Transmission mode global quantum security encryption equipment and data processing method

Abstract

The invention relates to the technical field of information security, in particular to transmission mode global quantum security encryption equipment and a data processing method. According to the scheme, the working area, the isolation area and the safety area can be integrated in one device and can also be separated devices. And if the quantum security encryption equipment is separated equipment, the quantum security encryption equipment can realize plug and play without any adjustment of a working area, so that the deployment process of the equipment is simplified, and the expandability and maintainability of the system are improved. The Ethernet interface is used for communication, so that the equipment disclosed by the invention can be easily integrated into the existing network architecture, and the existing network infrastructure does not need to be subjected to large-scale transformation.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a transmission mode global quantum security encryption device and a data processing method. Background Art

[0002] With the continuous development of quantum technology, the application of global quantum security encryption devices has received increasing attention. Global quantum security encryption devices achieve effective docking with traditional devices through specific communication areas to ensure the security of data transmission. In a newly built network environment, it is relatively simple to achieve effective communication because compatibility with quantum security devices can be considered at the design stage. However, for an established network environment, the situation is much more complicated.

[0003] The existing network environment usually has a fixed network topology, that is, the connection layout of network devices has been determined. In this case, the introduction of quantum-safe encryption devices faces major challenges, because this may require large-scale modifications to the existing network structure, which is not only time-consuming and labor-intensive, but may also affect the normal operation of the network.

[0004] In addition, traditional tunnel mode encryption methods have applicability issues in existing network environments. Tunnel mode protects data transmission by creating an encrypted channel in the network, but in complex network environments, especially when there are already established lines, this mode may be difficult to implement or inefficient. Summary of the invention

[0005] To solve the above problems, on one hand, the present application discloses a transmission mode global quantum security encryption device, comprising:

[0006] A work area, used for running user applications, comprising an independent first central processing unit, a first memory and a first disk storage, wherein the work area communicates with the isolation area via an Ethernet interface;

[0007] A secure zone, comprising an independent second central processor, a second memory and a second disk storage, communicating with the isolation zone via an Ethernet interface, for performing quantum encryption / decryption processing on data from the isolation zone, and performing an interaction process with a quantum security service;

[0008] Wherein, the working area and the security area each have an independent communication IP;

[0009] The isolation area includes a hardware processing module for filtering illegal messages and is also responsible for forwarding messages between the working area and the security area, and between the security area and the external communication network.

[0010] In the above scheme, when the work area communicates with the outside world as a communication initiator, the data generated by it is forwarded to the security area through the isolation area for encryption, and the encrypted data is returned to the isolation area and sent to the network from the isolation area;

[0011] When the security zone communicates with the outside world as a communication initiator, the security zone directly generates encrypted security messages, uses its own address information for external communication, and the encrypted messages are forwarded to the network through the isolation zone;

[0012] The isolation area first forwards the received message to the security area. The security area makes a judgment based on the destination address of the message. If the destination address points to the security area itself, it directly performs decryption processing; if the destination address points to the working area, the security area returns the message to the isolation area after decryption, and then the isolation area forwards it to the working area.

[0013] In the above scheme, the interaction process between the security zone and the quantum security service end includes access, authentication, key application and download with the global quantum security service.

[0014] In the above scheme, the isolation zone receives network data, and after judging it as a legitimate message based on local rules, forwards the network data to the security zone;

[0015] When the security zone receives network data from the isolation zone and determines that the data belongs to itself based on the destination IP of the network data, it decrypts the network data based on the transport layer load to obtain the network data sent by the quantum security server.

[0016] In the above solution, the process of the safe area processing the data from the working area further includes:

[0017] After receiving the data from the working area, the security area sends a relay key signaling message to the quantum security server;

[0018] Encrypting the workspace data to form quantum secure data, and correspondingly generating key relay data for indicating encryption to the quantum secure data;

[0019] The source MAC address and source IP address corresponding to the encrypted working area data correspond to the MAC address and IP address of the working area; the source MAC address and source IP address corresponding to the key relay data correspond to the MAC address and IP address of the security area;

[0020] The destination MAC and destination IP information corresponding to the encrypted working area data and key relay data are determined according to the corresponding receiving end.

