Computing power zero-trust security tunnel method and system for improving security of private network

Abstract

The invention discloses a computing power zero-trust secure tunnel method and system for improving the security of a private network, and relates to the technical field of network communication, and the method comprises the steps: registering each tunnel end node to a unified control center, and carrying out the authentication of tunnel end point information on a control plane; selecting a routing protocol, and announcing service layer routing information, computing power information and network information; through a routing protocol, the nodes schedule the computing power network according to actual requirements; when the source node receives an uplink service message from the terminal, tunnel encapsulation is added for the message according to routing information of the overlay, security identification information of comprehensive encryption authentication is added in the encapsulation, and then the message is sent out; and after receiving the message, the destination node classifies the message and verifies the security identification information of the message conforming to the preset security feature so as to complete the authentication of two dimensions of tunnel and security. The method does not need to build the tunnel between the nodes in an active mode or a passive mode, and is suitable for point-to-point and point-to-multipoint tunnels.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and more specifically to a computing power zero-trust security tunnel method and system for improving the security of a private network. Background Art

[0002] In the fields of computing networks and mobile communication networks, various types of forwarding plane tunnels usually require both parties to establish a tunnel before forwarding data. This way of establishing tunnels has some significant problems and challenges for scenarios with many tunnel endpoints:

[0003] 1. N square tunnel problem: When the number of nodes is large, if an independent tunnel needs to be established between every two nodes, the total number of tunnels will be the square of the number of nodes (N^2). This will cause the number of tunnels to grow exponentially, greatly increasing the complexity of management and configuration.

[0004] 2. Resource consumption: The establishment, management, and maintenance of tunnels all consume host and network resources. As the number of tunnels increases, the consumption of these resources will also increase accordingly, which may lead to system performance degradation or insufficient resources.

[0005] 3. Tunnel management complexity: The host protocol stack of the node needs to allocate resources such as tunnel instances, forwarding tables, interfaces / IP, service flow analysis, and encapsulation for various tunnel types (such as GRE / IPSec / VxLAN, etc.) and bearer services (L2, L3), etc. This further increases the complexity and redundancy of tunnel management.

[0006] 4. Convergence of forwarding plane functions: In heterogeneous networks, after the forwarding and control separation of different meta-devices, the forwarding plane functions may become the same, but the control plane functions may also become the same. Although this helps to unify heterogeneous networks, it also brings new challenges, such as how to ensure compatibility and interoperability between different devices.

[0007] To address these issues, the industry is exploring new technologies and methods. Summary of the invention

[0008] In response to the needs and deficiencies of current technological development, the present invention provides a computing power zero-trust security tunnel method and system for improving the security of a private network.

[0009] In the first aspect, the present invention provides a computing power zero-trust security tunnel method for improving the security of a private network. The technical solution adopted to solve the above technical problems is as follows:

[0010] A computing power zero-trust security tunnel method for improving the security of a private network comprises the following steps:

[0011] S1. Register each tunnel end node with a unified control center and authenticate the tunnel endpoint information on the control plane;

[0012] S2. Select a routing protocol to notify the business layer routing information, computing power information, and network information. Through the routing protocol, the node schedules the computing power network according to actual needs.

[0013] S3. When the source node in the computing network receives an uplink service message from the terminal, the source node adds a tunnel encapsulation to the message according to the overlay routing information, adds the security identification information of the comprehensive encryption authentication to the encapsulation, and then sends it out; after receiving the tunnel encapsulated message, the destination node performs a "rough" classification according to the tunnel source address and security identification format, and verifies the security identification information of the message that meets the preset security characteristics, so as to complete the authentication of the two dimensions of tunnel and security;

[0014] Once the message passes the security check, the destination node removes its tunnel encapsulation and routes the original business message to the computing service for processing; when the downlink business of the computing service reaches the destination node: the destination node adds a new tunnel encapsulation for the downlink business and routes it to the designated node; then, when the designated node receives the message of this downlink business, it removes the tunnel encapsulation and forwards the business message to the terminal.

[0015] Optionally, the specific implementation process of step S1 is as follows:

[0016] S1.1. New node registration request: When a new node wishes to join the computing network, the new node first needs to send a registration request to the control center, which contains the node identity, security authentication information and public key;

[0017] S1.2, Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response after the verification is passed. The response contains the relevant information of the previously registered nodes in the computing power network;

[0018] S1.3, secure tunnel authentication: using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing network;

[0019] S1.4, Information notification: After the new node is successfully registered, the control center will notify the information of the new node to all previously registered nodes in the computing power network.

[0020] Further optionally, after executing step S1:

[0021] (1) Control plane connection and security authentication: Establish a control plane connection between the control center and each node, and complete security authentication;

[0022] (2) Automatic establishment of a “virtual” secure tunnel: After completing the security authentication of the control plane, a “virtual” secure tunnel will be automatically established between nodes;

[0023] (3) Business-level computing power routing notification: Combined with the business-level computing power routing notification, each node will have business-level routing information and secure tunnel encapsulation functions.

[0024] Optionally, select a centralized routing protocol, distributed routing protocol, policy routing, or local command line configuration to notify service layer routing information, computing power information, and network information, including:

[0025] Centralized routing protocols include PCE and NETCONF. PCEP is used to transmit path calculation requests and responses. NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management.

