UDP link management method and device based on quantum encryption card and storage medium

Abstract

The invention discloses a UDP link management method and device based on a quantum encryption card and a storage medium. The method comprises the steps that the quantum encryption card establishes a UDP link management table; and when the external link of the quantum encryption card receives the ciphertext UDP data packet from the security server, obtaining the tetrad information and the external link handle of the ciphertext UDP data packet, and searching the corresponding node in the UDP link management table according to the tetrad information and the external link handle of the ciphertext UDP data packet. According to the method, the UDP link management table is established through the quantum encryption and decryption card, the quad information of the UDP data packet is sequentially subjected to the XOR operation, then the modular operation is carried out on the total number n of the slot positions of the UDP link management table, so that the corresponding slot position number is obtained, the related node information is indexed in the slot positions through the quad information and the link handle, and the UDP data packet is obtained. The link searching speed is high, a large-flow transmission environment is supported, and the data transmission performance is improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a UDP link management method, device and storage medium based on a quantum encryption card. Background Art

[0002] In the current era of frequent network data security incidents, traditional encryption methods are seriously challenged, and quantum encryption technology has emerged. As a security agent, the quantum encryption card can perform quantum encryption on the plaintext data sent by the application terminal in the secret area, and send the obtained ciphertext to the security server in the non-secret area; at the same time, it can perform quantum decryption on the ciphertext sent by the security server in the non-secret area, and forward the obtained plaintext to the application terminal in the secret area.

[0003] The quantum encryption card receives the non-secret zone ciphertext UDP link connection request by creating the same listening port as the internal cipher zone application terminal on the external network card. When receiving the ciphertext connection request from the non-secret zone security server, it will synchronously create a UDP plaintext link on the internal network card with the same port as the internal application server. In this way, there is a one-to-one correspondence between the ciphertext link between the encryption card agent / non-secret zone server and the plaintext link between the encryption card agent / secret zone application, and data can be created, destroyed, and sent and received synchronously.

[0004] Because UDP is a connectionless protocol, the two communicating parties do not need to establish a connection before data transmission, nor do they need to disconnect. Therefore, a method is needed to determine whether a certain UDP link is the first time to receive data or the client has deleted the link, that is, it is necessary to synchronously create or disconnect the internal or external UDP link. At the same time, when external ciphertext data arrives, it is necessary to find the corresponding internal UDP plaintext link, that is, the internal link, to forward the plaintext. And when internal plaintext data arrives, it is necessary to find the corresponding external UDP ciphertext link, that is, the external link, to forward the ciphertext. For UDP, a connectionless link, how to manage the creation and deletion of the link, and when the data traffic is very large, how to achieve the mapping and search of the internal and external links, has become a bottleneck problem in the data transmission and reception processing performance of the encryption card. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a UDP link management method, device and storage medium based on a quantum encryption card, which solves the problem that the existing UDP has no connection link and cannot manage the creation and deletion of the link; it also solves the problem that when the data flow is very large, the mapping search of internal and external links cannot be realized and the bottleneck of quantum encryption card data receiving and sending processing cannot be broken through.

[0006] Technical solution: The present invention provides a UDP link management method based on a quantum encryption card, comprising the following steps:

[0007] The quantum encryption card establishes a UDP link management table, which includes slots 0 to n, each slot includes a linked list, each linked list includes multiple nodes, and each node includes four-tuple information, external link handle and internal link handle;

[0008] When the external link of the quantum encryption card receives a ciphertext UDP data packet from the security server, it obtains the four-tuple information and external link handle of the ciphertext UDP data packet, and searches for the corresponding node in the UDP link management table according to the four-tuple information and external link handle of the ciphertext UDP data packet; if the corresponding node is found, the internal link handle in the node is obtained to determine the internal link, and then the ciphertext UDP data packet is decrypted to obtain a plaintext UDP data packet, and the plaintext UDP data packet is sent to the application terminal through the internal link; if the corresponding node cannot be found, the quantum encryption card creates a new internal link handle to determine the new internal link, and then decrypts the ciphertext UDP data packet to obtain a plaintext UDP data packet, and sends the plaintext UDP data packet to the application terminal through the new internal link, and creates a new node in the UDP link management table, which includes the external link handle, the new internal link handle and the four-tuple information of the ciphertext UDP data packet;

[0009] When the internal link of the quantum encryption card receives a plaintext UDP data packet from the application terminal, the above process is executed in reverse.

[0010] Furthermore, the four-tuple information includes a source IP value, a destination IP value, a source port value and a destination port value.