[0021] In the above solution, after the security zone receives the network data whose destination is the working zone, the processing process includes:

[0022] The security zone determines the decryption key based on the key information in the received key relay data to decrypt the ciphertext message whose destination is the working area. After decryption, a hash check is performed, and after the check is successful, the decrypted plaintext data is sent to the isolation area, which is then forwarded to the working area through the isolation area.

[0023] On the other hand, the present application also discloses a data processing method for a transmission mode global quantum secure encryption device, which specifically includes the following steps:

[0024] S101: The working area sends working area data to the isolation area in a standard Ethernet frame data format;

[0025] Among them, the MAC layer source MAC in the standard Ethernet frame data is the MAC address of the work area network card; the destination MAC is the MAC address of the link peer end; the IP layer source IP is the work area IP address, and the destination IP is the communication peer end IP address; the port layer source port is the work area application port, and the destination port is the peer end service port;

[0026] S102: After receiving the working area data, the isolation area transparently transmits the data to the security area;

[0027] S103: The security zone receives the working zone data forwarded from the isolation zone, and performs quantum encryption processing on the working zone data to obtain quantum security data, wherein the quantum encryption processing method includes network layer load encryption and transport layer load encryption;

[0028] S104: The isolation zone receives the quantum secure data encrypted by the security zone. If the encryption method of the quantum secure data is network layer payload encryption, the quantum secure data is directly forwarded to the network; if the encryption method of the quantum secure data is transport layer payload encryption, the security zone recalculates the checksum of the transport layer protocol header based on the encrypted data, and then forwards the quantum secure data to the network.

[0029] In the above scheme, the quantum encryption processing method is that when the network layer load is encrypted, the MAC layer and the IP layer are kept unchanged, and the network layer load is quantum encrypted to obtain a quantum encrypted data packet. The quantum encrypted data packet includes an encryption header and an encrypted payload. The encryption header is used to indicate encryption information, and the encrypted payload is the data of the original network layer load after quantum encryption.

[0030] In the above scheme, the quantum encryption processing method is that when the transport layer load is encrypted, the MAC layer, IP layer and transport layer information are kept unchanged, and the transport layer load is quantum encrypted to form a quantum encrypted data packet, wherein the encrypted data includes an encryption header and an encrypted load, the encryption header is used to indicate the encryption information, and the encrypted load is the data after the original transport layer load is quantum encrypted.

[0031] In the above scheme, when the security zone communicates with the quantum security server, an Ethernet data packet constructed by the security zone and an Ethernet data packet containing quantum encrypted data are sent to the isolation zone, and then transparently transmitted to the external network through the isolation zone.

[0032] The working area, isolation area and security area in the device of the present application can be integrated into one device or can be separate devices. If they are separate devices, the quantum security encryption device can be plug-and-play without any adjustment of the working area, thereby simplifying the deployment process of the device and improving the scalability and maintainability of the system. By using the Ethernet interface for communication, the device of the present application can be easily integrated into the existing network architecture without large-scale transformation of the existing network infrastructure. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a schematic diagram of the steps of the working area of ​​the embodiment of the present application as a communication initiator communicating with the outside world;

[0034] Figure 2 This is a system block diagram of a global quantum secure encryption device in an embodiment of the present application;

[0035] Figure 3 This is a schematic diagram of data flow when the working area acts as a communication initiator to communicate with the outside world in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0037] Example 1: Figure 2 As shown, a transmission mode global quantum security encryption device includes:

[0038] A work area, used for running user applications, comprising an independent first central processing unit, a first memory and a first disk storage, wherein the work area communicates with the isolation area via an Ethernet interface;

[0039] The work area includes an independent first central processing unit (CPU), a first memory and a first disk storage; it is used to run user applications and process regular business data; it communicates with the isolation area through an Ethernet interface and does not directly communicate with the external network;

