Heterogeneous multipath secure routing calculation method based on software defined network load balancing

Abstract

The invention discloses a heterogeneous multipath secure routing calculation method based on software defined network load balancing, which comprises the following steps of: 1) transmitting a derived encryption key and an authentication key to a switch by using a secure channel, and constructing an identity identifier of the switch by using an ID (Identity) and an input port number of the switch; 2) constructing a temporary storage message by using an input port number and an identity identifier of the switch and a plaintext message; constructing a routing forwarding data packet based on the encryption key, the authentication key and the temporary storage message; 3) generating a heterogeneous path set of multiple groups of source node-destination node pairs; 4) carrying out flow load balancing on paths of the multiple groups of source-destination node pairs; and 5) verifying the data packet by the next switch on the transmission path, if the verification is successful, forwarding the data packet to the downstream, and if the verification is failed, stopping routing, positioning the damaged switch and rerouting the data packet according to a new path. According to the method, the flow is distributed for the generated path, and the load balance is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information stable transmission protection, and in particular to a heterogeneous multi-path secure routing calculation method based on software-defined network load balancing. Background Art

[0002] Software-defined networking is an emerging network architecture that separates the control plane from the data plane, making network management and configuration more flexible and efficient. However, since the data plane involves relevant sensitive information, routing and information protection during information transmission become an important issue. In the process of information transmission, security is considered to be one of the most important issues. At present, the research on software-defined networking is in a period of vigorous development, and the inherent security of software-defined networking is crucial. Summary of the invention

[0003] The object of the present invention is to provide a heterogeneous multi-path secure routing calculation method based on software-defined network load balancing.

[0004] The technical solution adopted by the present invention is:

[0005] The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing includes the following steps:

[0006] 1) Use a secure channel to transmit the derived encryption key and authentication key to the switch, and construct the switch identity identifier using the switch ID and input port number;

[0007] 2) Using the current switch S i Input port numberInport(S i ) and the identity identifier FID i , and the plaintext message M constructs the temporary storage message Itm, the specific content of the temporary storage message Itm is Inport(S i )||FID i ||Enc(E k ,M); based on the encryption key E k 、Authentication Key A k The temporary message Itm is constructed to carry information Enc(E k ,Itm||Sig(A k ,Itm)) routing forwarding data packets; where Enc() represents encryption action, Sig() represents signature action;

[0008] 3) Generate multiple sets of heterogeneous path sets of source node-destination node pairs;

[0009] 4) Load balancing traffic for paths of multiple source-destination node pairs;

[0010] 5) The next switch on the transmission path verifies the data packet. If the verification succeeds, it forwards it downstream. If the verification fails, it stops routing, locates the damaged switch, and reroutes the data packet according to the new path.

[0011] The specific method of step 1 is:

[0012] 1-1, use a secure channel to transmit the derived encryption key E k and authentication key A k To the switch;

[0013] 1-2, switch S i Generate your own SID i , and its own input port number Inport(S i );

[0014] 1-3, using SID i and Import(S i )Construct S i FID i , Identifier FID i The specific content is in Indicates XOR action;

[0015] The specific method of step 2 is:

[0016] 2-1, using encryption key E k Encrypt the plaintext message M, denoted as Enc(E k ,M), where Enc() represents the encryption action;

[0017] 2-2, Import(S i )、FID i and Enc(E k ,M) in series, recorded as temporary message Itm, Itm can be expressed as Inport(S i )||FID i ||Enc(E k ,M);

[0018] 2-3, using authentication key A k Sign the temporarily stored message Itm, recorded as Sig(A k ,Itm), where Sig() represents the signature action;

[0019] 2-4, connect Itm and Sig (A k ,Itm), recorded as Itm||Sig(A k ,Itm);

[0020] 2-5, using encryption key R k For Itm and Sig(A k ,Itm) encryption, construct routing forwarding data packet Enc(E k ,Itm||Sig(A k ,Itm));

[0021] The specific method of step 3 is:

[0022] 3-1, initialize the network topology G, an empty heterogeneous multi-path set Min(P) and a positive integer counter i, where i=1;

[0023] 3-2, obtain the network path set P from the network topology G i , node set V i 、The node degree IS(V i ) and the total number of nodes N(V);

[0024] 3-3, determine whether the size of i and the total number of nodes N(V) satisfies i≤N(V); if yes, execute 3-4; otherwise, complete the selection of heterogeneous paths if not satisfied;

