A Heterogeneous Multipath Secure Routing Calculation Method Based on Software-Defined Network Load Balancing

Abstract

This invention discloses a heterogeneous multipath secure routing calculation method based on software-defined network load balancing, comprising the following steps: 1) transmitting derived encryption and authentication keys to the switch using a secure channel, and constructing the switch's identity identifier using the switch's ID and input port number; 2) constructing a temporary message using the switch's input port number, identity identifier, and plaintext message; constructing a route forwarding data packet based on the encryption key, authentication key, and temporary message; 3) generating a set of heterogeneous paths for multiple source-destination node pairs; 4) performing traffic load balancing on the paths of the multiple source-destination node pairs; 5) the next switch on the transmission path verifies the data packet; if verification is successful, it forwards it downstream; if verification fails, routing stops, the damaged switch is located, and the data packet is re-routed according to the new path. This invention allocates traffic to the generated paths to ensure load balancing.

Description

Technical Field

[0001] This invention relates to the field of information stable transmission protection, and in particular to a heterogeneous multipath secure routing calculation method based on software-defined network load balancing. Background Technology

[0002] Software-defined networking (SDN) is an emerging network architecture that separates the control plane from the data plane, making network management and configuration more flexible and efficient. However, because the data plane involves sensitive information, routing and information protection during transmission become critical issues. Security is considered one of the most important concerns during information transmission. Currently, research on SDN is booming, and its inherent security is of paramount importance. Summary of the Invention

[0003] The purpose of this invention is to provide a method for calculating secure heterogeneous multipath routes based on software-defined network load balancing.

[0004] The technical solution adopted in this invention is:

[0005] A heterogeneous multipath secure routing calculation method based on software-defined network load balancing includes the following steps:

[0006] 1) Use a secure channel to transmit the derived encryption key and authentication key to the switch, and construct the switch's identity identifier using the switch's ID and input port number;

[0007] 2) Utilizing the current switch S i Input port number Inport(S i ) and identity identifier FID i And the plaintext message M constructs a temporary message Itm, the specific content of which is Inport(S i )||FID i ||Enc(E k ,M); based on encryption key E k Authentication key A k The temporary message Itm is constructed to carry information as Enc(E) k ,Itm||Sig(A k The routing and forwarding of data packets is performed using `Enc()`, where `Enc()` represents the encryption action and `Sig()` represents the signing action.

[0008] 3) Generate a heterogeneous path set of multiple source node-destination node pairs;

[0009] 4) Perform traffic load balancing for multiple source-destination node pairs along their paths;

[0010] 5) The next switch on the transmission path verifies the data packet. If the verification is successful, it forwards it downstream; if the verification fails, it stops routing, locates the damaged switch, and reroutes the data packet according to the new path.

[0011] The specific method for step 1 is as follows:

[0012] 1-1, Use a secure channel to transmit the derived encryption key E k and authentication key A k Give it to the switch;

[0013] 1-2, Switch S i Generate your own ID number (SID) i and its own input port number Inport(S i );

[0014] 1-3, using SID i and Inport(S i Construct S i FID (Firmware ID) i Identity Identifier (FID) i The specific content is as follows in Indicates the XOR operation;

[0015] The specific method for step 2 is as follows:

[0016] 2-1, Using encryption key E k Encrypting a plaintext message M, denoted as Enc(E k ,M), where Enc() represents the encryption action;

[0017] 2-2, Import(S) i ), FID i and Enc(E k The concatenation of ,M) is denoted as the temporary message Itm, and Itm can be represented as Inport(S i )||FID i ||Enc(E k ,M);

[0018] 2-3, using authentication key A k Sign the temporary message Itm, denoted as Sig(A) k ,Itm), where Sig() represents the signature action;

[0019] 2-4, Connect Itm and Sig(A) k ,Itm), denoted as Itm||Sig(A k ,Itm);