[0040] A secure zone, comprising an independent second central processor, a second memory and a second disk storage, communicating with the isolation zone via an Ethernet interface, for performing quantum encryption / decryption processing on data from the isolation zone, and performing an interaction process with a quantum security service;

[0041] The security zone further includes a quantum encryption module for performing quantum encryption and decryption operations on data using a quantum secure encryption and decryption algorithm (e.g., using quantum true random numbers as encryption keys using AES or XOR algorithms for encryption and decryption) to ensure the security of data during transmission;

[0042] Wherein, the working area and the security area each have an independent communication IP;

[0043] The isolation area includes a hardware processing module for filtering illegal messages and is also responsible for forwarding messages between the working area and the security area, and between the security area and the external communication network.

[0044] like Figure 3 In the data flow of 1-4, when the work area communicates with the outside world as a communication initiator, the data generated by it is forwarded to the security area through the isolation area for encryption, and then returned to the isolation area after encryption, and then sent to the network from the isolation area;

[0045] When the security zone communicates with the outside world as a communication initiator, the security zone directly generates encrypted security messages, uses its own address information for external communication, and the encrypted messages are forwarded to the network through the isolation zone;

[0046] The isolation area first forwards the received message to the security area. The security area makes a judgment based on the destination address of the message. If the destination address points to the security area itself, it directly performs decryption processing; if the destination address points to the working area, the security area returns the message to the isolation area after decryption, and then the isolation area forwards it to the working area.

[0047] The security of data transmission is ensured through quantum encryption / decryption processing. Quantum encryption is based on quantum true random number keys for data encryption and decryption, which is theoretically impossible to crack and has high security. The user workspace can enjoy quantum encryption protection without changing its operating habits or configuration, realizing transparent security enhancement for users. The setting of the isolation zone effectively prevents the intrusion of illegal messages, and also protects the workspace from direct external network attacks. The security zone can directly generate encrypted messages and use independent address information for external communication, which increases the flexibility and reliability of communication. The workspace and the security zone have independent CPU, memory and storage resources, which ensures that the performance of the workspace will not be affected even when encryption processing is performed in the security zone.

[0048] Through the implementation of the above solution, not only can the security of data during transmission be ensured, but also the convenience of user operation and the efficient operation of the system can be maintained, achieving a balance between security and user experience.

[0049] Embodiment 2: The process of the workspace as a communication initiator communicating with the outside world further includes:

[0050] S101: Sending working area data to the isolation area using standard Ethernet frame data;

[0051] Among them, the MAC layer source MAC in the standard Ethernet frame data is the MAC address of the work area network card; the destination MAC is the MAC address of the link peer end; the IP layer source IP is the work area IP address, and the destination IP is the communication peer end IP address; the port layer source port is the work area application port, and the destination port is the peer end service port;

[0052] The application in the workspace generates data and encapsulates it in the standard Ethernet frame data format;

[0053] Package contents:

[0054] MAC layer: The source MAC address is set to the MAC address of the work area network card, and the destination MAC address is set to the MAC address of the link peer (usually the MAC address of the next-hop device);

[0055] IP layer: The source IP address is set to the IP address of the workspace, and the destination IP address is set to the IP address of the communication peer (such as a server on the Internet);

[0056] Port layer: The source port is set to the port used by the workspace application, and the destination port is set to the port of the peer service;

[0057] S102: After receiving the working area data, the isolation area transparently transmits the data to the security area;

[0058] The isolation zone receives the standard Ethernet frame data sent by the working zone and performs a validity check on the data (such as checking the message format, filtering illegal traffic, etc.); among them, the legal data is transparently transmitted (transparently transmitted) to the security zone without any modification;

[0059] S103: The security zone receives the working zone data forwarded from the isolation zone, and performs quantum encryption processing on the working zone data to obtain quantum security data, wherein the quantum encryption processing method includes network layer load encryption and transport layer load encryption;

[0060] The secure zone receives the data forwarded by the isolated zone and performs quantum encryption on the data to generate quantum secure data. The quantum encryption process includes:

[0061] Network layer payload encryption: Encrypt the packet payload at the IP layer;

[0062] Transport layer payload encryption: Encrypts the packet payload at the TCP or UDP layer;

[0063] During the encryption process, the secure zone is encrypted using quantum keys (quantum true random numbers);

[0064] S104: The isolation zone receives the quantum secure data encrypted by the security zone. If the encryption method of the quantum secure data is network layer load encryption, the quantum secure data is directly forwarded to the network; if the encryption method of the quantum secure data is transport layer load encryption, the security zone recalculates the checksum of the TCP / UDP header based on the encrypted data, and then forwards the quantum secure data to the network;

[0065] The isolated area receives the quantum secure data encrypted by the secure area.

[0066] Perform the following operations depending on the encryption method:

[0067] Network layer payload encryption: Directly forward encrypted data to the external network.

[0068] Transport layer payload encryption: Since the checksum field in the TCP / UDP header needs to reflect the encrypted data, the security zone needs to recalculate the checksum of the TCP / UDP header and include the updated checksum in the data forwarded to the quarantine zone. After the quarantine zone receives the updated data, it forwards it to the external network.

[0069] In a specific scheme, the quantum encryption processing method is that when the network layer load is encrypted, the MAC layer and the IP layer are kept unchanged, and the network layer load is quantum encrypted to obtain a quantum encrypted data packet. The quantum encrypted data packet includes an encryption header and an encrypted payload. The encryption header is used to indicate encryption information, and the encrypted payload is the data of the original network layer load after quantum encryption.

[0070] During the quantum encryption process, the information of the MAC layer and IP layer remains unchanged, among which the source MAC address, destination MAC address, source IP address and destination IP address will not be modified.

[0071] During the encryption process, an encryption header is added before the original network layer payload. The encryption header contains encryption information, such as encryption algorithm identifier, key identifier, encryption mode, etc., which is used to instruct the receiving end how to decrypt the data;

[0072] The encrypted payload is the original network layer payload (such as data of ICMP, IGMP and other protocols) processed by the quantum encryption algorithm to form an encrypted payload.

[0073] The quantum encrypted data packet consists of an encrypted header and an encrypted payload, and the whole is still encapsulated under the original IP layer and above the MAC layer.

[0074] The network layer load is encrypted through quantum encryption technology, ensuring the security of data during transmission. Even if the data packet is intercepted, it cannot be interpreted by unauthorized third parties. The MAC layer and IP layer remain unchanged, and the routing and forwarding mechanism of the network layer does not need to be changed, which improves compatibility with existing networks.

[0075] The quantum encryption processing method is that when the transport layer load is encrypted, the MAC layer, IP layer and transport layer information are kept unchanged, and the transport layer load is quantum encrypted to form a quantum encrypted data packet, wherein the encrypted data includes an encryption header and an encrypted load, the encryption header is used to indicate the encryption information, and the encrypted load is the data after the original transport layer load is quantum encrypted.

[0076] During the quantum encryption process, the information of the MAC layer, IP layer and transport layer (such as TCP or UDP header information) remains unchanged; including the source port, destination port, sequence number, confirmation number, etc.

[0077] During the encryption process, an encryption header is added before the original transport layer payload, which contains encryption information, similar to the encryption header of the network layer payload encryption.

[0078] The encrypted payload is the original transport layer payload (such as data of application layer protocols such as HTTP and FTP) processed by the quantum encryption algorithm to form an encrypted payload.

[0079] The quantum encrypted data packet consists of an encrypted header and an encrypted payload, and the whole is still encapsulated in the original TCP or UDP segment, below the IP layer and above the MAC layer.

[0080] Quantum encryption of the transport layer payload protects the data security of the application layer, which is particularly important for applications that require end-to-end encryption. Keeping the transport layer header unchanged ensures that end-to-end communication will not be affected by encryption, such as TCP's flow control and congestion control mechanisms remain effective.

[0081] In the above scheme, the interaction process between the security zone and the quantum security service end includes access, authentication, key application and download with the global quantum security service.