[0025] 3-4, select the first node V with the smallest degree i :IS(V i )≤IS(V′), where VT represents the node Vi. i Any node other than

[0026] 3-5, will be with Vi i The connected path P i Add to the heterogeneous multi-path set Min(P);

[0027] 3-6, remove path P in network topology G i Node V i , the counter performs i+1 action;

[0028] 3-7, return to step 3-3;

[0029] The specific method of step 4 is:

[0030] 4-1, in one of the source node-destination node pairs, the flow is allocated to a routing segment of one of the heterogeneous paths HP, denoted as in represents the traffic from the mth to the nth routing segment on the path from the source node s to the destination node d;

[0031] 4-2, generate a random number k, calculate Where k is a decimal between 0 and 1, and “·” is a multiplication operation;

[0032] 4-3, Calculation Recorded as Where “·” is a multiplication operation;

[0033] 4-4, distribute the traffic in path HP To the corresponding routing fragments of another set of heterogeneous paths HP′;

[0034] 4-5, according to the above traffic allocation method, allocate traffic to all path segments of the heterogeneous path HP′;

[0035] The specific method of step 5 is:

[0036] 5-1, switch S i+1 Use E k Decryption from switch S i Data packet Enc(E k ,Itm||Sig(A k ,Itm)) obtainItm||Sig(A k ,Itm);

[0037] 5-2, Separation of Itm||Sig(A k ,Itm) gets the temporary message Itm:Inport(S i )||FID i ||Enc(E k ,M) and Sig(A k ,Itm);

[0038] 5-3, the next switch on the transmission path verifies the temporarily stored message Itm. If the verification result is consistent with Sig(A k ,Itm) matches, then continue to forward to the downstream switch;

[0039] 5-3-1, S i+1 Generate ID number SID i+1 and input port numberInport(S i+1 ) and construct the identity identifier FID i+1 , FID i+1 Expressed as in Indicates XOR action;

[0040] 5-3-2, S i+1 The temporary message Itm is imported (S i ) is replaced by Inport(S i+1 ), FID i Replaced by FID i+1, and generate a new temporary message Itm′, Itm′ is represented by Inpor(S i+1 )||FID i+1 ||Enc(E k ,M);

[0041] 5-3-3, S i+1 Use A k Sign the temporarily stored message Itm′, recorded as: Sig(A k ,Itm′);

[0042] 5-3-4, Itm′ and Sig(A k ,Itm′) are connected in series, recorded as Itm′||Sig(A k ,Itm′);

[0043] 5-3-5, using E k For Itm′||Sig(A k ,Itm′ is encrypted and forwarded to the downstream switch. k ,Itm′||Sig(A k ,Itm′));

[0044] 5-4, if the verification result of the temporarily stored message Itm is the same as ig(A k ,Itm) does not match, then stop routing and locate the damaged switch, select a new path to re-forward the data packet;

[0045] 5-4-1, intercept the temporary message Itm to obtain Inport (S i ) and FID i And perform XOR operation to calculate SID i ,in

[0046] 5-4-2, based on the calculated switch ID: SID i , locate the attacked switch;

[0047] 5-4-3, the source node reconstructs the encryption key E k 、Authentication Key A k The temporary message Itm is constructed to carry information Enc(E k ,Itm||Sig(A k ,Itm))’s routing forwarding data packets;

[0048] 5-4-4, select a path from the heterogeneous multi-path set Min(P) to transmit the data packet;

[0049] 5-4-5, allocate traffic to the selected path;

[0050] 5-4-6, the source node resends the data packet to the destination node along the newly selected path.