[0020] 2-5, using encryption key R k For Itm and Sig(A) k Encrypting (,Itm) and constructing a route to forward data packets Enc(E) k ,Itm||Sig(A k ,Itm));

[0021] The specific method for step 3 is as follows:

[0022] 3-1. Initialize the network topology G, an empty heterogeneous multipath set Min(P) and a positive integer counter i, where i = 1;

[0023] 3-2, Obtain the path set P of the network from the network topology G. i Node set V i The degree of the node IS(V) i The total number of nodes N(V);

[0024] 3-3, Determine if the size of i and the total number of nodes N(V) satisfies i≤N(V); if yes, proceed to 3-4; otherwise, complete the selection of heterogeneous paths if the condition is not met.

[0025] 3-4, Select the first node V with the smallest degree. i :IS(V i )≤IS(V′), where VT represents the value excluding node Vi. i Any node other than;

[0026] 3-5, will be with Vi i Connected path P i Add it to the heterogeneous multipath set Min(P);

[0027] 3-6, Remove path P in network topology G i Node V i The counter executes the i+1 action;

[0028] 3-7, Return to step 3-3;

[0029] The specific method for step 4 is as follows:

[0030] 4-1, in one set of source-destination node pairs, allocate traffic to a route segment of a heterogeneous path HP, denoted as . in This represents the traffic of the m-th to n-th routing segments on the path from source node s to destination node d;

[0031] 4-2, Generate a random number k, calculate Where k is a decimal between 0 and 1, and "·" represents scalar multiplication;

[0032] 4-3, Calculation Recorded as Where “·” represents scalar multiplication;

[0033] 4-4, Distribute the traffic in path HP On the corresponding routing segment of another set of heterogeneous paths HP′;

[0034] 4-5. Based on the above traffic allocation method, allocate traffic to all path segments of the heterogeneous path HP′;

[0035] The specific method for step 5 is as follows:

[0036] 5-1, Switch S i+1 Use E k Decryption from switch S i data packet Enc(E k ,Itm||Sig(A k ,Itm)) obtain Itm||Sig(A k ,Itm);

[0037] 5-2, Separate Itm||Sig(A) k Itm) retrieves the temporary message Itm:Inport(S i )||FID i ||Enc(E k ,M) and Sig(A k ,Itm);

[0038] 5-3, the next switch on the transmission path verifies the temporary message Itm. If the verification result matches Sig(A)... k If the match is found (,Itm), then the message is forwarded to the downstream switch.

[0039] 5-3-1, S i+1 Generate ID number SID i+1 and input port number Inport(S i+1 And construct the identity identifier FID i+1 FID i+1 Represented as in Indicates the XOR operation;

[0040] 5-3-2, S i+1 Inport(S) of the temporarily stored message Itm i Replace ) with Inport(S i+1 ), will FID i Replace with FID i+1And generate a new temporary message Itm′, which is represented as Inpor(S i+1 )||FID i+1 ||Enc(E k ,M);

[0041] 5-3-3, S i+1 Use A k Sign the temporary message Itm′ as: Sig(A k ,Itm′);

[0042] 5-3-4, combine Itm′ and Sig(A) k The cascaded sequence of Itm′ is denoted as Itm′||Sig(A k ,Itm′);

[0043] 5-3-5, using E k For Itm′||Sig(A) k Itm' is encrypted and the new data packet Enc(E) is forwarded to the downstream switch. k ,Itm′||Sig(A k ,Itm′));

[0044] 5-4, if the verification result of the temporary message Itm is consistent with ig(A) k If (,Itm) does not match, then stop routing, locate the damaged switch, and select a new path to re-forward the data packet;

[0045] 5-4-1, Intercepting the temporarily stored message Itm to obtain Inport(S i ) and FID i And perform an XOR operation to calculate the SID. i ,in

[0046] 5-4-2, based on the calculated switch ID: SID i The attacked switch was located.

