Universe quantum security intelligent network card and data processing method thereof

Abstract

The invention discloses a global quantum security intelligent network card and a data processing method thereof, and the network card remarkably improves the security of data transmission through integrating quantum encryption / decryption functions. The isolation function of the media access control module effectively prevents external network equipment from directly accessing the processing module, and the security of the system is further enhanced. The processing module not only executes network protocol processing, but also can perform quantum encryption / decryption, and the integrated design greatly improves the data processing efficiency. And the quantum encryption function is integrated into the network card, so that the requirement on additional encryption equipment is eliminated, and the whole system architecture is simplified. By integrating multiple functions into a single device, the hardware cost required for implementing quantum encryption is reduced. Meanwhile, the existing system does not need to be transformed on a large scale, so that the deployment and maintenance cost is also reduced.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a global quantum security smart network card and a data processing method thereof. Background Art

[0002] With the rapid development of information technology and the increasing threats to network security, quantum encryption technology has gradually become an important means of protecting data security due to its theoretically unbreakable characteristics. However, the current implementation of quantum encryption in terminal devices has many limitations and shortcomings, and urgently needs improvement and innovation.

[0003] Existing terminal quantum encryption usually uses dedicated devices or modules to complete quantum key management and data encryption and decryption on the main processor. This implementation method has the following major problems:

[0004] 1. Bulky equipment: It is necessary to add an independent quantum encryption and decryption module to the original equipment, which increases the overall size of the equipment and is not conducive to the development trend of miniaturization and integration.

[0005] 2. Limited universality: Different terminal devices may require different interfaces and protocol support, which reduces the universality of quantum encryption solutions and increases development and maintenance costs.

[0006] 3. Large changes to the terminal: In order to support additional quantum encryption modules, terminal equipment often needs to undergo major changes, involving support and adaptation in multiple aspects such as interfaces, space, and power supply. This not only increases the difficulty of construction, but also limits the promotion and application of technology.

[0007] However, there is no global quantum security smart network card solution that can meet the above requirements on the market. Therefore, the development of such a smart network card with integrated quantum encryption function can not only solve many problems in the existing quantum encryption implementation, but also bring revolutionary progress to the field of network security, which has important technical significance and market value. Summary of the invention

[0008] In order to solve the problems of the prior art, the present invention provides a global quantum security smart network card and a data processing method thereof. The technical solution is as follows:

[0009] In a first aspect, the present application discloses a quantum secure smart network card, which specifically includes:

[0010] A processing module, used to perform network protocol processing and quantum encryption / decryption processing on data;

[0011] Physical layer interface module, used to realize network physical connection and signal processing;

[0012] The media access control module is arranged between the physical layer interface module and the processing module, and is used to isolate the unencrypted data and the decrypted plaintext data in the processing module, prevent external network devices from directly accessing the processing module, and perform data packet processing, including routing decisions, data exchange and traffic filtering.

[0013] The host interface unit is connected to the media access control module and is used for data exchange with the host.

[0014] In a specific solution, the media access control module includes:

[0015] A network traffic processing unit, used to perform network traffic preprocessing, filtering and security detection;

[0016] Switching / routing unit, used to implement packet forwarding, routing selection and quantum secure communication protocol processing.

[0017] In addition, the media access control module also includes:

[0018] DMA data transfer unit, used to realize direct data exchange between network data and host memory.

[0019] The media access control module further includes an instruction control unit for receiving a control instruction sent by a host, wherein the control instruction includes:

[0020] Instructions for setting rules for the media access control module, wherein the rules include filtering rules based on protocols, flow labels or data features;

[0021] An instruction for setting a function switch of the media access control module, used to turn on or off a rule filtering or encryption and decryption function;

[0022] The instruction for performing parameter configuration on the processing module is used to configure access information and key control parameters of the quantum security network.

[0023] Furthermore, the media access control module also includes a security verification module for verifying the operator's identity through identity authentication or U-Key verification when receiving a rule setting or function switch instruction, so as to prevent encryption rules and filtering rules from being tampered with without authorization.

[0024] In a possible implementation, the media access control module is configured to:

[0025] Only quantum-encrypted data is allowed to be transmitted from the processing module to the external network;

[0026] Only quantum-encrypted data is allowed to be transmitted from the external network to the processing module.

