Session key management method and device for VPN communication, medium and program product

Abstract

The embodiment of the invention provides a session key management method and device for VPN communication, a medium and a program product, and relates to the technical field of encrypted communication. The method comprises the following steps: determining that a current message to be transmitted meets a preset session key updating condition, updating a quantum key index, and obtaining a quantum key from a first key cache pool; the updated quantum key index is added to the corresponding ESP information, and the quantum key is used as an updated session key to encrypt and transmit the to-be-transmitted message to a second network end, so that the second network end obtains the quantum key from a second key cache pool based on the updated quantum key index and decrypts the to-be-transmitted message; according to the embodiment of the invention, the key cache pools are arranged at the two ends of the VPN communication respectively, and the session key of the VPN communication is updated in time according to the update rule negotiated by the two parties, so that the session key can be quickly converted without tunnel re-negotiation, and the security of the VPN communication is effectively improved.

Description

Technical Field

[0001] The present application relates to the technical field of encrypted communication, and in particular to a session key management method, device, medium and program product for VPN communication. Background Art

[0002] IPSec VPN is a VPN (Virtual Private Network) technology that uses the IPSec (Internet Protocol Security) protocol to achieve remote access. It is used to provide a secure communication channel between two private networks on the public Internet.

[0003] Before using IPSec VPN for data communication, it is necessary to first negotiate the VPN tunnel. After going through negotiation logic such as key exchange, identity authentication, and encryption algorithm negotiation, the session key required for VPN tunnel data transmission is generated.

[0004] Currently, changes to session keys require renegotiation of VPN tunnels, and the renegotiation cycle of session keys is usually long. Therefore, if the data channel establishment process is attacked by hackers, the session key may be cracked, resulting in a security risk of private data being stolen.

[0005] In summary, there is an urgent need for a session key management solution that can improve the security of VPN communications. Summary of the invention

[0006] The purpose of the embodiments of the present application is to provide a method, device, medium and program product for managing session keys of VPN communications, so as to improve the security of VPN communications.

[0007] In a first aspect, an embodiment of the present application provides a session key management method for VPN communication, which is applied to a first network end, including:

[0008] Determining that the current message to be transmitted meets a preset session key update condition, updating a quantum key index, and obtaining a quantum key from a preset first key cache pool based on the quantum key index;

[0009] Adding the updated quantum key index to the ESP information corresponding to the message to be transmitted, and using the quantum key as the updated session key to encrypt and transmit the message to be transmitted to the second network end, so that the second network end obtains the quantum key from the second key cache pool based on the updated quantum key index and completes decryption of the message to be transmitted;

[0010] The session key update condition, the first key cache pool, and the second key cache pool are determined by the first network end and the second network end through tunnel negotiation.

[0011] In an embodiment of the present application, by setting up key cache pools at both ends of VPN communication, and timely updating the session keys of VPN communication according to the update rules agreed upon by both parties, the session keys can be quickly changed without the need for tunnel re-negotiation, thereby effectively improving the security of VPN communication.

[0012] In some possible embodiments, determining whether the current message to be transmitted meets a preset session key update condition includes:

[0013] Obtaining the current time corresponding to the message to be transmitted and the historical update time corresponding to the last update of the session key;

[0014] When it is determined that the time difference between the current moment and the historical update moment is greater than a preset update period, it is determined that the current message to be transmitted meets a preset session key update condition.

[0015] In an embodiment of the present application, whether the key update condition is met is determined based on whether the accumulated time for which the key has not been updated exceeds the update period, so that the session key can be regularly updated according to the time period, further improving the reliability of the key update.

[0016] In some possible embodiments, determining whether the current message to be transmitted meets a preset session key update condition includes:

[0017] Obtaining the current time corresponding to the message to be transmitted and the historical update time corresponding to the last update of the session key, and obtaining the message transmission volume between the current time and the historical update time;

[0018] When the message transmission amount is greater than a preset transmission amount threshold, it is determined that the current message to be transmitted meets a preset session key update condition.

[0019] In an embodiment of the present application, whether the key update condition is met is determined based on whether the cumulative message transmission volume of the unupdated key exceeds the transmission volume threshold, so that the session key can be updated in time according to the amount of data that can be transmitted, thereby further improving the flexibility of the key update.

[0020] In some possible embodiments, the second network end is further configured to: after obtaining the quantum key from the second key cache pool based on the updated quantum key index, update the local quantum key index recorded by the local security alliance based on the updated quantum key index.