[0047] 5-4-3, The source node is rebuilt based on the encryption key E k Authentication key A k The temporary message Itm is constructed to carry information as Enc(E) k ,Itm||Sig(A k The routing forwards data packets of Itm);

[0048] 5-4-4, Select a path from the heterogeneous multipath set Min(P) to transmit data packets;

[0049] 5-4-5, allocate traffic to the selected path;

[0050] 5-4-6, the source node resends the data packet to the destination node according to the newly selected path.

[0051] This invention employs the above technical solution. When multiple source-destination node pairs send data packets, it is necessary to first calculate the heterogeneous paths from the source node to the destination node. One of these paths is selected for data packet transmission. This is to ensure that if a node transmitting on that path is attacked, other unattacked paths can be quickly selected from the heterogeneous path set Min(P) to continue data transmission. Then, appropriate traffic is allocated to the paths of multiple source-destination node pairs to ensure balanced traffic across all paths during transmission. Finally, the encapsulated data packets are transmitted on the established link. During data packet transmission, each upstream switch forwards data packets to its downstream switches, and the downstream switches verify the received data packets. When a downstream switch receives a data packet Enc(E) from an upstream switch... k ,Itm||Sig(A k After `,Itm))`, the encryption key `E` will be used. k Decrypt it to obtain Itm||Sig(A) k (,Itm). Then use authentication key A. k Sign the temporary message Itm and verify whether it matches Sig(A) k If the upstream switch matches (Itm), the downstream switch re-encapsulates the data packet and sends it to its downstream switch. If they don't match, the upstream switch is under attack, and the downstream switch uses the Inport(S) from the temporary message Itm. i ) and FID i Calculate the SID of the attacked switch i The damaged switch is located. Then, an unattacked path from the source node to the destination node is selected from the heterogeneous multipath set Min(P) to re-forward the data packet. The effective effects of this invention are: 1. When a node in the source path is damaged, other heterogeneous paths can be selected from the heterogeneous multipath set Min(P) to re-forward the message, ensuring the stability of message transmission; 2. Through the multipath load balancing mechanism, the balanced distribution of traffic during data transmission is ensured; 3. Since the temporary message Itm is encrypted and signed before transmission, each routing node can verify the message after receiving the routing information from the upstream switch, ensuring the integrity and reliability of the message. Attached Figure Description

[0052] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments;

[0053] Figure 1This is a flowchart illustrating a heterogeneous multipath secure routing calculation method based on software-defined network load balancing according to the present invention.

[0054] Figure 2 This is a schematic diagram of the protection route for a heterogeneous multipath security route calculation method based on software-defined network load balancing according to the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0056] like Figure 1 As shown in Figure 2, this invention discloses a heterogeneous multipath secure routing calculation method based on software-defined network load balancing. To achieve this goal, when multiple source-destination node pairs send data packets, it is necessary to first calculate the heterogeneous multipaths of these pairs. One of these paths is selected for data packet transmission. This is so that if a node transmitting on that path is attacked, it can choose another unattacked path from the heterogeneous path set Min(P) to continue transmitting data. Then, appropriate traffic is allocated to the paths of the multiple source-destination node pairs according to the traffic load to ensure balanced traffic across all paths during transmission. Finally, the encapsulated data packets are transmitted on the established links.

[0057] like Figure 1 As shown in Figure 2, this invention discloses a heterogeneous multipath secure routing calculation method based on software-defined network load balancing, which includes the following steps:

[0058] 1) Use a secure channel to transmit the derived encryption key and authentication key to the switch, and construct the switch's identity identifier using the switch's ID and input port number;

[0059] 2) Utilizing the current switch S i Input port number Inport(S i ) and identity identifier FID i And the plaintext message M constructs a temporary message Itm, the specific content of which is Inport(S i )||FID i ||Enc(E k ,M); based on encryption key E k Authentication key A k The temporary message Itm is constructed to carry information as Enc(E) k ,Itm||Sig(A k The routing and forwarding of data packets is performed using `Enc()`, where `Enc()` represents the encryption action and `Sig()` represents the signing action.

