node is S1 with address SID, and the destination node is Sm with address DID; the addresses of neighboring nodes stored in S1 are denoted as AID, and their set is denoted as {AIDs}. The process of establishing a virtual link from S1 to Sm through a call may include the following steps:

[0104] Step 1: Configure the LK of “S1-Sm” on node S1, establish the corresponding VQI (denoted as VQIa), and form a call request message;

[0105] Step 2: Node S1 retrieves the first AID1 from {AIDs} and matches it with DID to find... (That is, the DID string contains the AID string) and the matching length of AID1 and DID is L1 (that is, the first L1 characters of AID1 and DID are the same);

[0106] Step 3: Node S1 takes the second AID2 from {AIDs} and matches it with DID, obtaining the matching length L2 between AID2 and DID according to Step 1. This process continues until every AID in {AIDs} has been matched with DID, resulting in a matching length set {Ls}.

[0107] Step 4: Assume the largest element in {Ls} is Lb, the AID corresponding to Lb is AIDb, the IF corresponding to AIDb is IFb, and the neighboring node corresponding to AIDb is S2. Then, S1 will send the generated call request message to node S2 via IFb. Simultaneously, node S1 updates its forwarding table. The update process is as follows:

[0108] ① Node S1 creates a new VQI (denoted as VQIb) in IFb (numbered as IFb_NO), and each creation uses an incremental method and is not occupied.

[0109] ② Node S1 adds two records to the forwarding table. The contents of one record are: IF-I is 0, VQI-I is VQIa, IF-O is IFb_NO, VQI-O is VQIb, and the contents of the other record are: IF-I is IFb_NO, VQI-I is VQIb, IF-O is 0, VQI-O is VQIa.

[0110] Step 5: After receiving the call request message, node S2 repeats steps 2 to 4, finds the neighboring node S3 and its corresponding IF (denoted as IFb), sends the call request message to node S3, and updates the forwarding table. The update process is as follows:

[0111] ① If node S2 receives this call request message with an IF of IFa (numbered IFa_NO), then a new VQI (denoted as VQIa, VQIa = S1's VQIb, i.e., the VQI in the call request message) is created in IFa. At the same time, a new VQI (denoted as VQIb) is created in IFb (numbered IFb_NO). Each creation uses an incremental method and is not occupied.

[0112] ②S2 adds two records to the forwarding table. The contents of one record are: IF-I is IFa_NO, VQI-I is VQIa, IF-O is IFb_NO, VQI-O is VQIb, and the contents of the other record are: IF-I is IFb_NO, VQI-I is VQIb, IF-O is IFa_NO, and VQI-O is VQIa.

[0113] Step 6: Continue in this manner until the call request message reaches node Sm. Node Sm updates its forwarding table. The process of node Sm updating its forwarding table is as follows:

[0114] ① After receiving this call request message, node Sm finds that the DID is the same as its own ID, so it extracts the SID and VQI (denoted as VQIa) from the call request message and establishes the corresponding LK and VQI (denoted as VQIb);

[0115] ② If node Sm receives this call request message with an IF of IFa (numbered IFa_NO), then create a new VQI in IFa with the value VQIa;

[0116] ③ Node Sm adds two records to the forwarding table. The contents of one record are: IF-I is IFa_NO, VQI-I is VQIa, IF-O is 0, and VQI-O is VQIb. The contents of the other record are: IF-I is 0, VQI-I is VQIb, IF-O is IFa_NO, and VQI-O is VQIa.

[0117] At this point, the call establishment process between node S1 and node Sm is complete, and the "virtual link" between S1 and Sm is established (temporarily).

[0118] Step 7: Node Sm responds to this call request message. The response message will be transmitted to S1 along the reverse path of S1-Sm. When the response message reaches each intermediate node, the corresponding "virtual link" is formally established.

[0119] For the maintenance and teardown of the aforementioned virtual links, a keep-alive mechanism is used for maintenance. The source node maintains the virtual link (the link between node S1 and node Sm) from the current node to the destination node via a call request. If the update time expires (i.e., the TTL in the forwarding table becomes 0) and the node on the virtual link has not received the corresponding request message, the virtual link is torn down. When a virtual link is torn down, the corresponding LKs (Legacy Registers) of the source and destination nodes are deleted. The source node initiates a call when the TTL of the corresponding record in its forwarding table is 0. Each call request establishes a new LK and its VQI.

[0120] 3) QKX-III:

[0121] QKX-III is the third-layer switching network of a quantum secure communication network. It consists of different user networks, allowing users to build their own private networks and achieve network-wide quantum key exchange. QKX-III employs a layered and area-based networking approach, such as... Figure 12 The diagram shown illustrates the QKX-III network topology. This QKX-III network is a four-layer, 16-Area network structure, where each router and each ellipse represents an Area. Figure 13 The diagram shows the hierarchical relationship of Area.

[0122] In packet-switched networks, Link State Advertisement (LSA) refers to link-state advertisements. The structure of the Link State Database (LSDB) for an LSA is shown in Table 3. A link consists of two network nodes, designated QKX-III-A and QKX-III-B, with corresponding IP addresses and network masks AID, BID, ASM, and BSM, respectively. The parent mask is PM. To optimize network routing more effectively, a key balance parameter is added to the LSDB for route selection. Specifically, when multiple paths exist simultaneously, the path with the higher key balance is prioritized.