[0021] In an embodiment of the present application, the second network terminal promptly and synchronously updates the local quantum key index after decrypting the current message, thereby avoiding the reuse of the quantum key and further improving the security of VPN communication.

[0022] In some possible embodiments, before determining whether the current message to be transmitted meets a preset session key update condition, the method further includes:

[0023] Initiating a tunnel negotiation request to the second network end based on preset quantum key configuration information, and receiving a negotiation response instruction fed back by the second network end in response to the tunnel negotiation request; wherein the quantum key configuration information includes a quantum key enabling flag and a first key cache pool UID adopted by the first network end, and the negotiation response instruction includes a second key cache pool UID adopted by the second network end;

[0024] Information configuration is performed on the security association of the current tunnel communication based on the first key cache pool UID and the second key cache pool UID.

[0025] In an embodiment of the present application, tunnel negotiation is performed between the communicating parties based on quantum key configuration information to determine the quantum key enabling method and caching strategy, thereby further improving the flexibility of key updating.

[0026] In some possible embodiments, before determining whether the current message to be transmitted meets a preset session key update condition, the method further includes:

[0027] In response to a quantum key initialization request, a quantum key is obtained based on preset quantum key configuration information and stored in a first key cache pool; wherein the quantum key configuration information includes the first key cache pool UID, the quantum key server IP address, the quantum key server port, the local device IP, the peer device ID, the authentication password and the peer device IP address;

[0028] Based on the quantum key configuration information, a target network end corresponding to the first network end is determined, and quantum key initialization synchronization processing is performed on the target network end.

[0029] In an embodiment of the present application, the flexibility of key updating is further improved by initializing and synchronizing the quantum key caches of the local and target network ends based on the quantum key configuration information.

[0030] In some possible embodiments, the VPN communication session key management method further includes:

[0031] It is determined that the first key cache pool meets a preset key synchronization condition, and the quantum keys of the first key cache pool and the second key cache pool are synchronously updated based on a pre-configured key synchronization module.

[0032] In the embodiment of the present application, by configuring the key synchronization module and synchronously updating the key cache pools at both ends of the communication in a timely manner according to needs, the consistency of the keys at both ends is ensured, thereby further improving the reliability of VPN communication.

[0033] In a second aspect, an embodiment of the present application provides a session key management device for VPN communication, which is applied to a first network end and includes:

[0034] A key acquisition module, used to determine whether the current message to be transmitted meets a preset session key update condition, update the quantum key index, and obtain the quantum key from a preset first key cache pool based on the quantum key index;

[0035] An encryption transmission module, used to add the updated quantum key index to the ESP information corresponding to the message to be transmitted, and use the quantum key as the updated session key to encrypt and transmit the message to be transmitted to the second network end, so that the second network end obtains the quantum key from the second key cache pool based on the updated quantum key index and completes decryption of the message to be transmitted;

[0036] The session key update condition, the first key cache pool, and the second key cache pool are determined by the first network end and the second network end through tunnel negotiation.

[0037] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement the method described in any embodiment of the first aspect when executing the program.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented.

[0039] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a computer program, wherein when the computer program is executed by a processor, the method described in any embodiment of the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A flow chart of a method for managing session keys for VPN communications provided in an embodiment of the present application;

[0042] Figure 2 A schematic diagram of the format of the ESP header for data communication provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of the structure of a session key management device for VPN communication provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0046] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0047] It should be noted that in the existing schemes that combine quantum keys with VPN communications, through negotiation processes such as key exchange, identity authentication, and encryption algorithm negotiation, a session key for data encryption transmission in the VPN channel can be generated. However, in the case where the session key needs to be changed, it is necessary to rely on the renegotiation of the tunnel, and the renegotiation process requires the suspension of data transmission, which slows down the overall data transmission efficiency. Therefore, in order to take into account the transmission efficiency, a longer session key renegotiation cycle is usually set, which undoubtedly increases the risk of key leakage caused by hackers cracking the transmission channel, so the security of the VPN tunnel is not high.

[0048] In view of the problems existing in the above-mentioned prior art, an embodiment of the present application provides a session key management method for VPN communication, which can quickly change the session key without the need for tunnel re-negotiation, thereby effectively improving the security of VPN communication.

[0049] like Figure 1 As shown, the embodiment of the present application provides a session key management method for VPN communication, which is applied to a first network end and may include the steps of:

[0050] S1. Determine whether the current message to be transmitted meets a preset session key update condition, update the quantum key index, and obtain the quantum key from a preset first key cache pool based on the quantum key index.