[0027] In a second aspect, the present application further discloses a data encryption and transmission processing method for a global quantum security smart network card, comprising the following steps:

[0028] The media access control module receives the data to be sent through the host interface unit and forwards it to the processing module;

[0029] The processing module is used to perform network protocol processing and quantum encrypt the data to generate ciphertext data;

[0030] The processing module transmits the ciphertext data to the media access control module;

[0031] The media access control module encapsulates the encrypted data packet according to the network topology and routing protocol to form a quantum encrypted data packet, and then forwards the quantum secure data packet to the physical layer interface module;

[0032] The encrypted data packets are sent to the external network through the physical layer interface module.

[0033] In a third aspect, the present application also discloses a method for processing data received by a global quantum security smart network card, comprising the following steps:

[0034] Receive data from the external network through the physical layer interface module and perform signal conversion and processing;

[0035] The processed data is transmitted to the media access control module, where the network traffic processing unit performs preprocessing and filtering;

[0036] The switching / routing unit in the media access control module decapsulates the quantum encrypted data packet and transmits the data to the processing module;

[0037] The processing module uses a quantum decryption algorithm to decrypt it into plaintext data, performs calculations and processing operations on the decrypted plaintext data, and generates processing result data; if the processing result data needs to be sent to an external network, the generated processing result data is again subjected to quantum encryption operations before being transmitted.

[0038] The beneficial effects of the present application are as follows: By integrating quantum encryption / decryption functions, the network card significantly improves the security of data transmission. Quantum encryption technology is theoretically impossible to crack, which provides the highest level of protection for network communications. At the same time, the isolation function of the media access control module effectively prevents external network devices from directly accessing the processing module, further enhancing the security of the system.

[0039] The processing module not only performs network protocol processing, but also performs quantum encryption / decryption. This integrated design greatly improves the efficiency of data processing. The packet processing function of the media access control module, including routing decisions, data exchange and traffic filtering, further enhances the intelligent processing capabilities of the network card.

[0040] Integrating quantum encryption functions into the network card eliminates the need for additional encryption equipment and simplifies the overall system architecture. By integrating multiple functions into a single device, the present invention reduces the hardware cost required to implement quantum encryption. At the same time, since there is no need to make large-scale modifications to existing systems, deployment and maintenance costs are also reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0042] Figure 1 This is a schematic diagram of the structure of the network card in the embodiment of the present application;

[0043] Figure 2 This is a schematic diagram of the structure of the processing module and the media access control module in the embodiment of the present application;

[0044] Figure 3 This is a schematic diagram of the data transmission direction of the network card in the embodiment of the present application;

[0045] Figure 4 This is a flow chart of the data encryption and sending method of the global quantum security smart network card in the embodiment of the present application.

[0046] Figure 5 This is a flow chart of the processing method for receiving data by the global quantum security smart network card in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0048] Example 1: Figure 1-3 As shown, a global quantum security smart network card, the smart network card specifically includes:

[0049] A processing module, used to perform network protocol processing and quantum encryption / decryption processing on data;

[0050] like Figure 2 As shown, the processing module can be an ARM / X86 chip, including a network protocol processing unit, which is used to perform network protocol processing tasks, such as: processing of the TCP / IP protocol stack, support of various Ethernet protocols (such as IEEE 802.3), processing of wireless network protocols (such as Wi-Fi, Bluetooth, etc.) and implementation of network security protocols (such as SSL / TLS, IPSec, etc.); ensuring that the network card can support various network environments and protocols;

[0051] In addition, it is also used to perform quantum encryption processing on the transmitted data, converting the plaintext data into ciphertext to improve the security of data transmission; and to perform quantum decryption processing on the received encrypted data to restore the original plaintext data;

[0052] Physical layer interface module, used to realize network physical connection and signal processing;

[0053] Mainly include: Connector: can be electrical port, optical port or wireless interface, such as RJ45, SFP, QSFP, WI FI, etc., used to complete the access network;

[0054] PHY chip: responsible for the conversion between digital signals and analog signals; contains multiple sublayers, responsible for data encoding, decoding and link error detection.

[0055] Transformer: optional, used for signal adjustment and electrical isolation, etc.

[0056] The media access control module is arranged between the physical layer interface module and the processing module, and is used to isolate the unencrypted data and the decrypted plaintext data in the processing module, prevent external network devices from directly accessing the processing module, and perform data packet processing, including routing decisions, data exchange and traffic filtering.