[0051] The present invention adopts the above technical solution. When multiple groups of source-destination node pairs send data packets, it is necessary to first calculate the heterogeneous paths from the source node to the destination node, and select one of the paths to transmit the data packet. The purpose is to quickly select other unattacked paths in the heterogeneous path set Min(P) to continue transmitting data after the node transmitting on the path is attacked. Then, appropriate traffic is allocated to the paths of multiple groups of source-destination node pairs to ensure the balance of traffic on each path during the transmission process. Finally, the encapsulated data packet is transmitted on the established link. During the data packet transmission process, each upstream switch will forward the data packet to its downstream switch, and the downstream switch will perform verification operations on the received data packet. When the downstream switch receives the data packet Enc(E k ,Itm||Sig(A k ,Itm)) will use the encryption key E k Decrypt it to get Itm||Sig(A k ,Itm). Then use the authentication key A k Sign the temporarily stored message Itm and verify whether it is consistent with Sig(A k ,Itm). If they match, it means that the upstream switch is not attacked, and the downstream switch re-encapsulates the data packet and sends it to its downstream switch. If they do not match, it means that the upstream switch is attacked, and the downstream switch uses the Inport (S i ) and FID i Calculate the SID of the attacked switch i To locate the damaged switch. Select another unattacked path from the source node to the destination node in the heterogeneous multi-path set Min(P) to re-forward the data packet. The effective effects of the present invention are: 1. When a node in the source path is damaged, other heterogeneous paths can be selected in the heterogeneous multi-path set Min(P) to re-forward the message to ensure the stability of message transmission; 2. Through the multi-path load balancing mechanism, the balanced distribution of traffic during data transmission is guaranteed; 3. Since the temporary message Itm is encrypted and signed before transmission, each routing node can verify the message after receiving the routing information sent by the upstream switch to ensure the integrity and reliability of the message. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments;

[0053] Figure 1A schematic diagram of a flow chart of a heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to the present invention;

[0054] Figure 2 The present invention is a protection routing schematic diagram of a heterogeneous multi-path secure routing calculation method based on software-defined network load balancing. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0056] like Figure 1 As shown in or 2, the present invention discloses a heterogeneous multipath secure routing calculation method based on software-defined network load balancing. In order to achieve this goal, when multiple source-destination node pairs send data packets, it is necessary to first calculate the heterogeneous multipaths of multiple source-destination node pairs, and select one of these paths to transmit the data packet. The purpose is to select other paths that have not been attacked in the heterogeneous path set Min (P) to continue to transmit data after the node transmitted on the path is attacked. Then, according to the traffic load, appropriate traffic is allocated to the paths of multiple source-destination node pairs to ensure the balance of traffic in each group of paths during the transmission process. Finally, the encapsulated data packet is transmitted on the established link.

[0057] like Figure 1 As shown in or 2, the present invention discloses a heterogeneous multi-path secure routing calculation method based on software-defined network load balancing, which includes the following steps:

[0058] 1) Use a secure channel to transmit the derived encryption key and authentication key to the switch, and construct the switch identity identifier using the switch ID and input port number;

[0059] 2) Using the current switch S i Input port numberInport(S i ) and the identity identifier FID i , and the plaintext message M constructs the temporary storage message Itm, the specific content of the temporary storage message Itm is Inport(S i )||FID i ||Enc(E k ,M); based on the encryption key E k 、Authentication Key A k The temporary message Itm is constructed to carry information Enc(E k ,Itm||Sig(A k ,Itm)) routing forwarding data packets; where Enc() represents encryption action, Sig() represents signature action;

[0060] 3) Generate multiple sets of heterogeneous path sets of source node-destination node pairs;

[0061] 4) Load balancing traffic for paths of multiple source-destination node pairs;

[0062] 5) The next switch on the transmission path verifies the data packet. If the verification succeeds, it forwards it downstream. If the verification fails, it stops routing, locates the damaged switch, and reroutes the data packet according to the new path.

[0063] Furthermore, the specific method of step 1 is:

[0064] 1-1, use a secure channel to transmit the derived encryption key E k and authentication key A k To the switch;

[0065] 1-2, switch S i Generate your own SID i , and its own input port number Inport(S i );

[0066] 1-3, using SID i and Import(S i )Construct S i FID i , Identifier FID i The specific content is SID i Import(S i ),in Indicates XOR action;

[0067] Furthermore, the specific method of step 2 is:

[0068] 2-1, using encryption key E k Encrypt the plaintext message M, denoted as Enc(E k ,M), where Enc() represents the encryption action;

[0069] 2-2, Import(S i )、FID i and Enc(E k ,M) in series, recorded as temporary message Itm, Itm can be expressed as Inport(S i )||FID i ||Enc(E k ,M);

[0070] 2-3, using authentication key A kSign the temporarily stored message Itm, recorded as Sig(A k ,Itm), where Sig() represents the signature action;

[0071] 2-4, connect Itm and Sig (A k ,Itm), recorded as Itm||Sig(A k ,Itm);

[0072] 2-5, using encryption key E k For Itm and Sig(A k ,Itm) encryption, construct routing forwarding data packet Enc(E k ,Itm||Sig(A k ,Itm));

[0073] Furthermore, the specific method of step 3 is:

[0074] 3-1, initialize the network topology G, an empty heterogeneous multi-path set Min(P) and a positive integer counter i, where i=1;

[0075] 3-2, obtain the network path set P from the network topology G i , node set V i 、The node degree IS(V i ) and the total number of nodes N(V);

[0076] 3-3, determine whether the size of i and the total number of nodes N(V) satisfies i≤N(V); if yes, execute 3-4; otherwise, complete the selection of heterogeneous paths if not satisfied;

[0077] 3-4, select the first node V with the smallest degree i :IS(V i )≤IS(V′), where V′ represents the node V i Any node other than

[0078] 3-5, will be with V i The connected path P i Add to the heterogeneous multi-path set Min(P);

[0079] 3-6, remove path P in network topology G i Node V i , the counter performs i+1 action;

[0080] 3-7, return to step 3-3;

[0081] Furthermore, the specific method of step 4 is:

[0082] 4-1, in one of the source node-destination node pairs, the flow is allocated to a routing segment of one of the heterogeneous paths HP, denoted as in represents the traffic from the mth to the nth routing segment on the path from the source node s to the destination node d;

[0083] 4-2, generate a random number k, calculate Where k is a decimal between 0 and 1, and “·” is a multiplication operation;

[0084] 4-3, Calculation Recorded as Where “·” is a multiplication operation;

[0085] 4-4, distribute the traffic in path HP To the corresponding routing fragments of another set of heterogeneous paths HP′;

[0086] 4-5, according to the above traffic allocation method, allocate traffic to all path segments of the heterogeneous path HP′;

[0087] Furthermore, the specific method of step 5 is:

[0088] 5-1, switch S i+1 Use E k Decryption from switch S i Data packet Enc(E k ,Itm||Sig(A k ,Itm)) obtainItm||Sig(A k ,Itm);

[0089] 5-2, Separation of Itm||Sig(A k ,Itm) gets the temporary message Itm:Inport(S i )||FID i ||Enc(E k ,M) and Sig(A k ,Itm);

[0090] 5-3, the next switch S on the transmission path i+1 Verify the temporarily stored message Itm. If the verification result is consistent with Sig(A k ,Itm) matches, then continue to forward to the downstream switch;

[0091] Furthermore, step 5-3 specifically includes the following steps:

[0092] 5-3-1, switch S i+1 Generate ID number SID i+1 and input port numberInport(Si+1 ) and construct the identity identifier FID i+1 , FID i+1 Expressed as in Indicates XOR action;

[0093] 5-3-2, S i+1 The temporary message Itm is imported (S i ) is replaced by Inport(S i+1 ), FID i Replaced by FID i+1 , and generate a new temporary message Itm′, Itm′ is represented by Inpor(S i+1 )||FID i+1 ||Enc(E k ,M);

[0094] 5-3-3, S i+1 Use A k Sign the temporarily stored message Itm′, recorded as: Sig(A k ,Itm′);

[0095] 5-3-4, Itm′ and Sig(A k ,Itm′) are connected in series, recorded as Itm′||Sig(A k ,Itm′);

[0096] 5-3-5, using E k For Itm′||Sig(A k ,Itm′ is encrypted and forwarded to the downstream switch. k ,Itm′||Sig(A k ,Itm′));

[0097] 5-4, if the verification result of the temporarily stored message Itm is the same as ig(A k ,Itm) does not match, then stop routing and locate the damaged switch, select a new path to re-forward the data packet;

[0098] Furthermore, step 5-4 specifically includes the following steps:

[0099] 5-4-1, intercept the temporary message Itm to obtain Inport (S i ) and FID i And perform XOR operation to calculate SID i ,in

[0100] 5-4-2, based on the calculated switch ID: SIDi , locate the attacked switch;

[0101] 5-4-3, the source node reconstructs the encryption key E k 、Authentication Key A k The temporary message Itm is constructed to carry information Enc(E k ,Itm||Sig(A k ,Itm))’s routing forwarding data packets;

[0102] 5-4-4, select a path from the heterogeneous multi-path set Min(P) to transmit the data packet;

[0103] 5-4-5, allocate traffic to the selected path;

[0104] 5-4-6, the source node resends the data packet to the destination node along the newly selected path.