[0051] It should be noted that, during the data transmission process, before each message transmission, it is first determined whether the session key needs to be updated.

[0052] For example, the corresponding time information can be recorded each time the session key is updated. When the accumulated time information exceeds the set period, it is determined that the message to be transmitted currently meets the preset session key update condition. The specific determination rules and judgment parameters can be set according to actual needs.

[0053] When it is determined that the current message to be transmitted meets the preset session key update conditions, the local (first network terminal) quantum key index is first updated, and the quantum key index is used to point to the quantum key currently required to be obtained in the first key cache pool. It can be understood that at the initial moment of using the current tunnel for data transmission, the quantum key index is 0, that is, the quantum key is obtained from the starting point, and the algorithm type for obtaining the quantum key can be set according to demand, where different algorithm types contain information such as the length of each quantum key obtained. When the session key needs to be updated, the quantum key index is first updated to point to the index of the next quantum key. For example, the rule of the current algorithm type indicates that the length of each quantum key obtained is 16 bits, then the quantum key index at the starting moment is zero, and the quantum key index updated when the session key is updated for the first time is 16.

[0054] S2, adding the updated quantum key index to the ESP information corresponding to the message to be transmitted, and using the quantum key as the updated session key to encrypt and transmit the message to be transmitted to the second network end, so that the second network end obtains the quantum key from the second key cache pool based on the updated quantum key index and completes decryption of the message to be transmitted;

[0055] The session key update condition, the first key cache pool and the second key cache pool are determined by the first network end and the second network end through tunnel negotiation.

[0056] Specifically, after the quantum key index is updated, the updated quantum key index needs to be added (rewritten) to the ESP information of the current data transmission. It can be understood that ESP (Encapsulating Security Payload) is part of the IPsec protocol, which is used to ensure the confidentiality and integrity of data packets at the network layer, as well as the authentication of the data source and limited anti-replay protection.

[0057] At the same time, the session key in the Security Association (SA) is replaced according to the latest quantum key, and then the quantum key is used as the session key to encrypt the current message to be transmitted.

[0058] After the second network end receives the message to be transmitted, it can obtain the corresponding SA information and quantum key index from the ESP information header, and then determine the second key cache pool corresponding to the first key cache pool in the local second network end according to the quantum key cache pool UID (unique identifier) ​​carried in the SA information, and then obtain the corresponding quantum key from the second key cache pool according to the quantum key index to decrypt the message to be transmitted. See Figure 2 The format of the ESP header of the encrypted data packet can be as follows Figure 2 As shown, the security parameter index (SPI) is used to identify the corresponding security association information.

[0059] It should be noted that the first network end and the second network end are two network ends that currently need to perform tunnel communication; illustratively, the first network end is the client, and the corresponding second network end is the server; or, the first network end is the server, and the corresponding second network end is the client.

[0060] It is understandable that the first network end and the second network end need to perform tunnel negotiation before data communication. After the negotiation, the corresponding session key update conditions, the UID of the first key cache pool and the second key cache pool and other negotiation information can be saved in the security association (SA) used for data communication.

[0061] It should be noted that the first key cache pool and the second key cache pool are cache modules pre-configured by the first network end and the second network end respectively, which store a specific number of quantum keys respectively, and the key synchronization process can ensure that the quantum keys stored in the first key cache pool are consistent with those stored in the second key cache pool.

[0062] It should be noted that the embodiment of the present application sets up a key cache pool at both ends of the VPN communication, and timely updates the session key of the VPN communication according to the update rules agreed upon by the communicating parties, so that the change of the session key can be completed without performing a tunnel re-negotiation process; since the session key change process only involves simple key acquisition and replacement steps, even if the session key change cycle is set to change once for each message transmitted, it has almost no effect on the overall data transmission efficiency, thereby effectively improving the security of VPN communication while ensuring data transmission efficiency.

[0063] In some possible embodiments, in step S1, determining whether the current message to be transmitted meets a preset session key update condition may include:

[0064] S101, obtaining the current time corresponding to the message to be transmitted and the historical update time corresponding to the last update of the session key;

[0065] S102: When it is determined that the time difference between the current time and the historical update time is greater than a preset update period, determine whether the current message to be transmitted meets a preset session key update condition.

[0066] It should be noted that the session key update condition can be set to update the session key when it is determined that the same session key has been used for more than a set period of time. Specifically, first, each time a message is to be transmitted, the current time corresponding to the message to be transmitted is obtained (for example, the time may be the time when the message to be transmitted is obtained, or the time when the message is expected to be sent); then the historical update time corresponding to the last update of the session key is obtained (for example, the time may be the time when the session key was last changed, or the time when the first message was sent using the previous session key). It should be noted that the above times are all recorded based on the same system time source.