[0057] like Figure 2 As shown, the media access control module can adopt a programmable logic module, such as FPGA, PLD and CPLD, etc., which is located between the physical layer interface module and the processing module, including:

[0058] Hardware isolation unit: used to prevent external network from directly accessing the processing module and protect unencrypted data and decrypted plaintext data; the media access control module is physically located between the physical layer interface module and the processing module.

[0059] Separate memories and buffers can be used to ensure that data is not mixed up during different stages of processing, as well as different internal buses or channels for transmitting encrypted and unencrypted data.

[0060] Mark the data packets to distinguish between encrypted and unencrypted data. Determine the data processing method and the modules that are allowed to access based on the mark. For example, add a specific field to the data packet header to identify the encryption status of the data packet. 1-2 bits can be used to represent different encryption states, for example: 00: unencrypted data 01: encrypted data 10: encryption in progress 11: decryption in progress.

[0061] Processing decision based on tag: Unencrypted data (00), restricted to access only by the encryption module, not allowed to be directly forwarded to the external network, may trigger the encryption process

[0062] Encrypted data (01): Allowed to be forwarded to the external network and can be accessed by the decryption module for decryption

[0063] Encryption processing (10): Processing is restricted to the encryption module. After completion, the mark is updated to the encrypted state. Decryption processing (11): Processing is restricted to the decryption module. After completion, the mark is updated to the unencrypted state.

[0064] Network traffic processing unit: performs network traffic preprocessing, filtering and security detection; for example, Filter processing unit;

[0065] In one possible implementation, the network traffic processing unit includes the following main components: a data packet capture module, a preprocessing module, a filtering module, and a security detection module;

[0066] The packet capture module uses the promiscuous mode of the network interface card (NIC) to capture all packets passing through the specified network interface.

[0067] The preprocessing module performs preliminary processing on the captured raw data packets, including: parsing the packet header to extract key information (such as source IP, destination IP, protocol type, etc.); standardizing timestamps to ensure time consistency in subsequent analysis; deduplication to avoid duplicate packets affecting the analysis results; and packet reassembly to process fragmented packets.

[0068] The filtering module is used to implement a configurable multi-level filtering mechanism: for example, filtering based on protocol type (such as TCP, UDP, ICMP, etc.); IP address filtering: filtering based on source IP or destination IP; port filtering: filtering based on source port or destination port; content filtering: keyword matching of data packet payload.

[0069] The security detection module is used to implement a multi-level security detection mechanism: for example, signature detection: using a predefined signature library to detect known threats; abnormal behavior detection: identifying abnormal traffic patterns based on statistical analysis; protocol anomaly detection: checking whether the protocol usage complies with standard specifications.

[0070] Switching / routing unit: implements data packet forwarding and routing, and supports encapsulation and decapsulation of quantum secure communication protocols;

[0071] Specifically, a crossbar architecture can be used to implement non-blocking switching and a high-bandwidth internal bus, such as PCI Express Gen 4 or higher, can be used to support multi-stage switching and improve the forwarding efficiency of large-scale networks.

[0072] In addition, multiple routing protocols can be used, such as OSPF, BGP, ISIS, etc. Use efficient routing table lookup algorithms, such as TCAM or Multi-bit Tree.

[0073] In a possible implementation, the encapsulation and decapsulation of the quantum secure communication protocol can be performed in the following manner:

[0074] Transport layer encapsulation: Use the existing TCP or UDP protocol as the transmission carrier; add a quantum security protocol header before the application layer data.

[0075] Network layer encapsulation: Use the extended header mechanism of the IP protocol; add a quantum security protocol header before the original IP packet; the specific protocol header contains the following fields: version: 4 bits, used to identify the protocol version; type: 4 bits, used to specify the message type; reserved: 8 bits, reserved for future use; sequence number: 32 bits, used for message sorting and anti-replay attack; security parameter index (SPI): 32 bits, used to identify security associations.

[0076] Encapsulation method: UDP encapsulation: Use a predefined UDP port (such as 15000).

[0077] Protocol stack: IP->UDP->quantum-safe protocol header->encrypted payload.

[0078] TCP encapsulation: After the TCP connection is established, the quantum security protocol handshake is performed first.

[0079] Protocol stack: IP->TCP->quantum-safe protocol header->encrypted payload

[0080] IP extension header encapsulation: Use the IP protocol number (such as 253, for experiments / tests).

[0081] Protocol stack: IP->Quantum security protocol header (as IP extension header)->Original IP packet (encrypted)

[0082] Protocol identification and processing: UDP / TCP encapsulation: Identified by predefined port numbers.