[0123] Table 3

[0124] AID BID ASM BSM Parent mask PM Key remaining amount

[0125] QKX-III network nodes are addressed according to the IPv4 protocol family of IP addresses, for example, a Class C private IP address: "192.168.1.3". After the user configures the IP address and subnet mask of the network node, the IF generates the corresponding LSA. The QKX-III ID (i.e., IP address), SML, and PM can be obtained through network settings. The IF obtains the key production rate, denoted as KR, by acquiring the various links of the lower layer (QKX-II). Finally, the IF combines (AID, ASM, APM), (BID, BSM, BPM), and KR into an LSA, denoted as LSA = (AID, BID, ASM, BSM, PM, KR).

[0126] For QKX-III network nodes, it is necessary to flood the LSAs they know to the entire network, allowing each network node to expand its LSDB and understand the topology of the entire network. The specific process may include the following steps:

[0127] Step 1: For LSAs generated by the QKX-III network node itself, extract the PM from the LSA. If the PM of the LSA is less than or equal to the PM of the IF, then this LSA will be transmitted to the peer IF through this IF.

[0128] Step 2: For an LSA received from an IF (denoted as IF0), extract the AID and PM from the LSA. If the AID is the same as its own IP address, discard the LSA. If the PM of the LSA is less than or equal to the PM of the IF and the IF does not equal IF0, then this LSA will be transmitted to the other end IF through this IF.

[0129] QKX-III network nodes collect their own generated LSAs and received LSAs to form an LSDB. The LSDB stores LSAs according to PM (Primary Area) classification, meaning LSAs with the same PM are grouped together as a dataset. Routers, based on the LSAs collected in each dataset class, form a directed graph (network topology graph), where nodes represent areas (containing independent domains) and edges are links (LSAs) between areas. Therefore, QKX-III network nodes form a directed graph for each layer of the network, such as... Figure 14 As shown, for Figure 12 In the QKX-III network, R1 stores LSDB corresponding to three graphs. Figure 14 The network topology diagram formed by R1's LSDB.

[0130] Assuming the source node of QKX-III is R1 with IP address SID, and the destination node is Rm with IP address DID, the query for this message routing path can include the following steps:

[0131] Step 1: Query the smallest domain (Arean) containing the DID in LSDB:

[0132] ① Query the domain where DID is located: Assuming that the QKX-III node corresponding to SID is R1, R1 first queries the LSA in the local LSDB, using "whether DID&BSM is equal to BID&BSM" as the query condition. If the corresponding LSA is not found, it is determined that the destination is unreachable.

[0133] ② Select the smallest field in the query result set from ①: If it can be found, and if the query result contains multiple LSAs, select the LSA with the largest ASM, i.e., select the "Area containing the DID and with the smallest level", and calculate:

[0134] The Areaid of this domain (let's call it Areean) gives Areean = BID & BSM;

[0135] The Areaid of the direct parent domain of this domain (let's call it Pn) is obtained as Pn = BID & PM.

[0136] Step 2: Query the LSDB for the sibling domain Areai at the same level as Areai, where the SID resides:

[0137] To query an Area in LSDB that contains R1 and shares the same direct parent domain as Arean (i.e., an Area that contains R1 and is a sibling domain of Arean), the query method is as follows:

[0138] ① Find all next-level subdomains of Pn: Query the LSDB for LSAs that match AID&PM==Pn;

[0139] ② Query the subdomain containing SID: Determine which subdomain contains R1, that is: find the LSA that matches SID&ASM==AID&ASM in the result set above, and denote the domain ID as Areai;

[0140] Step 3: Calculate the shortest path from Areai to Arean:

[0141] Based on the shortest path algorithm (i.e., Dijkstra's algorithm), query the LSDB for the shortest path from Areai to Arean:

[0142] ① Construct a graph from Areai to the level of Arean based on LSDB:

[0143] i) Search for all LSAs in LSDB where AID&ASM==Areai. At this time, BID&BSM (let's call it Areai') is the first hop. According to graph theory, Areai and Areai' are two nodes, and the line connecting them is an edge in graph theory.

[0144] ii) Similarly, a directed graph of the Areai level can be constructed based on the LSDB. Based on this graph, the shortest path from Areai to Arean can be found using Dijkstra's algorithm.

[0145] ② Let the first hop be denoted as Areaj.

[0146] Step 4: Locate the QKX-III node, the boundary connecting Areai to Arean:

[0147] ① Search the LSDB for LSAs that satisfy AID&ASM==Areai and BID&BSM==Areaj;

[0148] ② There may be multiple LSAs that meet the conditions. In this case, select the LSA with the larger KR, find the AID of the LSA, and record this AID as the new DID, which is called DID'.

[0149] Step 5: Determine if SID is equal to the boundary QKX-III node (DID'):

[0150] ①If SID equals DID', then the QKX-III node corresponding to the BID of LSA in step 4 ② is the first hop (denoted as R2), and jump to step 6.

[0151] ② If SID is not equal to DID', then repeat steps 1 to 5 above for DID' until a DID' is obtained, such that SID == DID'.

[0152] Furthermore, if SID is determined to be equal to DID', (DID, BIDR2) is added to R1's forwarding table (the forwarding table contains two pieces of information: the destination address and the next-hop address; BIDR2 is R2's IP address; when sending information again, only the forwarding table needs to be queried).