[0067] Then, the time difference between the current moment and the historical update moment is calculated. If the time difference is greater than the preset update period, it means that the usage time of the previous session key has exceeded the set period and the session key needs to be updated; otherwise, there is no need to update the session key and the current session key continues to be used for message transmission. It should be noted that the preset update period can be pre-configured according to demand, and the update period information is recorded in the security association of data communication through tunnel negotiation. When the update period information needs to be changed, the new update period information can be re-recorded through tunnel re-negotiation.

[0068] In some possible embodiments, in step S1, determining whether the current message to be transmitted meets a preset session key update condition may include:

[0069] S111, obtaining the current time corresponding to the message to be transmitted and the historical update time corresponding to the last update of the session key, and obtaining the message transmission volume between the current time and the historical update time;

[0070] S112: When the message transmission volume is greater than a preset transmission volume threshold, determine whether the current message to be transmitted meets a preset session key update condition.

[0071] It should be noted that the session key update condition can also be set to perform session key update when it is determined that the amount of message data sent using the same session key exceeds a set upper limit. Specifically, similarly to the previous embodiment, each time a message is to be transmitted, the current time corresponding to the message to be transmitted and the historical update time corresponding to the last update of the session key can be obtained; then, the cumulative message transmission volume during this period is obtained based on these two times; if it is determined that the message transmission volume exceeds the preset transmission volume threshold, the session key needs to be updated; otherwise, there is no need to update the session key, and the current session key continues to be used for message transmission.

[0072] It is understandable that when the data transmission efficiency is unstable, if the session key is updated according to a fixed period, the cumulative amount of message data transmitted in each update period will be inconsistent, and the same data security performance cannot be guaranteed in each update period. Therefore, by determining whether the key update condition is met based on whether the cumulative amount of message transmission without updated keys exceeds the transmission amount threshold, the session key update frequency can be adaptively adjusted based on the data transmission efficiency, so that the session key can still be updated in time when the data transmission rate is high, thereby further improving the flexibility of key update and the reliability of VPN communication.

[0073] In some possible embodiments, the second network end is further configured to: after obtaining the quantum key from the second key cache pool based on the updated quantum key index, update the local quantum key index recorded by the local security alliance based on the updated quantum key index.

[0074] It is understandable that security association is the basis of IPSec. Security association is a unidirectional logical connection, so it usually needs to be established in pairs, that is, when an IPSec tunnel is established between a first network end and a second network end, two security associations need to be established, one of which specifies the protection method for data sent from the first network end to the second network end, and the other specifies the protection method for data sent from the second network end to the first network end.

[0075] It should be noted that when the data transmission process is only one-way transmission from the first network end to the second network end, the second network end only needs to passively obtain the latest quantum key based on the quantum key index rewritten by the first network end. However, in this process, if the second network end also needs to transmit data to the first network end, it is necessary to update the local quantum key index recorded by the local security alliance of the second network end to avoid the second network end still using duplicate quantum keys for data encryption transmission, thereby further improving the security of VPN communication.

[0076] In some possible embodiments, before step S1, the following steps may also be included:

[0077] Initiate a tunnel negotiation request to the second network end based on preset quantum key configuration information, and receive a negotiation response instruction fed back by the second network end in response to the tunnel negotiation request; wherein the quantum key configuration information includes a quantum key enabling flag and a first key cache pool UID adopted by the first network end, and the negotiation response instruction includes a second key cache pool UID adopted by the second network end;

[0078] Information configuration is performed on the security association of the current tunnel communication based on the first key cache pool UID and the second key cache pool UID.

[0079] It should be noted that tunnel negotiation is required first when establishing an IPSec tunnel. Specifically, a configuration file for this IPSec VPN communication is first obtained, which includes quantum key configuration information, and the configuration information may include an indication of whether to enable quantum key (when quantum key needs to be enabled for session key update, a quantum key enablement flag is configured) and the UID of the first key cache pool to be used by the current tunnel, the session key update period, and other information.

[0080] It is understandable that multiple key cache pools may be configured in the first network end (or the second network end). When the first network end needs to establish IPSec VPN tunnels with multiple peers, a key cache pool may be used to store session key information of the corresponding tunnels.