[0083] Processing quantum security protocols at the application layer. IP extension header encapsulation: Identified by IP protocol number.

[0084] Processing quantum-safe protocols at the network layer.

[0085] Protocol negotiation mechanism: At the initial stage of the connection, both parties exchange supported protocol versions and encryption algorithms. The highest version and strongest algorithm supported by both parties are selected.

[0086] Downgrade mechanism: If it is detected that the network device does not support the quantum security protocol, it will automatically downgrade to traditional encryption methods (such as TLS).

[0087] Through this design, the quantum secure communication protocol can be well compatible with existing network architectures and transmission protocols. It provides a variety of encapsulation options that can be flexibly selected according to specific deployment environments and security requirements. At the same time, through negotiation mechanisms and degradation strategies, interoperability is ensured under various network conditions.

[0088] DMA data transfer unit: realizes direct data exchange between network data and host memory, improving transmission efficiency.

[0089] When the network card receives a data packet, the DMA unit transfers the data directly to the pre-allocated system memory buffer, without the need for processing module intervention, reducing data copying and processing module overhead.

[0090] When data needs to be sent, the DMA unit directly reads the data packet from the system memory and transfers it to the network card's send buffer, which improves the efficiency of data transmission and reduces the burden on the processing module.

[0091] The host interface unit is connected to the media access control module and is used for data exchange with the host.

[0092] The host interface unit is an interface type that can be used to connect the network card and the host, such as:

[0093] PCI (Peripheral Component Interconnect), PCI-X (PCI eXtended)

[0094] USB (Universe Ser ia l Bus) and Thunderbolt and other interface units.

[0095] The host interface unit is responsible for data interaction between the network card and the host system. Through this interface, the host can: send data to be transmitted to the network card, receive decrypted data from the network card, and configure and manage the network card, such as setting filtering rules, encryption policies, etc.

[0096] like Figure 3 As shown, when sending data:

[0097] 1. Data enters the network card from the host through the PCI e interface;

[0098] 2. The media access control module performs preliminary processing and filtering of the data;

[0099] 3. The processing module performs quantum encryption on the data;

[0100] 4. The encrypted data is routed through the media access control module;

[0101] 5. The data is converted by the physical layer interface module and sent to the network.

[0102] When receiving data:

[0103] 1. Encrypted data enters the physical layer interface module from the network.

[0104] 2. The media access control module performs preliminary processing and filtering on the data.

[0105] 3. Quantum decryption of data through processing modules.

[0106] In a possible implementation, the media access control module further includes an instruction control unit, which is used to receive a control instruction sent by the host, and the control instruction includes:

[0107] Instructions for setting rules for the media access control module, wherein the rules include filtering rules based on protocols, flow labels or data features;

[0108] Exemplary, protocol-based filtering rules: the network card can be set to process only specific network protocols (such as TCP, UDP, etc.);

[0109] Filtering rules based on flow labels: Filtering can be performed based on the flow identifier of the data packet, which helps to achieve fine-grained flow control;

[0110] Filtering rules based on data features: Filtering can be performed based on the content features of the data packet (such as a specific string or pattern);

[0111] An instruction for setting a function switch of the media access control module, used to turn on or off a rule filtering or encryption and decryption function;

[0112] This type of command allows the host to flexibly control the opening or closing of certain functions of the network card;

[0113] For example, the switch of the rule filtering function: the above filtering rules can be enabled or disabled when needed;

[0114] Encryption / decryption switch: It can control whether to perform quantum encryption / decryption on data, which can improve transmission efficiency in some scenarios where high security is not required;

[0115] Instructions for performing parameter configuration on the processing module, used to configure access information and key control parameters of the quantum security network;

[0116] Used to configure parameters related to quantum secure networks in the processing module.

[0117] For example, access information configuration: setting the parameters required to connect to the quantum security network, such as network address, authentication information, etc.

[0118] Key control parameter configuration: set parameters related to quantum key distribution and management, such as key update frequency, key length, etc.

[0119] During specific implementation, the instruction control unit can be implemented through an API interface. Exemplarily, the API interface may include the following aspects: Initialization interface: used to initialize the instruction control unit. Rule setting interface: allows the host to set filtering rules based on protocols, flow labels or data features. The interface can accept different types of rule parameters. Rule management interface: includes the functions of adding, deleting, modifying and querying rules. Function control interface: used to enable or disable filtering functions. Status query interface: allows the host to query the current filtering rules and function status. Error handling interface: used to obtain error information during the operation process. The host program can call these APIs to perform the required operations, such as setting new filtering rules, modifying existing rules, enabling or disabling filtering functions, etc.