[0105] like Figure 2 As shown, the present invention adopts the above technical solution. When multiple groups of source-destination node pairs send data packets, it is necessary to first calculate the heterogeneous paths from the source node to the destination node, and select one of the paths to transmit the data packet. The purpose is to quickly select other unattacked paths in the heterogeneous path set Min(P) to continue transmitting data after the node transmitting on the path is attacked. Then, appropriate traffic is allocated to the paths of multiple groups of source-destination node pairs to ensure the balance of traffic on each path during the transmission process. Finally, the encapsulated data packet is transmitted on the established link. During the data packet transmission process, each upstream switch will forward the data packet to its downstream switch, and the downstream switch will perform verification operations on the received data packet. When the downstream switch receives the data packet Enc(E k ,Itm||Sig(A k ,Itm)) will use the encryption key E k Decrypt it to get Itm||Sig(A k ,itm). Then use the authentication key A k Sign the temporarily stored message itm and verify whether it is consistent with Sig(A k ,itm). If they match, it means that the upstream switch is not attacked, and the downstream switch re-encapsulates the data packet and sends it to its downstream switch. If they do not match, it means that the upstream switch is attacked, and the downstream switch uses the Inport (S i ) and FID i Calculate the SID of the attacked switch iTo locate the damaged switch, select another unattacked path from the source node to the destination node in the heterogeneous multi-path set Min(P) to re-forward the data packet.

[0106] The present invention proposes a multi-path routing scheme, which uses multi-path technology to forward data packets. The multi-path routing technology proposed in the present invention ensures that after a single node or link on a path fails, other generated multi-paths are used for message forwarding, and the present invention also allocates appropriate traffic to heterogeneous paths of multiple groups of source-destination node pairs respectively to ensure the stability of multiple groups of transmitted data. At present, the research on software-defined networks is in a period of vigorous development, and the inherent security of software-defined networks is crucial. In order to ensure the reliability and accuracy of information transmission, the present invention generates multiple heterogeneous paths from the source node to the destination node; since there are multiple groups of source-destination node pairs in the network, the present invention allocates traffic to the generated paths to ensure load balancing; in addition, the present invention also uses encryption and authentication mechanisms to provide confidentiality and integrity for transmitted data packets.

[0107] The effective effects of the present invention are: 1. When a node in the source path is damaged, other heterogeneous paths can be selected in the heterogeneous multi-path set Min (P) to re-forward the message to ensure the stability of message transmission; 2. Through the multi-path load balancing mechanism, the balanced distribution of traffic during data transmission is guaranteed; 3. Since the temporarily stored message itm is encrypted and signed before transmission, each routing node can verify the message after receiving the routing information sent by the upstream switch to ensure the integrity and reliability of the message.

[0108] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians of the art without making creative work are within the scope of protection of the present application.

Claims

1. A heterogeneous multi-path secure routing calculation method based on software-defined network load balancing, characterized by: It includes the following steps: Step 1: Use a secure channel to transmit the derived encryption key and authentication key to the switch, and construct the switch identity identifier using the switch ID and input port number; Step 2: Use the current switch S i Input port numberInport(S i ) and the identity identifier FID i , and the plaintext message M constructs the temporary storage message Itm, the specific content of the temporary storage message Itm is Inport(S i )||FID i ||Enc(E k , M); based on the encryption key E k 、Authentication Key A k The temporary message Itm is constructed to carry information Enc(E k ,Itm||Sig(A k , Itm))'s routing forwarding data packets; Where Enc() represents encryption action, Sig() represents signature action; Step 3, generating a plurality of heterogeneous path sets of source node-destination node pairs; Step 4, load balancing traffic for paths of multiple source-destination node pairs; Step 5: The next switch S on the transmission path i+1 Verify the data packet; if the verification is successful, forward it downstream; if the verification fails, stop routing, locate the damaged switch and reroute the data packet according to the new path.

2. The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to claim 1 is characterized in that: The specific method of step 1 is: 1-1, use a secure channel to transmit the derived encryption key E k and authentication key A k To the switch; 1-2, switch S i Generate your own SID i , and its own input port number Inport(S i ); 1-3, using SID i and Import(S i )Construct S i FID i The specific content of the identity identifier FIDi is in Indicates an exclusive OR action.

3. The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to claim 1 is characterized in that: The specific method of step 2 is: 2-1, using encryption key E k Encrypt the plaintext message M, denoted as Enc(E k , M), where Enc( ) represents the encryption action; 2-2, Import(S i )、FID i and Enc(E k , M) in series, recorded as temporary message Itm, Itm represents Inport (S i )||FID i ||Enc(E k , M); 2-3, using authentication key A k Sign the temporarily stored message Itm, recorded as Sig(A k , Itm), where Sig( ) represents the signature action; 2-4, connect Itm and Sig (A k , Itm), denoted as Itm||Sig(A k , Itm); 2-5, using encryption key E k For Itm and Sig(A k , Itm) encryption, construct routing forwarding data packet Enc(E k ,Itm||Sig(A k , Itm)).