[0081] Based on the tunnel negotiation mechanism, after the second network end authenticates the tunnel negotiation request, it will return a corresponding negotiation response instruction, which contains the second key cache pool UID corresponding to the first key cache pool. It can be understood that the second key cache pool and the first key cache pool store corresponding and consistent quantum keys, and the quantum keys between the two cache pools can be synchronized and updated through the key synchronization module.

[0082] Then, the security association of the current tunnel communication is configured according to the first key cache pool UID and the second key cache pool UID determined by the tunnel negotiation, so that quantum keys can be acquired based on the negotiated key cache pool UID during subsequent communications through the tunnel.

[0083] Based on this, tunnel negotiation between the communicating parties is carried out based on quantum key configuration information, so that the corresponding session key update method and the adopted caching strategy can be configured according to needs, thereby further improving the flexibility of key update.

[0084] In some possible embodiments, before step S1, the following steps may also be included:

[0085] In response to a quantum key initialization request, a quantum key is obtained based on preset quantum key configuration information and stored in a first key cache pool; wherein the quantum key configuration information includes the first key cache pool UID, the quantum key server IP address, the quantum key server port, the local device IP, the peer device ID, the authentication password and the peer device IP address;

[0086] Based on the quantum key configuration information, a target network end corresponding to the first network end is determined, and quantum key initialization synchronization processing is performed on the target network end.

[0087] It should be noted that before data communication, the first network end and the corresponding target network end need to be quantum key initialized. Specifically, the key initialization process can be performed at any time before VPN data communication, for example, the key initialization can be performed during the network idle period.

[0088] When key initialization is required, the first key cache pool UID, quantum key server IP address, and quantum key server port are first determined based on the preset quantum key configuration information, and then the quantum key is obtained from the corresponding quantum key server according to this information, and the obtained quantum key is stored in the corresponding first key cache pool. Then, based on the local device IP, the peer device ID, the authentication password, and the peer device IP address, a synchronization request is sent to the corresponding target network end, and the quantum key initialization synchronization process is performed after a specific authentication process.

[0089] Based on this, the flexibility of key update is further improved by initializing and synchronizing the quantum key caches of the local and target network ends based on the quantum key configuration information.

[0090] In some possible embodiments, the method for managing a session key for VPN communication may further include the steps of:

[0091] S3. Determine whether the first key cache pool meets a preset key synchronization condition, and synchronously update the quantum keys of the first key cache pool and the second key cache pool based on a pre-configured key synchronization module.

[0092] It should be noted that in order to ensure that the quantum keys stored in the first key cache pool and the second key cache pool having a corresponding binding relationship are consistent, the quantum keys of the first key cache pool and the second key cache pool can be synchronized and updated regularly.

[0093] Exemplarily, according to the set synchronization cycle, each synchronization cycle is regarded as the first key cache pool meeting the preset key synchronization condition. At this time, the quantum keys of the first key cache pool and the second key cache pool are synchronously updated based on the key synchronization module, and the synchronization process can include the identity authentication process of both parties to ensure security.

[0094] It should be noted that the key synchronization module may be a functional module deployed in the first network end, or may be an independent device connecting the first network end and the second network end.

[0095] Based on this, by configuring the key synchronization module and updating the key cache pools at both ends of the communication in a timely manner according to needs, the consistency of the keys at both ends is ensured, further improving the reliability of VPN communication.

[0096] Please refer to Figure 3 , Figure 3 The block diagram of the session key management device for VPN communication provided by some embodiments of the present application is shown. It should be understood that the session key management device for VPN communication is similar to the above-mentioned Figure 1 Corresponding to the method embodiment, each step involved in the above method embodiment can be executed. The specific functions of the session key management device for VPN communication can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0097] Figure 3 The session key management device for VPN communication includes at least one software function module that can be stored in a memory in the form of software or firmware or fixed in the session key management device for VPN communication. The session key management device for VPN communication is applied to the first network end and includes:

[0098] A key acquisition module 310, configured to determine whether the current message to be transmitted meets a preset session key update condition, update a quantum key index, and acquire a quantum key from a preset first key cache pool based on the quantum key index;

[0099] The encryption transmission module 320 is used to add the updated quantum key index to the ESP information corresponding to the message to be transmitted, and use the quantum key as the updated session key to encrypt and transmit the message to be transmitted to the second network end, so that the second network end obtains the quantum key from the second key cache pool based on the updated quantum key index and completes decryption of the message to be transmitted;

[0100] The session key update condition, the first key cache pool and the second key cache pool are determined by the first network end and the second network end through tunnel negotiation.