[0120] In a possible implementation, the media access control module is configured to:

[0121] Only quantum-encrypted data is allowed to be transmitted from the processing module to the external network;

[0122] All data sent from the network card to the external network must be processed by quantum encryption. The media access control module checks the data from the processing module to ensure that they have been encrypted. If unencrypted data is detected, the media access control module will block its transmission or return it to the processing module for encryption.

[0123] Only quantum-encrypted data is allowed to be transmitted from the external network to the processing module.

[0124] All data received from external networks must be quantum encrypted.

[0125] The MAC module checks incoming packets to ensure they are encrypted. If unencrypted packets are detected, the MAC module simply discards them and does not allow them to pass to the processing module.

[0126] The settings of the media access control module can ensure that all data entering and leaving the network card is quantum encrypted, greatly reducing the risk of data being eavesdropped or tampered with. Through hardware-level control, encryption policies are strictly enforced to avoid possible loopholes or bypasses at the software level. Even if an internal system attempts to send unencrypted sensitive data, it will be blocked, helping to prevent internal data leakage. Administrators can be sure that all communications through this network card are encrypted without the need for additional monitoring measures.

[0127] In this embodiment, the processing module uses a quantum random number generator (QRNG) to generate true random numbers as encryption keys; wherein the QRNG can be based on quantum phenomena, such as the quantum state of photons or the spin of electrons, etc. For example, a single photon source and a photodetector can be used to generate random bits by measuring the polarization state of photons.

[0128] When encrypting, choose an efficient symmetric encryption algorithm, such as AES (Advanced Encryption Standard). Use the random number generated by QRNG as the key of AES. Divide the plaintext data to be transmitted into blocks, and encrypt each block using the AES algorithm and quantum random key. The encrypted data blocks are combined into ciphertext.

[0129] During decryption, the receiver obtains the ciphertext and uses the same symmetric encryption algorithm (such as AES) and key to decrypt the received ciphertext.

[0130] To further improve security, the quantum random key can be updated regularly to improve the security of the system. A data integrity check mechanism can be added, such as using a quantum hash function, to verify whether the data has been tampered with during transmission.

[0131] The QRNG can be integrated into the processing module, or an external QRNG device can be connected through a secure interface.

[0132] In one possible implementation, the two communicating parties can pre-share a series of quantum true random numbers generated by QRNG. These preset random numbers will be used as "key encryption keys" to provide protection for the actual encryption keys of each communication.

[0133] In the actual communication process, the sender uses QRNG to generate a new random number as the key for this AES encryption. Then, the sender selects a preset quantum true random number to encrypt this AES key. The sender sends the encrypted AES key, an identifier for indicating which preset quantum true random number to use, and the actual data encrypted with the AES key to the receiver.

[0134] After receiving this information, the receiver first selects the correct "key encryption key" from the pre-stored quantum true random number based on the received identifier. Using this key, the receiver can decrypt the AES key for this communication, and then use this AES key to decrypt the actual data. This method avoids the trouble of transmitting a new key through a secure channel for each communication, while maintaining a high degree of security.

[0135] The use of newly generated AES keys for each communication increases security, while preset quantum true random numbers provide an additional layer of protection. The security of the system is further enhanced by sending identifiers instead of directly sending "key encryption keys".

[0136] In addition, during the specific implementation process, a key center can be established to generate, store and distribute quantum random number keys. The key center is equipped with a high-performance quantum random number generator (QRNG) to generate a large number of high-quality random numbers.

[0137] During the manufacturing or initialization phase of the network card, an initial quantum random number key (called a root key) is preset. The root key is used for initial secure communication between the network card and the key center.

[0138] The NIC sends a key update request to the key center periodically or when needed. The request contains the NIC's unique identifier and current timestamp, encrypted using the current valid key.

[0139] After receiving the request, the key center uses QRNG to generate a new quantum random number key. The key center uses the current valid key (or root key) of the network card to encrypt the newly generated key. The key center sends the encrypted new key to the requesting network card. Secure network protocols such as TLS can be used during the transmission process to provide an additional layer of protection.