[0153] Step 6: Route the message to the first hop QKX-III node R2;

[0154] Step 7: Repeat the above steps: Let SID = BIDR2, DID is still the ID of Rm, repeat steps 1 to 6, find the second hop QKX-III node R3, and so on, until Rm is reached.

[0155] In one embodiment, a switching network for a quantum secure communication network is provided in this example, which may include: a first switching layer (corresponding to QKX-I above), a second switching layer (corresponding to QKX-II above), and a third switching layer (corresponding to QKX-III above), wherein:

[0156] 1) The first switching layer is built on the quantum key distribution system. The first switching layer is the underlying switching network formed by the network infrastructure developer. The first switching layer can include multiple network nodes. The types of multiple network nodes can include: switching nodes and relay nodes. Among them, the switching node is a node with more than or equal to 3 connected links, and the relay node is a node with two connected links, one in and one out.

[0157] 2) The second switching layer is constructed by interconnecting multiple first switching layer networks based on users' network interoperability requirements for quantum key distribution. The second switching layer adopts a hierarchical and regional networking approach. The second switching layer is configured, operated and managed by the operator for bandwidth leasing, bandwidth allocation and bandwidth release.

[0158] 3) The third switching layer is constructed by interconnecting multiple second switching layers. The third switching layer adopts a hierarchical and domain-based networking approach and is composed of different user networks. Users build private networks based on the third switching layer to achieve quantum key exchange across the entire network.

[0159] For the first switching layer, routes are pre-configured by the routing configuration center and distributed to switching nodes and relay nodes until the routes are no longer in use, at which point they are released by the network management node. The pre-configuration of routes by the routing configuration center may include:

[0160] S1: The routing configuration center obtains the network nodes in the first switching layer and the quantum key requirements between the nodes;

[0161] S2: The routing configuration center determines the key production rate, key consumption rate, and key freshness based on each network node in the first switching layer and the quantum key requirements between each node;

[0162] S3: The routing configuration center determines the network route of the first switching layer by taking the optimal path of key routing as the target, based on key production rate, key consumption rate and key freshness.

[0163] S4: The routing setting center distributes the determined network-wide routes of the first switching network to each switching node and relay node in the first switching network in the form of a first forwarding table. The first forwarding table is used by network nodes in the first switching network to query when there is a need to send a message in order to determine the path for message forwarding.

[0164] The first forwarding table mentioned above includes the following fields: the number of the virtual path in the virtual circuit in the input direction (corresponding to IF_I above), the number of the virtual channel in the virtual circuit in the input direction (corresponding to VQI_I above), the number of the virtual path in the virtual circuit in the output direction (corresponding to IF_O above), and the number of the virtual channel in the virtual circuit in the output direction (corresponding to VQI_O above).

[0165] The virtual path number in the virtual circuit of the output direction is used to characterize the forwarding direction of the network interface, and the virtual channel number in the virtual circuit of the output direction is used to indicate the link association between the corresponding lower-layer network nodes. When the network node is a relay node, the forwarding direction of the network interface is unique. When the network node is a switching node, the forwarding direction of the network interface is multiple.

[0166] The network nodes in the second switching layer can be networked in a hierarchical and regional manner according to sub-regions and parent regions. The prefix of the address of the sub-region is the address of the parent region. Virtual links are established between the source node and the destination node that have communication needs in the second switching layer. The source node and the destination node interact through the virtual links. A virtual link includes one or more intermediate nodes other than the source node and the destination node. The source node periodically initiates call requests to maintain the validity of the virtual link.

[0167] The first network node in the second switching layer can establish a virtual link with the second network node through a call request, and form a second forwarding table for each node in the virtual link. The second forwarding table may include the following fields: the number of the virtual path in the virtual circuit in the input direction (corresponding to IF_I above), the number of the virtual channel in the virtual circuit in the input direction (corresponding to VQI_I above), the number of the virtual path in the virtual circuit in the output direction (corresponding to IF_O above), the number of the virtual channel in the virtual circuit in the output direction (corresponding to VQI_O above), and the time to life of the forwarding table record (corresponding to TTL above).

[0168] The network nodes in the aforementioned third switching layer are addressed using IPv4 protocol suite IP addresses. A link consists of a first network node and a second network node. A link state advertisement is generated using the IP address of the first network node, the network mask of the first network node, the IP address of the second network node, the network mask of the second network node, the parent mask, and the key production rate. Each network node in the third switching layer floods its own link state advertisement to the entire network, thereby expanding the link state database of each network node. The link state database also records a key remaining quantity parameter, which is used for routing selection. When multiple paths exist simultaneously, the path with the higher key remaining quantity is selected first.

[0169] Figure 15 This is a flowchart illustrating one embodiment of the routing path query method provided in this application. While this application provides method operation steps or apparatus structures as shown in the following embodiments or accompanying drawings, more or fewer operation steps or module units may be included in the method or apparatus based on conventional or non-inventive effort. In steps or structures where there is no logically necessary causal relationship, the execution order of these steps or the module structure of the apparatus is not limited to the execution order or module structure described in the embodiments and accompanying drawings of this application. When the method or module structure is applied in actual devices or terminal products, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or accompanying drawings (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed processing environment).