[0011] Furthermore, the specific process of searching the corresponding node in the UDP link management table according to the four-tuple information of the ciphertext UDP data packet and the external link handle is:

[0012] The quantum encryption card obtains the 4-tuple information of the data packet from the ciphertext UDP data packet of the external link, performs XOR operation on the source IP value, destination IP value, source port value and destination port value in the 4-tuple information in sequence to obtain the XOR value, and performs modulo operation on the XOR value with the total number of slots n to obtain the remainder m, which is the corresponding slot number;

[0013] The quantum encryption card searches for the corresponding node in the linked list of the mth slot according to the four-tuple information of the data packet and the external link handle.

[0014] Furthermore, creating a new node in the UDP link management table means that the quantum encryption card creates a new node on the linked list in the mth slot of the UDP link management table, and writes the four-tuple information of the external link handle, the new internal link handle and the ciphertext UDP data packet to the new node, and uses the four-tuple information of the external link handle and the ciphertext UDP data packet as the new node index.

[0015] Furthermore, when the internal link of the quantum encryption card receives a plaintext UDP data packet from the application terminal, the above process is executed in reverse. The specific process is:

[0016] When the internal link of the quantum encryption card receives a plaintext UDP data packet from the application terminal, it obtains the four-tuple information and the internal link handle of the plaintext UDP data packet, and searches for the corresponding node in the UDP link management table according to the four-tuple information and the internal link handle of the plaintext UDP data packet; if the corresponding node is found, the external link handle in the node is obtained to determine the external link, and then the plaintext UDP data packet is encrypted to obtain a ciphertext UDP data packet, and the ciphertext UDP data packet is sent to the security server through the external link; if the corresponding node cannot be found, the quantum encryption card creates a new external link handle to determine the new external link, and then the plaintext UDP data packet is encrypted to obtain a ciphertext UDP data packet, and the ciphertext UDP data packet is sent to the security server through the new external link, and a new node is created in the UDP link management table, which includes the internal link handle, the new external link handle and the four-tuple information of the plaintext UDP data packet.

[0017] Furthermore, the node also includes encryption ratio and active time.

[0018] The present invention also includes a computer device, which includes at least a processor and a memory, and the processor is used to implement the UDP link management method based on the quantum encryption card as described in any one of the above claims when executing the computer program stored in the memory.

[0019] The present invention also includes a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the UDP link management method based on a quantum encryption card as described in any one of the above claims.

[0020] Beneficial effects of the present invention: The present invention establishes a UDP link management table through a quantum encryption and decryption card, performs XOR operations on the four-tuple information of the UDP data packet in sequence, and then performs a modulo operation on the total number of slots n in the UDP link management table to obtain the corresponding slot number, and then searches for the corresponding link handle in the node corresponding to the slot, and finally sends the UDP data packet out. The present invention uses the UDP link management table to find the slot corresponding to the data packet, and then indexes the relevant node information in the slot through the four-tuple information and the link handle, so that the link search speed is fast, there is no need to freeze in finding the corresponding link, and there is no need to traverse all nodes to find the corresponding link handle, supports large-flow transmission environment, and improves data transmission performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 Schematic diagram of the quantum encryption environment;

[0022] Figure 2 This is a schematic diagram of the quantum UDP link management table structure. DETAILED DESCRIPTION

[0023] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0024] The existing UDP connectionless link cannot manage the creation and deletion of links. When searching for the corresponding link handle from the node, almost all nodes must be traversed to find the corresponding node, which is time-consuming and laborious. Especially when the data flow is very large, it is impossible to achieve fast mapping and searching of internal and external links, which ultimately leads to a bottleneck in the data transmission and reception of quantum encryption cards. In view of this, the present application proposes a UDP link management method based on a quantum encryption card.

[0025] like Figure 1 As shown, the participants of the present invention include a quantum encryption card, a security server and an application terminal, and the UDP link management method thereof includes the following steps:

[0026] To determine whether a UDP link is receiving data for the first time or the client has deleted the link, it is necessary to establish a UDP link management table. Therefore, the quantum encryption card first establishes a UDP link management table, such as Figure 2As shown, the UDP link management table is a hash table. The UDP link management table includes slots 0 to n. This embodiment takes slots 0 to 4 as an example. Each slot includes a linked list. Each linked list includes multiple nodes. Each node includes four-tuple information, an external link OuterFd handle, an internal link InnerFd handle, an encryption ratio, an active time, etc. The encryption ratio refers to different encryption ratios (for example, if the encryption ratio is 2, a one-byte key encrypts 2 bytes of plain text) and the IP of the security server to be sent for different UDP port plaintext data. This allows different encryption ratios to be used for different ports to encrypt ciphertexts and send them to different security servers. The active time refers to when data arrives, the active time in the corresponding management table node is updated, and each link node in the management table is traversed regularly. If no data arrives at this link node after a certain period of time and the active time times out, the corresponding client link handle is deleted, and this node is deleted.