[0101] It can be understood that the above-mentioned device item embodiment corresponds to the method item embodiment of the present invention. A session key management device for VPN communication provided by the embodiment of the present invention can implement the session key management method for VPN communication provided by any method item embodiment of the present invention.

[0102] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0103] like Figure 4 As shown, some embodiments of the present application provide an electronic device 400, which includes: a memory 410, a processor 420, and a computer program stored in the memory 410 and executable on the processor 420, wherein the processor 420 reads the program from the memory 410 through a bus 430 and executes the program to implement a method of any embodiment of the session key management method for VPN communication as described above.

[0104] Processor 420 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 420 can be a microprocessor.

[0105] The memory 410 may be used to store instructions executed by the processor 420 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 420 of the disclosed embodiment may be used to execute instructions in the memory 410 to implement the method shown above. The memory 410 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0106] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon. The computer program is executed by a processor to execute the method described in the method embodiment.

[0107] Some embodiments of the present application further provide a computer program product, which, when executed on a computer, enables the computer to execute the method described in the method embodiment.

[0108] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0109] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0110] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0111] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0112] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0113] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0114] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for managing session keys for VPN communication, characterized in that: Applied to the first network end, including: Determining that the current message to be transmitted meets a preset session key update condition, updating a quantum key index, and obtaining a quantum key from a preset first key cache pool based on the quantum key index; Adding the updated quantum key index to the ESP information corresponding to the message to be transmitted, and using the quantum key as the updated session key to encrypt and transmit the message to be transmitted to the second network end, so that the second network end obtains the quantum key from the second key cache pool based on the updated quantum key index and completes decryption of the message to be transmitted; The session key update condition, the first key cache pool, and the second key cache pool are determined by the first network end and the second network end through tunnel negotiation.

2. The method for managing session keys for VPN communication according to claim 1, characterized in that: The step of determining whether the current message to be transmitted satisfies a preset session key update condition includes: Obtaining the current time corresponding to the message to be transmitted and the historical update time corresponding to the last update of the session key; When it is determined that the time difference between the current moment and the historical update moment is greater than a preset update period, it is determined that the current message to be transmitted meets a preset session key update condition.

3. The method for managing session keys for VPN communication according to claim 1, characterized in that: The step of determining whether the current message to be transmitted satisfies a preset session key update condition includes: Obtaining the current time corresponding to the message to be transmitted and the historical update time corresponding to the last update of the session key, and obtaining the message transmission volume between the current time and the historical update time; When the message transmission amount is greater than a preset transmission amount threshold, it is determined that the current message to be transmitted meets a preset session key update condition.

4. The method for managing session keys for VPN communication according to claim 1, wherein: The second network end is further configured to: after obtaining the quantum key from the second key cache pool based on the updated quantum key index, update the local quantum key index recorded by the local security alliance based on the updated quantum key index.

5. The method for managing session keys for VPN communication according to claim 1, wherein: Before determining that the current message to be transmitted meets the preset session key update condition, the method further includes: Initiating a tunnel negotiation request to the second network end based on preset quantum key configuration information, and receiving a negotiation response instruction fed back by the second network end in response to the tunnel negotiation request; wherein the quantum key configuration information includes a quantum key enabling flag and a first key cache pool UID adopted by the first network end, and the negotiation response instruction includes a second key cache pool UID adopted by the second network end; Information configuration is performed on the security association of the current tunnel communication based on the first key cache pool UID and the second key cache pool UID.

6. The method for managing session keys for VPN communication according to claim 1, wherein: Before determining that the current message to be transmitted meets the preset session key update condition, the method further includes: In response to a quantum key initialization request, a quantum key is obtained based on preset quantum key configuration information and stored in a first key cache pool; wherein the quantum key configuration information includes the first key cache pool UID, the quantum key server IP address, the quantum key server port, the local device IP, the peer device ID, the authentication password and the peer device IP address; Based on the quantum key configuration information, a target network end corresponding to the first network end is determined, and quantum key initialization synchronization processing is performed on the target network end.

7. The method for managing session keys for VPN communication according to claim 1, characterized in that: Also includes: It is determined that the first key cache pool meets a preset key synchronization condition, and the quantum keys of the first key cache pool and the second key cache pool are synchronously updated based on a pre-configured key synchronization module.

8. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the method for managing a session key for VPN communication according to any one of claims 1 to 7 can be implemented when the processor executes the program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the session key management method for VPN communication according to any one of claims 1 to 7 is executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the session key management method for VPN communication according to any one of claims 1 to 7 is implemented.

Images