[0170] Specifically, such as Figure 15 As shown, the above-described routing path lookup method, applied to the third switching layer of a quantum secure communication network, may include the following steps:

[0171] Step 1501: Obtain the message to be transmitted, wherein the message to be transmitted carries the IP address of the source node and the IP address of the destination node;

[0172] Step 1502: Query the minimum domain of the IP address of the destination node in the link state database, and take the minimum domain of the IP address of the destination node obtained in the query as the first target domain;

[0173] Step 1503: Query the link state database to find the sibling domain at the same level as the first target domain where the IP address of the source node is located, and use it as the second target domain;

[0174] Step 1504: Calculate the shortest path from the second target domain to the first target domain, and find the IP address of the boundary node between the second target domain and the first target domain;

[0175] Step 1505: Determine whether the IP address of the source node is equal to the IP address of the boundary node;

[0176] Step 1506: If the IP address of the source node is equal to the IP address of the boundary node, then the boundary node is designated as the first hop node.

[0177] Step 1507: Route the message to be transmitted to the first hop node.

[0178] In one implementation, after routing the message to be transmitted to the first hop node, the following steps can be repeated until the message to be transmitted is routed to the destination node:

[0179] S1: Determine whether the current boundary node is the destination node;

[0180] S2: If the current boundary node is not the destination node, then the boundary node is taken as the current source node;

[0181] S3: Query the minimum domain of the IP address of the destination node in the link state database, and use the minimum domain of the IP address of the destination node obtained in the query as the third target domain;

[0182] S4: Query the link state database to find the sibling domain at the same level as the third target domain where the IP address of the current source node is located, and use it as the fourth target domain;

[0183] S5: Calculate the shortest path from the fourth target domain to the third target domain, and find the IP address of the boundary node between the fourth target domain and the third target domain;

[0184] S6: Determine whether the IP address of the current source node is equal to the IP address of the boundary node from the fourth target domain to the third target domain;

[0185] S7: If the IP address of the current source node is equal to the IP address of the boundary node between the fourth target domain and the third target domain, the boundary node between the fourth target domain and the third target domain shall be used as the next hop node.

[0186] S8: Route the message to be transmitted to the next hop node.

[0187] In one implementation, after determining whether the IP address of the source node is equal to the IP address of the boundary node, the method further includes: if it is determined that the IP address of the source node is not equal to the IP address of the boundary node, using the IP address of the boundary node as the address of the current destination node, and repeating the following steps until an IP address of the boundary node that is equal to the IP address of the source node is found: querying the link state database for the smallest domain in which the IP address of the current destination node is located, and using the smallest domain in which the IP address of the current destination node is located as the fifth target domain; querying the link state database for the sibling domain at the same level as the fifth target domain in which the IP address of the source node is located, and using it as the sixth target domain; calculating the shortest path from the sixth target domain to the fifth target domain, and finding the IP address of the boundary node from the sixth target domain to the fifth target domain; and determining whether the IP address of the source node is equal to the IP address of the boundary node from the sixth target domain to the fifth target domain.

[0188] In one implementation, querying the minimum domain of the destination node's IP address in the link-state database may include: determining the network node of the third switching layer of the quantum secure communication network corresponding to the destination node's IP address as the initial node; the initial node searches its local link-state database for link-state announcements that meet preset query conditions as a query result set, wherein the preset query conditions are: the AND operation result of the destination node's IP address and BSM is equal to the AND operation result of BID and BSM; if the query result set does not include link-state announcements, the destination node is determined to be unreachable; if the query result set includes multiple link-state announcements, the domain corresponding to the link-state announcement with the largest number of network addresses in ASM is selected as the minimum domain of the destination node's IP address; wherein a link consists of a first network node and a second network node, and a link-state announcement includes: the IP address of the first network node, the network mask of the first network node, the IP address of the second network node, and the network mask of the second network node, wherein BID is the IP address of the second network node, ASM is the network mask of the first network node, and BSM is the network mask of the second network node.

[0189] In one implementation, querying the link state database for the sibling domain at the same level as the first target domain, where the IP address of the source node is located, includes: determining the parent domain of the first target domain; finding all the next-level subdomains of the parent domain as a set of subdomains; determining whether each subdomain in the set of subdomains contains the source node; and designating the subdomains in the set of subdomains that contain the source node as sibling domains at the same level as the first target domain.

[0190] In one implementation, calculating the shortest path from the second target domain to the first target domain may include: searching the link state database for all link state announcements that satisfy a preset condition, wherein the preset condition is that the AND operation result of AID and ASM equals the second target domain; determining the domain corresponding to each link state announcement among the link state announcements that satisfy the preset condition, as an intermediate domain; connecting the second target domain and the intermediate domain as nodes to form an edge, thereby forming a directed graph at the level where the second target domain is located; and finding the shortest path from the second target domain to the first target domain based on the directed graph and a shortest path algorithm; wherein a link consists of a first network node and a second network node, and a link state announcement includes: the IP address of the first network node, the network mask of the first network node, the IP address of the second network node, and the network mask of the second network node, wherein AID is the IP address of the first network node and ASM is the network mask of the first network node.

[0191] For example, assuming the source node of QKX-III is R1 with IP address SID, and the destination node is Rm with IP address DID, the lookup of this route path may include the following steps:

[0192] Step 1: Query the smallest domain (Arean) containing the DID in LSDB:

[0193] ① Query the domain where DID is located: Assuming that the QKX-III node corresponding to SID is R1, R1 first queries the LSA in the local LSDB, using "whether DID&BSM is equal to BID&BSM" as the query condition. If the corresponding LSA is not found, it is determined that the destination is unreachable.