4. The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to claim 1 is characterized in that: The specific method of step 3 is: 3-1, initialize the network topology G, an empty heterogeneous multi-path set Min(P) and a positive integer counter i, where i=1; 3-2, Get the network path set P from the network topology G i , node set V i , the node degree IS(V i ) and the total number of nodes N(V); 3-3, determine whether the size of i and the total number of nodes N(V) satisfies i≤N(V); if yes, execute 3-4; otherwise, complete the selection of heterogeneous paths if not satisfied; 3-4, select the first node V with the smallest degree i :IS(V i )≤IS(V′), where V′ represents the node V i Any node other than 3-5, will be with V i The connected path P i Add to the heterogeneous multi-path set Min(P); 3-6, remove path P in network topology G i Node V i , the counter performs i+1 action; 3-7, return to step 3-3.

5. The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to claim 1 is characterized in that: The specific method of step 4 is: 4-1, in one of the source node-destination node pairs, the flow is allocated to a routing segment of one of the heterogeneous paths HP, denoted as in represents the traffic from the mth to the nth routing segment on the path from the source node s to the destination node d; 4-2, generate a random number k, calculate Where k is a decimal between 0 and 1, and "·" is a multiplication operation; 4-3, Calculation Recorded as Where "·" is a multiplication operation; 4-4, distribute the traffic in path HP To the corresponding routing fragments of another set of heterogeneous paths HP′; 4-5. According to the above traffic allocation method, traffic is allocated to all path segments of the heterogeneous path HP′.

6. The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to claim 1 is characterized in that: The specific method of step 5 is: 5-1, switch S i+1 Use E k Decryption from switch S i Data packet Enc(E k ,Itm||Sig(A k ,Itm)) obtain Itm||Sig(A k , Itm); 5-2, Separation of Itm||Sig(A k , Itm) gets the temporary message Itm:Inport(S i )||FID i ||Enc(E k , M) and Sig(A k , Itm); 5-3, the next switch on the transmission path verifies the temporarily stored message Itm. If the verification result is consistent with Sig(A k , Itm) matches, then continue to forward to the downstream switch; 5-4, if the verification result of the temporarily stored message Itm is the same as ig(A k , Itm) does not match, then stop routing and locate the damaged switch, select a new path to re-forward the data packet.

7. The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to claim 6 is characterized in that: Step 5-3 specifically includes the following steps: 5-3-1, S i+1 Generate ID number SID i+1 and input port numberInport(S i+1 ) and construct the identity identifier FID i+1 , FID i+1 Expressed as in Indicates XOR action; 5-3-2, S i+1 The temporary message Itm is imported (S i ) is replaced by Inport(S i+1 ), FID i Replaced by FID i+1 , and generate a new temporary message Itm′, Itm′ is represented by Inport(S i+1 )||FID i+1 ||Enc(E k , M); 5-3-3, S i+1 Use A k Sign the temporarily stored message Itm′, recorded as: Sig(A k , Itm'); 5-3-4, Itm′ and Sig(A k , Itm′) are connected in series, recorded as Itm′||Sig(A k , Itm'); 5-3-5, using E k For Itm′||Sig(A k , Itm′ is encrypted and forwarded to the downstream switch. k ,Itm′||Sig(A k , Itm′)).

8. The heterogeneous multi-path secure routing calculation method based on software-defined network load balancing according to claim 6 is characterized in that: Step 5-4 specifically includes the following steps: 5-4-1, intercept the temporary message Itm to obtain Inport (S i ) and FID i And perform XOR operation to calculate SID i ,in 5-4-2, based on the calculated switch ID: SID i , locate the attacked switch; 5-4-3, the source node reconstructs the encryption key E k 、Authentication Key A k The temporary message Itm is constructed to carry information Enc(E k ,Itm||Sig(A k , Itm))'s routing forwarding data packets; 5-4-4, select a path from the heterogeneous multi-path set Min(P) to transmit the data packet; 5-4-5, allocate traffic to the selected path; 5-4-6, the source node resends the data packet to the destination node along the newly selected path.

Images