[0060] 3) Generate a heterogeneous path set of multiple source node-destination node pairs;

[0061] 4) Perform traffic load balancing for multiple source-destination node pairs along their paths;

[0062] 5) The next switch on the transmission path verifies the data packet. If the verification is successful, it forwards it downstream; if the verification fails, it stops routing, locates the damaged switch, and reroutes the data packet according to the new path.

[0063] Furthermore, the specific method for step 1 is as follows:

[0064] 1-1, Use a secure channel to transmit the derived encryption key E k and authentication key A k Give it to the switch;

[0065] 1-2, Switch S i Generate your own ID number (SID) i and its own input port number Inport(S i );

[0066] 1-3, using SID i and Inport(S i Construct S i FID (Firmware ID) i Identity Identifier (FID) i The specific content is SID i Inport(S i ),in Indicates the XOR operation;

[0067] Furthermore, the specific method for step 2 is as follows:

[0068] 2-1, Using encryption key E k Encrypting a plaintext message M, denoted as Enc(E k ,M), where Enc() represents the encryption action;

[0069] 2-2, Import(S) i ), FID i and Enc(E k The concatenation of ,M) is denoted as the temporary message Itm, and Itm can be represented as Inport(S i )||FID i ||Enc(E k ,M);

[0070] 2-3, using authentication key A kSign the temporary message Itm, denoted as Sig(A) k ,Itm), where Sig() represents the signature action;

[0071] 2-4, Connect Itm and Sig(A) k ,Itm), denoted as Itm||Sig(A k ,Itm);

[0072] 2-5, using encryption key E k For Itm and Sig(A) k Encrypting (,Itm) and constructing a route to forward data packets Enc(E) k ,Itm||Sig(A k ,Itm));

[0073] Furthermore, the specific method for step 3 is as follows:

[0074] 3-1. Initialize the network topology G, an empty heterogeneous multipath set Min(P) and a positive integer counter i, where i = 1;

[0075] 3-2, Obtain the path set P of the network from the network topology G. i Node set V i The degree of the node IS(V) i The total number of nodes N(V);

[0076] 3-3, Determine if the size of i and the total number of nodes N(V) satisfies i≤N(V); if yes, proceed to 3-4; otherwise, complete the selection of heterogeneous paths if the condition is not met.

[0077] 3-4, Select the first node V with the smallest degree. i :IS(V i )≤IS(V′), where V′ represents the value except for node V. i Any node other than;

[0078] 3-5, will be with V i Connected path P i Add it to the heterogeneous multipath set Min(P);

[0079] 3-6, Remove path P in network topology G i Node V i The counter executes the i+1 action;

[0080] 3-7, Return to step 3-3;

[0081] Furthermore, the specific method for step 4 is as follows:

[0082] 4-1, in one set of source-destination node pairs, allocate traffic to a route segment of a heterogeneous path HP, denoted as . in This represents the traffic of the m-th to n-th routing segments on the path from source node s to destination node d;

[0083] 4-2, Generate a random number k, calculate Where k is a decimal between 0 and 1, and "·" represents scalar multiplication;

[0084] 4-3, Calculation Recorded as Where “·” represents scalar multiplication;

[0085] 4-4, Distribute the traffic in path HP On the corresponding routing segment of another set of heterogeneous paths HP′;

[0086] 4-5. Based on the above traffic allocation method, allocate traffic to all path segments of the heterogeneous path HP′;

[0087] Furthermore, the specific method for step 5 is as follows:

[0088] 5-1, Switch S i+1 Use E k Decryption from switch S i data packet Enc(E k ,Itm||Sig(A k ,Itm)) obtain Itm||Sig(A k ,Itm);

[0089] 5-2, Separate Itm||Sig(A) k Itm) retrieves the temporary message Itm:Inport(S i )||FID i ||Enc(E k ,M) and Sig(A k ,Itm);

[0090] 5-3, the next switch S on the transmission path i+1 Verify the temporary message Itm. If the verification result matches Sig(A) k If the match is found (,Itm), then the message is forwarded to the downstream switch.