[0194] ② Select the smallest field in the query result set from ①: If it can be found, and if the query result contains multiple LSAs, select the LSA with the largest ASM, i.e., select the "Area containing the DID and with the smallest level", and calculate:

[0195] The Areaid of this domain (let's call it Areean) gives Areean = BID & BSM;

[0196] The Areaid of the direct parent domain of this domain (let's call it Pn) is obtained as Pn = BID & PM.

[0197] Step 2: Query the LSDB for the sibling domain Areai at the same level as Areai, where the SID resides:

[0198] To query an Area in LSDB that contains R1 and shares the same direct parent domain as Arean (i.e., an Area that contains R1 and is a sibling domain of Arean), the query method is as follows:

[0199] ① Find all next-level subdomains of Pn: Query the LSDB for LSAs that match AID&PM==Pn;

[0200] ② Query the subdomain containing SID: Determine which subdomain contains R1, that is: find the LSA that matches SID&ASM==AID&ASM in the result set above, and denote the domain ID as Areai;

[0201] Step 3: Calculate the shortest path from Areai to Arean:

[0202] Based on the shortest path algorithm (i.e., Dijkstra's algorithm), query the LSDB for the shortest path from Areai to Arean:

[0203] ① Construct a graph from Areai to the level of Arean based on LSDB:

[0204] i) Search for all LSAs in LSDB where AID&ASM==Areai. At this time, BID&BSM (let's call it Areai') is the first hop. According to graph theory, Areai and Areai' are two nodes, and the line connecting them is an edge in graph theory.

[0205] ii) Similarly, a directed graph of the Areai level can be constructed based on the LSDB. Based on this graph, the shortest path from Areai to Arean can be found using Dijkstra's algorithm.

[0206] ② Let the first hop be denoted as Areaj.

[0207] Step 4: Locate the QKX-III node, the boundary connecting Areai to Arean:

[0208] ① Search the LSDB for LSAs that satisfy AID&ASM==Areai and BID&BSM==Areaj;

[0209] ② There may be multiple LSAs that meet the conditions. In this case, select the LSA with the larger KR, find the AID of the LSA, and record this AID as the new DID, which is called DID'.

[0210] Step 5: Determine if SID is equal to the boundary QKX-III node (DID'):

[0211] ①If SID equals DID', then the QKX-III node corresponding to the BID of LSA in step 4 ② is the first hop (denoted as R2), and jump to step 6.

[0212] ② If SID is not equal to DID', then repeat steps 1 to 5 above for DID' until a DID' is obtained, such that SID == DID'.

[0213] Furthermore, if SID is determined to be equal to DID', (DID, BIDR2) is added to R1's forwarding table (the forwarding table contains two pieces of information: the destination address and the next-hop address; BIDR2 is R2's IP address; when sending information again, only the forwarding table needs to be queried).

[0214] Step 6: Route the message to the first hop QKX-III node R2;

[0215] Step 7: Repeat the above steps: Let SID = BIDR2, DID is still the ID of Rm, repeat steps 1 to 6, find the second hop QKX-III node R3, and so on, until Rm is reached.

[0216] The methods and embodiments provided in the above-described embodiments of this application can be executed in a mobile terminal, computer terminal, or similar computing device. Taking operation on an electronic device as an example... Figure 16 This is a hardware structure block diagram of an electronic device for a routing path query method provided in this application. For example... Figure 16 As shown, the electronic device 10 may include one or more (only one is shown in the figure) processors 02 (processors 02 may include, but are not limited to, microprocessors MCUs or programmable logic devices FPGAs, etc.), a memory 04 for storing data, and a transmission module 06 for communication functions. Those skilled in the art will understand that... Figure 16 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, electronic device 10 may also include... Figure 16 The more or fewer components shown, or having the same Figure 16 The different configurations shown.

[0217] The memory 04 can be used to store software programs and modules of application software, such as the program instructions / modules corresponding to the routing path query method in this embodiment. The processor 02 executes various functional applications and data processing by running the software programs and modules stored in the memory 04, thereby implementing the above-mentioned routing path query method of the application. The memory 04 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 04 may further include memory remotely located relative to the processor 02, and these remote memories can be connected to the electronic device 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0218] The transmission module 06 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the electronic device 10. In one example, the transmission module 06 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In one example, the transmission module 06 may use fiber optic transmission.

[0219] At the software level, the aforementioned routing path query device is applied to the third switching layer of the quantum secure communication network, and can be used as follows: Figure 17 As shown, it includes:

[0220] The acquisition module 1701 is used to acquire a message to be transmitted, wherein the message to be transmitted carries the IP address of the source node and the IP address of the destination node.

[0221] The first query module 1702 is used to query the minimum domain of the IP address of the destination node in the link state database, and take the minimum domain of the IP address of the destination node obtained by the query as the first target domain.

[0222] The second query module 1703 is used to query the link state database for the sibling domain at the same level as the first target domain where the IP address of the source node is located, and use it as the second target domain;

[0223] The lookup module 1704 is used to calculate the shortest path from the second target domain to the first target domain, and to find the IP address of the boundary node from the second target domain to the first target domain;

[0224] The determination module 1705 is used to determine whether the IP address of the source node is equal to the IP address of the boundary node;

[0225] The generation module 1706 is used to use the boundary node as the first hop node when the IP address of the source node is equal to the IP address of the boundary node.