[0027] The four-tuple information includes the source IP value, the destination IP value, the source port value, and the destination port value. When a UDP data packet comes, the link node information is searched in the UDP link management table. If it cannot be found, it means that this link is a new link, and a link handle needs to be established in the corresponding internal or external part and data is sent. If it is found, the found link handle is used directly to send data. If a link node in the UDP data management table has no data for a long time, it can be considered that the link has been deleted by the other end, and the time can be set to delete the corresponding internal or external client handle.

[0028] When an external link OuterFd of the quantum encryption card receives a ciphertext UDP data packet from a security server (in the uplink direction, from the non-confidential area security server to the confidential area application terminal), it obtains the quaternary information of the ciphertext UDP data packet and the external link OuterFd handle, and searches for the corresponding node, that is, the corresponding internal link InnerFd, in the UDP link management table according to the quaternary information of the ciphertext UDP data packet and the external link OuterFd handle. The specific process is as follows: the quantum encryption card obtains the quaternary information of the data packet from the ciphertext UDP data packet of the external link OuterFd, performs XOR operations on the source IP value, the destination IP value, the source port value and the destination port value in the quaternary information in sequence to obtain the XOR value, performs a modulus operation on the XOR value with the total number of slots n to obtain the remainder m, and the remainder m is the corresponding slot number. It can be seen that the slot number is calculated based on the quaternary information; the quantum encryption card searches for the corresponding node in the linked list of the mth slot according to the quaternary information of the data packet and the external link OuterFd handle.

[0029] If the corresponding node is found, the internal link InnerFd handle in the node is obtained to determine the internal link InnerFd, and then the ciphertext UDP data packet is decrypted to obtain the plaintext UDP data packet, and the plaintext UDP data packet is sent to the application terminal through the internal link InnerFd; if the corresponding node cannot be found, the quantum encryption card creates a new internal link InnerFd handle to determine the new internal link InnerFd, that is, the new internal link InnerFd is the internal link InnerFd indicated by the new internal link InnerFd handle created by the quantum encryption card. Then the ciphertext UDP data packet is decrypted to obtain the plaintext UDP data packet, and the plaintext UDP data packet is sent to the application terminal through the new internal link InnerFd, and a new node is created in the UDP link management table, which includes the four-tuple information of the external link OuterFd handle, the new internal link InnerFd handle and the ciphertext UDP data packet;

[0030] Creating a new node in the UDP link management table means: the quantum encryption card creates a new node on the linked list in the mth slot of the UDP link management table, and writes the external link OuterFd handle, the new internal link InnerFd handle and the four-tuple information of the ciphertext UDP data packet to the new node, and uses the external link OuterFd handle and the four-tuple information of the ciphertext UDP data packet as the new node index.

[0031] When the internal link InnerFd of the quantum encryption card receives a plaintext UDP data packet from the application terminal (downstream, from the encrypted area application terminal to the non-encrypted area security server), the above process is executed in reverse. The specific process is:

[0032] When an internal link InnerFd of the quantum encryption card receives a plaintext UDP data packet from an application terminal, it obtains the four-tuple information of the plaintext UDP data packet and the handle of the internal link InnerFd, and searches for the corresponding node, that is, the corresponding external link OuterFd, in the UDP link management table according to the four-tuple information of the plaintext UDP data packet and the handle of the internal link InnerFd; if the corresponding node is found, the handle of the external link OuterFd in the node is obtained to determine the external link OuterFd, and then the plaintext UDP data packet is encrypted to obtain the ciphertext UDP data packet, and the ciphertext UDP data packet is sent through the external link OuterFd. Send it to the security server; if the corresponding node cannot be found, the quantum encryption card creates a new external link OuterFd handle to determine the new external link OuterFd, and then encrypts the plaintext UDP data packet to obtain a ciphertext UDP data packet, and sends the ciphertext UDP data packet to the security server through the new external link OuterFd, and creates a new node in the UDP link management table, which includes the internal link InnerFd handle, the new external link OuterFd handle and the four-tuple information of the plaintext UDP data packet, and uses the internal link InnerFd handle and the four-tuple information of the plaintext UDP data packet as the new node index.

[0033] In summary, the present invention establishes a UDP link management table through a quantum encryption and decryption card, performs XOR operations on the four-tuple information of the UDP data packet in sequence, and then performs a modulo operation on the total number of slots n in the UDP link management table to obtain the corresponding slot number, and then searches for the corresponding link handle in the node of the corresponding slot, and finally sends the UDP data packet out. The present invention uses the UDP link management table to find the slot corresponding to the data packet, and then indexes the relevant node information in the slot through the four-tuple information and the link handle, so that the link search speed is fast, there is no need to freeze in the search for the corresponding link, and there is no need to traverse all nodes to find the corresponding link handle, which supports large-flow transmission environments and improves data transmission performance.