[0091] Furthermore, step 5-3 specifically includes the following steps:

[0092] 5-3-1, Switch S i+1 Generate ID number SID i+1 and input port number Inport(Si+1 And construct the identity identifier FID i+1 FID i+1 Represented as in Indicates the XOR operation;

[0093] 5-3-2, S i+1 Inport(S) of the temporarily stored message Itm i Replace ) with Inport(S i+1 ), will FID i Replace with FID i+1 And generate a new temporary message Itm′, which is represented as Inpor(S i+1 )||FID i+1 ||Enc(E k ,M);

[0094] 5-3-3, S i+1 Use A k Sign the temporary message Itm′ as: Sig(A k ,Itm′);

[0095] 5-3-4, combine Itm′ and Sig(A) k The cascaded sequence of Itm′ is denoted as Itm′||Sig(A k ,Itm′);

[0096] 5-3-5, using E k For Itm′||Sig(A) k Itm' is encrypted and the new data packet Enc(E) is forwarded to the downstream switch. k ,Itm′||Sig(A k ,Itm′));

[0097] 5-4, if the verification result of the temporary message Itm is consistent with ig(A) k If (,Itm) does not match, then stop routing, locate the damaged switch, and select a new path to re-forward the data packet;

[0098] Furthermore, step 5-4 specifically includes the following steps:

[0099] 5-4-1, Intercepting the temporarily stored message Itm to obtain Inport(S i ) and FID i And perform an XOR operation to calculate the SID. i ,in

[0100] 5-4-2, based on the calculated switch ID: SIDi The attacked switch was located.

[0101] 5-4-3, The source node is rebuilt based on the encryption key E k Authentication key A k The temporary message Itm is constructed to carry information as Enc(E) k ,Itm||Sig(A k The routing forwards data packets of Itm);

[0102] 5-4-4, Select a path from the heterogeneous multipath set Min(P) to transmit data packets;

[0103] 5-4-5, allocate traffic to the selected path;

[0104] 5-4-6, the source node resends the data packet to the destination node according to the newly selected path.

[0105] like Figure 2 As shown, this invention employs the above technical solution. When multiple source-destination node pairs send data packets, it is necessary to first calculate the heterogeneous paths from the source node to the destination node. One of these paths is selected for data packet transmission. This is so that if a node transmitting on that path is attacked, other unattacked paths can be quickly selected from the heterogeneous path set Min(P) to continue data transmission. Then, appropriate traffic is allocated to the paths of multiple source-destination node pairs to ensure balanced traffic across all paths during transmission. Finally, the encapsulated data packets are transmitted on the established link. During data packet transmission, each upstream switch forwards data packets to its downstream switches, and the downstream switches verify the received data packets. When a downstream switch receives a data packet Enc(E) from an upstream switch... k ,Itm||Sig(A k After `,Itm))`, the encryption key `E` will be used. k Decrypt it to obtain Itm||Sig(A) k (,itm). Then use authentication key A k Sign the temporary message itm and verify whether it matches Sig(A) k The upstream switch and downstream switch re-encapsulate the data packet and send it to their downstream switches. If they match, the upstream switch is not under attack, and the downstream switch re-encapsulates the data packet and sends it to its downstream switch. If they do not match, the upstream switch is under attack, and the downstream switch uses the Inport(S) function in the temporary message itm. i ) and FID i Calculate the SID of the attacked switch iTo locate the damaged switch, select an unattacked path from the source node to the destination node in the heterogeneous multipath set Min(P) and re-forward the data packets.