[0226] The routing module 1707 is used to route the message to be transmitted to the first hop node.

[0227] In one embodiment, after routing the message to be transmitted to the first hop node, the routing path query device repeats the following steps until the message to be transmitted is routed to the destination node: determining whether the current boundary node is the destination node; if the current boundary node is not the destination node, taking the boundary node as the current source node; querying the link state database for the smallest domain where the IP address of the destination node is located, and taking the smallest domain where the IP address of the destination node is located as the third target domain; querying the link state database for the sibling domain at the same level as the third target domain where the IP address of the current source node is located, and taking it as the fourth target domain; calculating the shortest path from the fourth target domain to the third target domain, and finding the IP address of the boundary node from the fourth target domain to the third target domain; determining whether the IP address of the current source node is equal to the IP address of the boundary node from the fourth target domain to the third target domain; if the IP address of the current source node is equal to the IP address of the boundary node from the fourth target domain to the third target domain, taking the boundary node from the fourth target domain to the third target domain as the next hop node; and routing the message to be transmitted to the next hop node.

[0228] In one embodiment, after determining whether the IP address of the source node is equal to the IP address of the boundary node, the routing path query device, if it determines that the IP address of the source node is not equal to the IP address of the boundary node, uses the IP address of the boundary node as the address of the current destination node, and repeats the following steps until an IP address of the boundary node equal to the IP address of the source node is found: querying the link state database for the smallest domain containing the IP address of the current destination node, and using the smallest domain containing the IP address of the current destination node as the fifth target domain; querying the link state database for a sibling domain at the same level as the fifth target domain containing the IP address of the source node, and using it as the sixth target domain; calculating the shortest path from the sixth target domain to the fifth target domain, and finding the IP address of the boundary node from the sixth target domain to the fifth target domain; and determining whether the IP address of the source node is equal to the IP address of the boundary node from the sixth target domain to the fifth target domain.

[0229] In one embodiment, the first query module 1702 is specifically used to determine the network node of the third switching layer of the quantum secure communication network corresponding to the IP address of the destination node as the initial node; the initial node searches its local link state database for link state announcements that meet preset query conditions as a query result set, wherein the preset query conditions are: the result of the AND operation between the IP address of the destination node and BSM is equal to the result of the AND operation between BID and BSM; if the query result set does not include link state announcements, the destination node is determined to be unreachable; if the query result set includes multiple link state announcements, the domain corresponding to the link state announcement with the largest number of network addresses in ASM is selected as the smallest domain where the IP address of the destination node is located; wherein a link consists of a first network node and a second network node, and a link state announcement includes: the IP address of the first network node, the network mask of the first network node, the IP address of the second network node, and the network mask of the second network node, wherein BID is the IP address of the second network node, ASM is the network mask of the first network node, and BSM is the network mask of the second network node.

[0230] In one implementation, the second query module 1703 may specifically be used to determine the parent domain of the first target domain; find all the next-level subdomains of the parent domain as a set of subdomains; determine whether each subdomain in the set of subdomains contains a source node; and designate the subdomains in the set of subdomains that contain the source node as sibling domains at the same level as the first target domain.

[0231] In one implementation, calculating the shortest path from the second target domain to the first target domain may include: searching the link state database for all link state announcements that satisfy a preset condition, wherein the preset condition is that the AND operation result of AID and ASM equals the second target domain; determining the domain corresponding to each link state announcement among the link state announcements that satisfy the preset condition, as an intermediate domain; connecting the second target domain and the intermediate domain as nodes to form an edge, thereby forming a directed graph at the level where the second target domain is located; and finding the shortest path from the second target domain to the first target domain based on the directed graph and a shortest path algorithm; wherein a link consists of a first network node and a second network node, and a link state announcement includes: the IP address of the first network node, the network mask of the first network node, the IP address of the second network node, and the network mask of the second network node, wherein AID is the IP address of the first network node and ASM is the network mask of the first network node.

[0232] This application also provides a specific implementation of an electronic device capable of implementing all steps of the routing path query method in the above embodiments. The electronic device specifically includes: a processor, a memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the processor is used to call a computer program in the memory, and when the processor executes the computer program, it implements all steps of the routing path query method in the above embodiments. This application also provides a computer-readable storage medium capable of implementing all steps of the routing path query method in the above embodiments. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements all steps of the routing path query method in the above embodiments. For example, when the processor executes the computer program, it implements the following steps:

[0233] Step 1: Obtain the message to be transmitted, wherein the message to be transmitted carries the IP address of the source node and the IP address of the destination node;

[0234] Step 2: Query the minimum domain of the IP address of the destination node in the link state database, and take the minimum domain of the IP address of the destination node obtained in the query as the first target domain;

[0235] Step 3: Query the link state database to find the sibling domain at the same level as the first target domain where the IP address of the source node is located, and use it as the second target domain;

[0236] Step 4: Calculate the shortest path from the second target domain to the first target domain, and find the IP address of the boundary node between the second target domain and the first target domain;

[0237] Step 5: Determine whether the IP address of the source node is equal to the IP address of the boundary node;

[0238] Step 6: If the IP address of the source node is equal to the IP address of the boundary node, then the boundary node is designated as the first hop node.

[0239] Step 7: Route the message to be transmitted to the first hop node.