[0034] An embodiment of the present invention further provides a computer device, which includes at least a processor and a memory, wherein the memory stores a computer program, and the processor is used to implement the steps in the UDP link management method based on a quantum encryption card in an embodiment of the present invention when executing the computer program stored in the memory.

[0035] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps in the UDP link management method based on a quantum encryption card in an embodiment of the present invention are implemented.

Claims

1. A UDP link management method based on a quantum encryption card, characterized in that: The following steps are involved: The quantum encryption card establishes a UDP link management table, which includes slots 0 to n, each slot includes a linked list, each linked list includes multiple nodes, and each node includes four-tuple information, external link handle and internal link handle; When the external link of the quantum encryption card receives a ciphertext UDP data packet from the security server, it obtains the four-tuple information and external link handle of the ciphertext UDP data packet, and searches for the corresponding node in the UDP link management table according to the four-tuple information and external link handle of the ciphertext UDP data packet; If the corresponding node is found, the internal link handle in the node is obtained to determine the internal link, and then the ciphertext UDP data packet is decrypted to obtain the plaintext UDP data packet, and the plaintext UDP data packet is sent to the application terminal through the internal link; if the corresponding node cannot be found, the quantum encryption card creates a new internal link handle to determine the new internal link, and then decrypts the ciphertext UDP data packet to obtain the plaintext UDP data packet, and sends the plaintext UDP data packet to the application terminal through the new internal link, and creates a new node in the UDP link management table, which includes the four-tuple information of the external link handle, the new internal link handle and the ciphertext UDP data packet; When the internal link of the quantum encryption card receives a plaintext UDP data packet from the application terminal, the above process is executed in reverse.

2. According to claim 1, a UDP link management method based on a quantum encryption card is characterized in that: The four-tuple information includes a source IP value, a destination IP value, a source port value and a destination port value.

3. A UDP link management method based on a quantum encryption card according to claim 2, characterized in that: The specific process of searching the corresponding node in the UDP link management table according to the four-tuple information of the ciphertext UDP data packet and the external link handle is as follows: The quantum encryption card obtains the 4-tuple information of the data packet from the ciphertext UDP data packet of the external link, performs XOR operation on the source IP value, destination IP value, source port value and destination port value in the 4-tuple information in sequence to obtain the XOR value, and performs modulo operation on the XOR value with the total number of slots n to obtain the remainder m, which is the corresponding slot number; The quantum encryption card searches for the corresponding node in the linked list of the mth slot according to the four-tuple information of the data packet and the external link handle.

4. A UDP link management method based on a quantum encryption card according to claim 3, characterized in that: Creating a new node in the UDP link management table means that the quantum encryption card creates a new node on the linked list in the mth slot of the UDP link management table, writes the four-tuple information of the external link handle, the new internal link handle and the ciphertext UDP data packet to the new node, and uses the four-tuple information of the external link handle and the ciphertext UDP data packet as the new node index.

5. A UDP link management method based on a quantum encryption card according to claim 1, characterized in that: When the internal link of the quantum encryption card receives a plaintext UDP data packet from the application terminal, the above process is executed in reverse. The specific process is: When the internal link of the quantum encryption card receives a plaintext UDP data packet from the application terminal, it obtains the four-tuple information and the internal link handle of the plaintext UDP data packet, and searches for the corresponding node in the UDP link management table according to the four-tuple information and the internal link handle of the plaintext UDP data packet; If the corresponding node is found, the external link handle in the node is obtained to determine the external link, and then the plaintext UDP data packet is encrypted to obtain a ciphertext UDP data packet, and the ciphertext UDP data packet is sent to the security server through the external link; if the corresponding node is not found, the quantum encryption card creates a new external link handle to determine the new external link, and then the plaintext UDP data packet is encrypted to obtain a ciphertext UDP data packet, and the ciphertext UDP data packet is sent to the security server through the new external link, and a new node is created in the UDP link management table, which includes the four-tuple information of the internal link handle, the new external link handle and the plaintext UDP data packet.

6. According to a UDP link management method based on a quantum encryption card according to claim 1, it is characterized in that: The node also includes the encryption ratio and active time.

7. A computer device, characterized in that: The computer device includes at least a processor and a memory, and the processor is used to implement the UDP link management method based on the quantum encryption card as described in any one of claims 1-6 when executing the computer program stored in the memory.

8. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements a UDP link management method based on a quantum encryption card as described in any one of claims 1 to 6.

Images