[0106] This invention proposes a multi-path routing scheme that uses multi-path technology for packet forwarding. The proposed multi-path routing technology ensures that in the event of a single node or link failure on a path, other generated multi-paths are used for packet forwarding. Furthermore, this invention allocates appropriate traffic to heterogeneous paths of multiple source-destination node pairs to ensure the stability of multiple sets of transmitted data. Currently, research on software-defined networks is booming, and the inherent security of software-defined networks is crucial. To ensure the reliability and accuracy of information transmission, this invention generates multiple heterogeneous paths from the source node to the destination node; since there are multiple source-destination node pairs in the network, this invention allocates traffic to the generated paths to ensure load balancing; in addition, this invention utilizes encryption and authentication mechanisms to provide confidentiality and integrity for transmitted data packets.

[0107] The effective effects of this invention are as follows: 1. When a node in the source path is damaged, other heterogeneous paths can be selected from the heterogeneous multipath set Min(P) to re-forward the message, ensuring the stability of message transmission; 2. Through the multipath load balancing mechanism, the balanced distribution of traffic during data transmission is ensured; 3. Since the temporary message itm is encrypted and signed before transmission, each routing node can verify the message after receiving the routing information sent by the upstream switch, ensuring the integrity and reliability of the message.

[0108] Obviously, the described embodiments are only a part of the embodiments of this application, not all of them. Without conflict, the embodiments and features in the embodiments of this application can be combined with each other. The components of the embodiments of this application described and illustrated herein can generally be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of this application is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

Claims

1. A heterogeneous multipath secure routing calculation method based on software-defined network load balancing, characterized in that: It includes the following steps: Step 1: Use the secure channel to transmit the derived encryption key and authentication key to the switch, and construct the switch's identity identifier using the switch's ID and input port number. Step 2, using the current switch S i Input port number Inport(S i ) and identity identifier FID i And the plaintext message M constructs a temporary message Itm, the specific content of which is Inport(S i )||FID i ||Enc(E k ,M); based on encryption key E k Authentication key A k The temporary message Itm is constructed to carry information as Enc(E) k ,Itm||Sig(A k The routing forwards data packets of ,Itm); where Enc() represents the encryption action and Sig() represents the signing action; Step 3: Generate a heterogeneous path set of multiple source node-destination node pairs; the specific method for step 3 is as follows: 3-1. Initialize the network topology G, an empty heterogeneous multipath set Min(P) and a positive integer counter i, where i = 1; 3-2, Obtain the path set P of the network from the network topology G. i Node set V i The degree of the node IS(V) i The total number of nodes N(V); 3-3, Determine if the size of i and the total number of nodes N(V) satisfies i≤N(V); if yes, proceed to 3-4; otherwise, complete the selection of heterogeneous paths if the condition is not met. 3-4, Select the first node V with the smallest degree. i :IS(V i )≤IS(V′), where V′ represents the value except for node V. i Any node other than; 3-5, will be with V i Connected path P i Add it to the heterogeneous multipath set Min(P); 3-6, Remove path P in network topology G i Node V i The counter executes the i+1 action; 3-7, Return to step 3-3; Step 4 involves performing traffic load balancing on the paths of multiple source-destination node pairs; the specific method for step 4 is as follows: 4-1, in one set of source-destination node pairs, allocate traffic to a route segment of a heterogeneous path HP, denoted as . in This represents the traffic of the m-th to n-th routing segments on the path from source node s to destination node d; 4-2, Generate a random number k, calculate And recorded as Where k is a decimal between 0 and 1, and "·" represents scalar multiplication; 4-3, Distribute the traffic in path HP On the corresponding routing segment of another set of heterogeneous paths HP′; 4-4. Based on the above traffic allocation method, allocate traffic to all path segments of the heterogeneous path HP′; Step 5, the next switch S on the transmission path i+1 The data packet is verified; if the verification is successful, it is forwarded downstream; if the verification fails, routing is stopped, the damaged switch is located, and the data packet is rerouted according to the new path.