[0082] In addition, when the security zone communicates with the quantum security server, an Ethernet data packet constructed by the security zone and an Ethernet data packet containing quantum encrypted data are sent to the isolation zone, and then transparently transmitted to the external network through the isolation zone.

[0083] After performing quantum encryption processing, the secure zone encapsulates the encrypted data into an Ethernet data packet. The format of the data packet follows the Ethernet standard, including the frame header, payload, and data packet tail.

[0084] After receiving the Ethernet data packet from the secure zone, the isolated zone forwards it to the external network according to the destination MAC address and IP address of the data packet. The transparent transmission mechanism of the isolated zone ensures that the data packet is not modified during the forwarding process, maintaining the integrity and security of the data.

[0085] The isolation zone receives network data, and after judging it as a legitimate message based on local rules, forwards the network data to the security zone;

[0086] When the security zone receives network data from the isolation zone and determines that the data belongs to itself based on the destination IP of the network data, it decrypts the network data based on the transport layer load to obtain the network data sent by the quantum security server.

[0087] In a specific solution, the process of the safe area processing data from the working area further includes:

[0088] After receiving the data from the working area, the security area sends a relay key signaling message to the quantum security server;

[0089] Encrypting the workspace data to form quantum secure data, and correspondingly generating key relay data for indicating the quantum secure data encrypted (for example, an index corresponding to the quantum key used for encryption, and the receiving party determines the corresponding decryption key in the quantum key pairing file shared by the communicating parties according to the index);

[0090] The source MAC address and source IP address corresponding to the encrypted working area data correspond to the MAC address and IP address of the working area; the source MAC address and source IP address corresponding to the key relay data correspond to the MAC address and IP address of the security area;

[0091] The destination MAC and destination IP information corresponding to the encrypted working area data and key relay data are determined according to the corresponding receiving end.

[0092] The sink MAC address and sink IP address of the encrypted work area data and key relay data are determined according to the receiving end.

[0093] For encrypted workspace data, the sink MAC address and sink IP address will be set to the address of the final recipient.

[0094] For key relay data, the sink MAC address and sink IP address will be set to the address of the quantum security server, as this is the destination of the key information.

[0095] After the security zone receives the network data whose destination is the work zone, the processing process includes:

[0096] The security zone determines the decryption key based on the key information in the received key relay data to decrypt the ciphertext message whose destination is the working zone. After decryption, a hash check is performed, and after the check is successful, the decrypted plaintext data is sent to the isolation zone, and forwarded to the working zone through the isolation zone. By using quantum encryption and key relay data, the security of data during transmission is ensured. The hash check mechanism ensures the integrity of the data after decryption and prevents the data from being tampered with during transmission. The processing of the security zone is transparent to the working zone. The working zone does not need to care about the security encryption and decryption process of the data, but only needs to process the received plaintext data.

[0097] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A transmission mode global quantum security encryption device, characterized in that: include: A work area, used to run user applications, comprising an independent first central processor, a first memory and a first disk storage, wherein the work area communicates with the isolation area via an Ethernet interface; A secure zone, comprising an independent second central processor, a second memory and a second disk storage, communicating with the isolation zone via an Ethernet interface, for performing quantum encryption / decryption processing on data from the isolation zone, and performing an interaction process with a quantum security service; Wherein, the working area and the security area each have an independent communication IP; The isolation area includes a hardware processing module for filtering illegal messages and is also responsible for forwarding messages between the working area and the security area, and between the security area and the external communication network.

2. The global quantum secure encryption device according to claim 1, characterized in that: When the work area communicates with the outside world as a communication initiator, the data generated by it is forwarded to the security area through the isolation area for encryption. After the data is encrypted, it is returned to the isolation area and sent to the network from the isolation area; When the security zone communicates with the outside world as a communication initiator, the security zone directly generates encrypted security messages, uses its own address information for external communication, and the encrypted messages are forwarded to the network through the isolation zone; The isolation zone first forwards the received message to the security zone, and the security zone makes a judgment based on the destination address of the message. If the destination address points to the security zone itself, the security zone directly performs decryption processing; If the destination address points to the working area, the security area returns the message to the isolation area after decryption, and then the isolation area forwards it to the working area.