[0140] The network card receives the encrypted new key, decrypts it using the currently valid key (or root key), and obtains a new quantum random number key.

[0141] The network card uses the new quantum random number key to symmetrically encrypt the data (such as using the AES algorithm).

[0142] A key rotation mechanism can be implemented to regularly update keys and improve system security. Use secure storage methods (such as hardware security modules HSM) to protect the keys in the network card. Add additional authentication mechanisms during key transmission to prevent man-in-the-middle attacks.

[0143] The above method avoids the complexity of traditional quantum key distribution QKD, while still taking advantage of quantum random numbers to enhance encryption strength. It is convenient for centralized management and easy to implement, and is more suitable for large-scale network environments.

[0144] In the above solution, the media access control module acts as an intermediate layer between the host and the processing module, providing critical security isolation. It prevents potential malware or attacks from directly accessing the processing module, increasing the overall security of the system. By centralizing functions such as data reception, forwarding, and encapsulation in the media access control module, a clear functional separation is achieved, making the system easier to manage, upgrade, and maintain. The media access control module can efficiently process data streams, reducing the burden on the host CPU and processing modules. It can implement intelligent scheduling of data streams and optimize overall performance. The media access control module provides a hardware-level protection layer that is more difficult to crack or bypass than pure software solutions.

[0145] Embodiment 2: The media access control module further includes a security verification module for verifying the operator's identity by identity authentication or U-Key verification when receiving a rule setting or function switch instruction, so as to prevent encryption rules and filtering rules from being tampered with without authorization.

[0146] Among them, identity authentication: may include username / password combination, biometrics (such as fingerprint or facial recognition), or multi-factor authentication;

[0147] U-Key Authentication: Uses a physical USB security key that needs to be inserted into the device for authentication;

[0148] The protection objectives include: Encryption rules: Control the specific parameters and methods of data encryption. Filtering rules: Determine which data can pass through the network card and which should be blocked.

[0149] This ensures that only authorized personnel can change these critical settings, preventing malicious insiders or external attackers from modifying security rules.

[0150] Embodiment 3: A method for encrypting and sending data using a quantum secure smart network card, comprising the following steps:

[0151] S101: The media access control module receives data to be sent through the host interface unit and forwards it to the processing module;

[0152] The media access control module receives data to be sent through the host interface unit, which may come from the computer's application program or operating system, and the data is forwarded to the processing module for further processing;

[0153] S102: Utilize the processing module to execute network protocol processing and perform quantum encryption on the data to generate ciphertext data;

[0154] The processing module performs network protocol processing, which may include segmentation, encapsulation and other operations, performs quantum encryption on data, and generates ciphertext data.

[0155] S103: The processing module transmits the ciphertext data to the media access control module;

[0156] S104: The media access control module encapsulates the encrypted data packet according to the network topology and routing protocol to form a quantum encrypted data packet, and then forwards the quantum secure data packet to the physical layer interface module;

[0157] The media access control module encapsulates the encrypted data according to the network topology and routing protocol to form a complete quantum encrypted data packet, including the necessary routing information; the data packet is forwarded to the physical layer interface module through the switching / routing unit;

[0158] S105: Sending the encrypted data packet to the external network through the physical layer interface module;

[0159] The physical layer interface module sends the encrypted data packets to the external network, which may involve converting the data into electrical or optical signals suitable for network transmission.

[0160] In the solution of this embodiment, the data is encrypted before leaving the host to ensure the security of the entire transmission process. The use of quantum encryption technology provides a higher level of security and can resist future quantum computing attacks. After encryption, it still follows the standard network protocol to ensure compatibility with existing network infrastructure.

[0161] Example 4: Figure 5 As shown, the method for processing data received by the global quantum security smart network card includes the following steps:

[0162] S201: receiving data from an external network through a physical layer interface module, and performing signal conversion and processing;

[0163] The physical layer interface module is responsible for receiving raw data signals from the external network. These signals may be electrical or optical signals, and need to be converted and preliminarily processed to become digital signals that can be understood and processed by other modules inside the network card. This step ensures that external data can enter the network card correctly.