2. The heterogeneous multipath secure routing calculation method based on software-defined network load balancing according to claim 1, characterized in that: The specific method for step 1 is as follows: 1-1, Use a secure channel to transmit the derived encryption key E k and authentication key A k Give it to the switch; 1-2, Switch S i Generate your own ID number (SID) i and its own input port number Inport(S i ); 1-3, using SID i and Inport(S i Construct S i FID (Firmware ID) i Identity Identifier (FID) i The specific content is as follows in It indicates the XOR operation.

3. The heterogeneous multipath secure routing calculation method based on software-defined network load balancing according to claim 1, characterized in that: The specific method for step 2 is as follows: 2-1, Using encryption key E k Encrypting plaintext message M, denoted as enc(E) k ,M), where Enc() represents the encryption action; 2-2, Import(S) i ), FID i and Enc(E k The concatenation of ,M) is denoted as the temporary message Itm, and Itm is represented as Inport(S i )||FID i ||Enc(E k ,M); 2-3, using authentication key A k Sign the temporary message Itm, denoted as Sig(A) k ,Itm), where Sig() represents the signature action; 2-4, Connect Itm and Sig(A) k ,Itm), denoted as Itm||Sig(A k ,Itm); 2-5, using encryption key E k For Itm and Sig(A) k Encrypting (,Itm) and constructing a route to forward data packets Enc(E) k ,Itm||Sig(A k ,Itm)).

4. The heterogeneous multipath secure routing calculation method based on software-defined network load balancing according to claim 1, characterized in that: The specific method for step 5 is as follows: 5-1, Switch S i+1 Use E k Decryption from switch S i data packet Enc(E k ,Itm||Sig(A k ,Itm)) obtain Itm||Sig(A k ,Itm); 5-2, Separate Itm||Sig(A) k Itm) retrieves the temporary message Itm:Inport(S i )||FID i ||Enc(E k ,M) and Sig(A k ,Itm); 5-3, the next switch on the transmission path verifies the temporary message Itm. If the verification result matches Sig(A)... k If the match is found (,Itm), then the message is forwarded to the downstream switch. 5-4, if the verification result of the temporary message Itm is consistent with ig(A) k If (Itm) does not match, then stop routing, locate the damaged switch, and select a new path to re-forward the data packet.

5. The heterogeneous multipath secure routing calculation method based on software-defined network load balancing according to claim 4, characterized in that: Step 5-3 specifically includes the following steps: 5-3-1, S i+1 Generate ID number SID i+1 and input port number Inport(S i+1 And construct the identity identifier FID i+1 FID i+1 Represented as in Indicates the XOR operation; 5-3-2, S i+1 Inport(S) of the temporarily stored message Itm i Replace ) with Inport(S i+1 ), will FID i Replace with FID i+1 And generate a new temporary message Itm′, which is represented as Inport(S i+1 )||FID i+1 ||Enc(E k ,M); 5-3-3, S i+1 Use A k Sign the temporary message Itm′ as: Sig(A k ,Itm′); 5-3-4, combine Itm′ and Sig(A) k The cascaded sequence of Itm′ is denoted as Itm′||Sig(A k ,Itm′); 5-3-5, using E k For Itm′||Sig(A) k Itm' is encrypted and the new data packet Enc(E) is forwarded to the downstream switch. k ,Itm′||Sig(A k ,Itm′)).

6. The heterogeneous multipath secure routing calculation method based on software-defined network load balancing according to claim 4, characterized in that: Step 5-4 specifically includes the following steps: 5-4-1, Intercepting the temporarily stored message Itm to obtain Inport(S i ) and FID i And perform an XOR operation to calculate the SID. i ,in 5-4-2, based on the calculated switch ID: SID i The attacked switch was located. 5-4-3, The source node is rebuilt based on the encryption key E k Authentication key A k The temporary message Itm is constructed to carry information as Enc(E) k ,Itm||Sig(A k The routing forwards data packets of Itm); 5-4-4, Select a path from the heterogeneous multipath set Min(P) to transmit data packets; 5-4-5, allocate traffic to the selected path; 5-4-6, the source node resends the data packet to the destination node according to the newly selected path.

Images