[0240] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, hardware + program embodiments are relatively simple in description because they are fundamentally similar to method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0241] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0242] While this application provides the method operation steps as described in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-inventive labor. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only execution order. In actual device or client product execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment).

[0243] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0244] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the embodiments in this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0245] The above description is merely an embodiment of the present specification and is not intended to limit the embodiments of the present specification. For those skilled in the art, various modifications and variations can be made to the embodiments of the present specification. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of the present specification should be included within the scope of the claims of the embodiments of the present specification.

Claims

1. A method for querying routing paths, characterized in that, The third switching layer applied to quantum secure communication networks includes: Obtain the message to be transmitted, wherein the message to be transmitted carries the IP address of the source node and the IP address of the destination node; The minimum domain containing the IP address of the destination node is queried in the link state database, and the minimum domain containing the IP address of the destination node obtained in the query is taken as the first target domain; The link state database is queried to find the sibling domain at the same level as the first target domain where the IP address of the source node is located, and this domain is used as the second target domain. Calculate the shortest path from the second target domain to the first target domain, and find the IP address of the boundary node of the second target domain from the second target domain to the first target domain; Determine whether the IP address of the source node is equal to the IP address of the boundary node; If the IP address of the source node is equal to the IP address of the boundary node, the boundary node is used as the first hop node. The message to be transmitted is routed to the first hop node; The quantum secure communication network comprises: a first switching layer, a second switching layer, and a third switching layer, wherein: The first switching layer is built on the quantum key distribution system. The first switching layer is the underlying switching network formed by the network infrastructure developer. The first switching layer includes multiple network nodes, and the types of multiple network nodes include: switching nodes and relay nodes. Among them, the switching node is a node with more than or equal to 3 connected links, and the relay node is a node with two connected links, one incoming and one outgoing. The second switching layer is constructed by interconnecting multiple first switching layer networks based on users' network interoperability requirements for quantum key distribution. The second switching layer adopts a hierarchical and regional networking approach. The second switching layer is configured, operated and managed by the operator for bandwidth leasing, bandwidth allocation and bandwidth release. The third switching layer consists of different user networks. Users build their own private networks based on the third switching layer to achieve quantum key exchange across the entire network. The third switching layer adopts a hierarchical and domain-based networking approach. In the link state database structure of the link state advertisement, a link consists of two network nodes, designated as QKX-III-A and QKX-III-B, with their corresponding IP addresses and network masks designated as AID, BID, ASM, and BSM, respectively. The parent mask is PM. A key remaining quantity parameter is added to the link state database to participate in routing selection. The key remaining quantity parameter is used for routing selection. When multiple paths exist simultaneously, the path with higher key remaining quantity is selected first. For the first switching layer, routes are pre-configured by the routing configuration center and distributed to switching nodes and relay nodes until the routes are no longer needed, at which point they are released by the network management nodes. The routes pre-configured by the routing configuration center include: The routing configuration center obtains the quantum key requirements of each network node in the first switching layer and the quantum key requirements between each node. The routing configuration center determines the key production rate, key consumption rate, and key freshness based on each network node in the first switching layer and the quantum key requirements between each node. The routing configuration center determines the network-wide route of the first switching layer by taking the optimal path of key routing as the target, based on key production rate, key consumption rate, and key freshness. The routing configuration center distributes the determined network-wide routes of the first switching network to each switching node and relay node in the first switching network in the form of a first forwarding table. The first forwarding table is used by network nodes in the first switching network to query when there is a need to send a message in order to determine the path for message forwarding.

2. The method according to claim 1, characterized in that, After routing the message to be transmitted to the first hop node, the method further includes: Repeat the following steps until the message to be transmitted is routed to the destination node: Determine whether the current boundary node is the destination node; If the current boundary node is not the destination node, the boundary node is taken as the current source node. The minimum domain containing the IP address of the destination node is queried in the link state database, and the minimum domain containing the IP address of the destination node obtained in the query is used as the third target domain; The link state database is queried to find the sibling domain at the same level as the third target domain where the IP address of the current source node is located, and this domain is used as the fourth target domain. Calculate the shortest path from the fourth target domain to the third target domain, and find the IP address of the boundary node between the fourth target domain and the third target domain; Determine whether the IP address of the current source node is equal to the IP address of the boundary node between the fourth target domain and the third target domain; If the IP address of the current source node is equal to the IP address of the boundary node between the fourth target domain and the third target domain, the boundary node between the fourth target domain and the third target domain shall be used as the next hop node. The message to be transmitted is routed to the next-hop node.

3. The method according to claim 1, characterized in that, After determining whether the IP address of the source node is equal to the IP address of the border node, the process further includes: If it is determined that the IP address of the source node is not equal to the IP address of the boundary node, the IP address of the boundary node is used as the address of the current destination node, and the following steps are repeated until the IP address of the boundary node that is equal to the IP address of the source node is found: Query the minimum domain of the IP address of the current destination node in the link state database, and use the minimum domain of the IP address of the current destination node obtained from the query as the fifth destination domain; The link state database is queried to find the sibling domain at the same level as the fifth target domain where the IP address of the source node is located, and this domain is used as the sixth target domain. Calculate the shortest path from the sixth target domain to the fifth target domain, and find the IP address of the boundary node between the sixth target domain and the fifth target domain; Determine whether the IP address of the source node is equal to the IP address of the boundary node between the sixth target domain and the fifth target domain.