[0164] S202: transmitting the processed data to the media access control module, where the network traffic processing unit performs preprocessing and filtering;

[0165] The data processed by the physical layer is transmitted to the media access control module; the network traffic processing unit in the media access control module pre-processes and filters the data; this may include removing redundant information, checking data integrity, and preliminary classification; the purpose of this step is to optimize the data flow and improve the efficiency of subsequent processing;

[0166] S203: The switching / routing unit in the media access control module decapsulates the quantum encrypted data packet and transmits the data to the processing module;

[0167] Decapsulate the received quantum encrypted data packets; the decapsulation process may include removing the header information of the transport layer and extracting the real encrypted data content; the decapsulated data is then transmitted to the processing module to prepare for the next step of decryption;

[0168] S204: The processing module decrypts the data into plaintext data using a quantum decryption algorithm, and performs a calculation operation on the plaintext data obtained by decryption to generate processing result data; wherein, if the processing result data needs to be sent to an external network, the generated processing result data is again subjected to a quantum encryption operation before being transmitted;

[0169] The processing module uses a quantum decryption algorithm to convert encrypted data into plaintext, and then performs corresponding computational processing operations based on the decrypted plaintext data to generate processing result data; the processing may include complex operations such as data analysis and decision making;

[0170] If the processing result data needs to be sent to an external network, the processing module will perform quantum encryption on the data again to ensure that the data remains encrypted throughout the entire transmission process, thereby greatly improving security.

[0171] Using quantum encryption technology, a very high level of data protection is provided. From receiving to processing to sending, data encryption is maintained throughout the process. It not only protects the security of data transmission, but also provides data processing capabilities, making the network card an intelligent network security device.

[0172] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A global quantum security smart network card, characterized in that: include: A processing module, used to perform network protocol processing and quantum encryption / decryption processing on data; Physical layer interface module, used to realize network physical connection and signal processing; The media access control module is arranged between the physical layer interface module and the processing module, and is used to isolate the unencrypted data and the decrypted plaintext data in the processing module, prevent external network devices from directly accessing the processing module, and perform data packet processing, including routing decisions, data exchange and traffic filtering. The host interface unit is connected to the media access control module and is used for data exchange with the host.

2. The smart network card according to claim 1, characterized in that: The media access control module includes: A network traffic processing unit, used to perform network traffic preprocessing, filtering and security detection; Switching / routing unit, used to implement packet forwarding, routing selection and quantum secure communication protocol processing.

3. The smart network card according to claim 2, characterized in that: The media access control module also includes: DMA data transfer unit, used to realize direct data exchange between network data and host memory.

4. The smart network card according to claim 1, characterized in that: The media access control module also includes an instruction control unit, which is used to receive a control instruction sent by the host, and the control instruction includes: Instructions for setting rules for the media access control module, wherein the rules include filtering rules based on protocols, flow labels or data features; An instruction for setting a function switch of the media access control module, for turning on or off a rule filtering or encryption / decryption function; The instruction for performing parameter configuration on the processing module is used to configure access information and key control parameters of the quantum security network.

5. The smart network card according to claim 4, characterized in that: The media access control module also includes a security verification module, which is used to verify the operator's identity through identity authentication or U-Key verification when receiving a rule setting or function switch instruction, so as to prevent encryption rules and filtering rules from being tampered with without authorization.

6. The global quantum secure smart network card according to claim 4, characterized in that: The media access control module is configured as follows: Only quantum-encrypted data is allowed to be transmitted from the processing module to the external network; Only quantum-encrypted data is allowed to be transmitted from the external network to the processing module.

7. A method for encrypting and sending data of a global quantum secure smart network card, characterized in that: The following steps are involved: The media access control module receives the data to be sent through the host interface unit and forwards it to the processing module; The processing module is used to perform network protocol processing and quantum encrypt the data to generate ciphertext data; The processing module transmits the ciphertext data to the media access control module; The media access control module encapsulates the encrypted data packet according to the network topology and routing protocol to form a quantum encrypted data packet, and then forwards the quantum secure data packet to the physical layer interface module; The encrypted data packets are sent to the external network through the physical layer interface module.

8. A method for processing data received by a global quantum security smart network card, characterized in that: The following steps are involved: Receive data from the external network through the physical layer interface module and perform signal conversion and processing; The processed data is transmitted to the media access control module, where the network traffic processing unit performs preprocessing and filtering; The switching / routing unit in the media access control module decapsulates the quantum encrypted data packet and transmits the data to the processing module; The processing module uses a quantum decryption algorithm to decrypt it into plaintext data, performs calculations and processing operations on the decrypted plaintext data, and generates processing result data; if the processing result data needs to be sent to an external network, the generated processing result data is again subjected to quantum encryption operations before being transmitted.

Images