3. The global quantum secure encryption device according to claim 1, characterized in that: The interaction process between the security zone and the quantum security service end includes access, authentication, key application and download with the global quantum security service.

4. The global quantum secure encryption device according to claim 1, characterized in that: The isolation zone receives the network data, and after judging it as a legitimate message based on local rules, forwards the network data to the security zone; When the security zone receives network data from the isolation zone and determines that the data belongs to itself based on the destination IP of the network data, it decrypts the network data based on the transport layer load to obtain the network data sent by the quantum security server.

5. The global quantum secure encryption device according to claim 1, characterized in that: The process of the security zone processing the data from the working zone further includes: After receiving the data from the working area, the security area sends a relay key signaling message to the quantum security server; Encrypting the workspace data to form quantum secure data, and correspondingly generating key relay data for indicating encryption to the quantum secure data; The source MAC address and source IP address corresponding to the encrypted working area data correspond to the MAC address and IP address of the working area; the source MAC address and source IP address corresponding to the key relay data correspond to the MAC address and IP address of the security area; The destination MAC and destination IP information corresponding to the encrypted working area data and key relay data are determined according to the corresponding receiving end.

6. The global quantum secure encryption device according to claim 5, characterized in that: After the security zone receives the network data whose destination is the working zone, the processing process includes: The security zone determines the decryption key based on the key information in the received key relay data to decrypt the ciphertext message whose destination is the working area. After decryption, a hash check is performed, and after the check is successful, the decrypted plaintext data is sent to the isolation area, which is then forwarded to the working area through the isolation area.

7. A data processing method for a transmission mode global quantum secure encryption device, characterized in that: The following steps are involved: S101: The working area sends working area data to the isolation area in a standard Ethernet frame data format; Among them, the MAC layer source MAC in the standard Ethernet frame data is the MAC address of the work area network card; the destination MAC is the MAC address of the link peer end; the IP layer source IP is the work area IP address, and the destination IP is the communication peer end IP address; the port layer source port is the work area application port, and the destination port is the peer end service port; S102: After receiving the working area data, the isolation area transparently transmits the data to the security area; S103: The security zone receives the working zone data forwarded from the isolation zone, and performs quantum encryption processing on the working zone data to obtain quantum security data, wherein the quantum encryption processing method includes network layer load encryption and transport layer load encryption; S104: The isolation zone receives the quantum secure data encrypted by the security zone. If the encryption method of the quantum secure data is network layer payload encryption, the quantum secure data is directly forwarded to the network; if the encryption method of the quantum secure data is transport layer payload encryption, the security zone recalculates the checksum of the transport layer protocol header based on the encrypted data, and then forwards the quantum secure data to the network.

8. The method according to claim 7, characterized in that The quantum encryption processing method is that when the network layer load is encrypted, the MAC layer and the IP layer are kept unchanged, and the network layer load is quantum encrypted to obtain a quantum encrypted data packet. The quantum encrypted data packet includes an encryption header and an encrypted payload. The encryption header is used to indicate encryption information, and the encrypted payload is the data of the original network layer load after quantum encryption.

9. The method according to claim 7, characterized in that: The quantum encryption processing method is that when the transport layer load is encrypted, the MAC layer, IP layer and transport layer information are kept unchanged, and the transport layer load is quantum encrypted to form a quantum encrypted data packet, wherein the encrypted data includes an encryption header and an encrypted load, the encryption header is used to indicate the encryption information, and the encrypted load is the data after the original transport layer load is quantum encrypted.

10. The method according to claim 7, characterized in that When the security zone communicates with the quantum security server, an Ethernet data packet constructed by the security zone is sent to the isolation zone, and the Ethernet data packet containing the quantum encrypted data is transparently transmitted to the external network through the isolation zone.

Images