4. The method according to claim 1, characterized in that, The minimum domain containing the IP address of the destination node is queried in the link-state database, including: The network node of the third switching layer of the quantum secure communication network corresponding to the IP address of the destination node is determined as the initial node; The initial node searches its local link state database for link state announcements that meet preset query conditions as a query result set. The preset query conditions are: the result of the AND operation between the destination node's IP address and BSM is equal to the result of the AND operation between BID and BSM. If the query result set does not include link status announcements, the destination node is determined to be unreachable. If the query result set includes multiple link status announcements, the domain corresponding to the link status announcement with the largest number of network addresses in ASM is selected as the smallest domain where the IP address of the destination node is located. One link consists of a first network node and a second network node. A link status announcement includes: the IP address of the first network node, the network mask of the first network node, the IP address of the second network node, and the network mask of the second network node. Here, BID is the IP address of the second network node, ASM is the network mask of the first network node, and BSM is the network mask of the second network node.

5. The method according to claim 1, characterized in that, The link state database is queried to find the sibling domains at the same level as the first target domain where the IP address of the source node belongs, including: Determine the parent domain of the first target domain; Find all the next-level subdomains of the parent domain, and compile them into a set of subdomains; Determine whether each subdomain in the set of subdomains contains a source node; The subdomains containing the source node in the subdomain set are considered as sibling domains at the same level as the first target domain.

6. The method according to claim 1, characterized in that, Calculating the shortest path from the second target domain to the first target domain includes: Search the link state database for all link state announcements that meet the preset conditions, wherein the preset conditions are: the result of the AND operation of AID and ASM is equal to the second target domain; Determine the field corresponding to each link status announcement in the link status announcement that meets the preset conditions, and use it as an intermediate field; The second target domain and the intermediate domain are used as nodes and connected to form edges to form a directed graph at the level where the second target domain is located. Based on the directed graph, the shortest path from the second target domain to the first target domain is found using the shortest path algorithm. One link consists of a first network node and a second network node. A link status announcement includes: the IP address of the first network node, the network mask of the first network node, the IP address of the second network node, and the network mask of the second network node, where AID is the IP address of the first network node and ASM is the network mask of the first network node.

7. A routing path query device, characterized in that, The third switching layer applied to quantum secure communication networks includes: An acquisition module is used to acquire a message to be transmitted, wherein the message to be transmitted carries the IP address of the source node and the IP address of the destination node; The first query module is used to query the minimum domain of the IP address of the destination node in the link state database, and take the minimum domain of the IP address of the destination node obtained by the query as the first target domain. The second query module is used to query the link state database for the sibling domain at the same level as the first target domain where the IP address of the source node is located, and use it as the second target domain; The lookup module is used to calculate the shortest path from the second target domain to the first target domain, and to find the IP address of the boundary node of the second target domain from the second target domain to the first target domain; A determination module is used to determine whether the IP address of the source node is equal to the IP address of the boundary node; A generation module is used to designate the boundary node as the first hop node when the IP address of the source node is equal to the IP address of the boundary node. The routing module is used to route the message to be transmitted to the first hop node; The quantum secure communication network comprises: a first switching layer, a second switching layer, and a third switching layer, wherein: The first switching layer is built on the quantum key distribution system. The first switching layer is the underlying switching network formed by the network infrastructure developer. The first switching layer includes multiple network nodes, and the types of multiple network nodes include: switching nodes and relay nodes. Among them, the switching node is a node with more than or equal to 3 connected links, and the relay node is a node with two connected links, one incoming and one outgoing. The second switching layer is constructed by interconnecting multiple first switching layer networks based on users' network interoperability requirements for quantum key distribution. The second switching layer adopts a hierarchical and regional networking approach. The second switching layer is configured, operated and managed by the operator for bandwidth leasing, bandwidth allocation and bandwidth release. The third switching layer consists of different user networks. Users build their own private networks based on the third switching layer to achieve quantum key exchange across the entire network. The third switching layer adopts a hierarchical and domain-based networking approach. In the link state database structure of the link state advertisement, a link consists of two network nodes, designated as QKX-III-A and QKX-III-B, with their corresponding IP addresses and network masks designated as AID, BID, ASM, and BSM, respectively. The parent mask is PM. A key remaining quantity parameter is added to the link state database to participate in routing selection. The key remaining quantity parameter is used for routing selection. When multiple paths exist simultaneously, the path with higher key remaining quantity is selected first. For the first switching layer, routes are pre-configured by the routing configuration center and distributed to switching nodes and relay nodes until the routes are no longer needed, at which point they are released by the network management nodes. The routes pre-configured by the routing configuration center include: The routing configuration center obtains the quantum key requirements of each network node in the first switching layer and the quantum key requirements between each node. The routing configuration center determines the key production rate, key consumption rate, and key freshness based on each network node in the first switching layer and the quantum key requirements between each node. The routing configuration center determines the network-wide route of the first switching layer by taking the optimal path of key routing as the target, based on key production rate, key consumption rate, and key freshness. The routing configuration center distributes the determined network-wide routes of the first switching network to each switching node and relay node in the first switching network in the form of a first forwarding table. The first forwarding table is used by network nodes in the first switching network to query when there is a need to send a message in order to determine the path for message forwarding.

8. An electronic device comprising a processor and a memory for storing processor-executable instructions, characterized in that, When the processor executes the instructions, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 6.

Images