[0026] Distributed routing protocols include BGP and IGP. BGP, as a border gateway protocol, is used to exchange routing information between autonomous systems. IGP includes OSPF and ISIS, which are used to exchange routing information within autonomous systems.

[0027] Policy routing makes routing decisions based on user-defined policies and can flexibly control the direction of data packets;

[0028] Local command line configuration is performed directly on the network device through the command line interface.

[0029] Optionally, step S3 is performed to perform security authentication of the message in a strict mode or a loose mode according to different security requirements, wherein:

[0030] For strict mode, security authentication will be performed packet by packet. During this process, the network device will perform independent security authentication on each received message.

[0031] For loose mode, a flow table is established, and the network device first performs strict security authentication on the first message of the data flow. Once the first message passes the authentication, subsequent messages will be sampled based on the established flow table; if unqualified messages are found during the sample inspection, the predetermined policy will be executed.

[0032] In the second aspect, the present invention provides a computing power zero-trust security tunnel system that improves the security of a private network. The technical solutions adopted to solve the above technical problems are as follows:

[0033] A computing power zero-trust security tunnel system for improving the security of a private network, comprising:

[0034] The control center is used to receive the registration request of each tunnel end node and perform the authentication process of the tunnel end point information on the control plane;

[0035] The notification module is used to select a routing protocol, notify the business layer routing information, computing power information, and network information, and also to assist the node in scheduling the computing power network according to actual needs through the selected routing protocol;

[0036] The network scheduling module is used to schedule the computing network according to the actual needs based on the selected routing protocol auxiliary node;

[0037] The message processing module is used to add tunnel encapsulation to the message according to the overlay routing information when the source node in the computing power network receives the uplink service message from the terminal, and add the security identification information of the comprehensive encryption authentication to the encapsulation, and then send it out;

[0038] The classification and verification module is used to perform "rough" classification according to the tunnel source address and security identification format after the destination node receives the tunnel-encapsulated message, and verify the security identification information of the message that meets the preset security characteristics to complete the authentication of the two dimensions of tunnel and security;

[0039] The encapsulation removal module is used to remove the tunnel encapsulation in the message after the message passes the security check, and route the original business message to the computing service for processing;

[0040] The routing processing module is used to route the original service message to the corresponding computing service, add a new tunnel encapsulation for the downlink service when the downlink service of the computing service arrives, and route it to the designated node;

[0041] The removal forwarding module is used to remove the tunnel encapsulation when the designated node receives the downlink service message and forward the service message to the terminal.

[0042] Optionally, the control center receives the registration request of each tunnel end node and performs an authentication process of the tunnel end point information on the control plane. This process specifically includes the following implementation process:

[0043] New node registration request: When a new node wishes to join the computing network, the new node first needs to send a registration request to the control center, which contains the node identity, security authentication information and public key;

[0044] Registration response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response after the verification is passed. The response contains relevant information about the previously registered nodes in the computing power network;

[0045] Secure tunnel authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing network;

[0046] Information notification: After the new node is successfully registered, the control center will notify the information of the new node to all previously registered nodes in the computing network.

[0047] Further optionally, the control center involved receives the registration request of each tunnel end node, and after authenticating the tunnel endpoint information on the control plane:

[0048] Establish control plane connection between the control center and each node and complete security authentication;

[0049] After completing security authentication, the "virtual" secure tunnel can be automatically established between nodes;

[0050] Combined with the computing power routing notification at the business level, each node will have business-level routing information and secure tunnel encapsulation functions.

[0051] Optionally, the notification module may select a centralized routing protocol, a distributed routing protocol, a policy routing or a local command line configuration to notify the service layer routing information, computing power information and network information, wherein:

[0052] Centralized routing protocols include PCEP and NETCONF. PCEP is used to transmit path calculation requests and responses, while NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management.

[0053] Distributed routing protocols include BGP and IGP. BGP, as a border gateway protocol, is used to exchange routing information between autonomous systems. IGP includes OSPF and ISIS, which are used to exchange routing information within autonomous systems.

[0054] Policy routing makes routing decisions based on user-defined policies and can flexibly control the direction of data packets;

[0055] Local command line configuration is performed directly on the network device through the command line interface.

[0056] Optionally, the classification verification module involved adopts a strict mode or a loose mode to perform security authentication of the message according to different security requirements, where:

[0057] For strict mode, security authentication will be performed packet by packet. During this process, the network device will perform independent security authentication on each received message.

[0058] For loose mode, a flow table is established, and the network device first performs strict security authentication on the first message of the data flow. Once the first message passes the authentication, subsequent messages will be sampled based on the established flow table; if unqualified messages are found during the sample inspection, the predetermined policy will be executed.

[0059] A computing power zero-trust security tunnel method and system for improving the security of a private network of the present invention has the following beneficial effects compared with the prior art:

[0060] 1. When the present invention performs tunnel forwarding, it is not necessary to establish tunnels between nodes in an active or passive manner, which simplifies the problem of the host protocol stack of the node managing multiple types and multiple tunnel instances, solves the N-square problem of establishing tunnels between large-scale nodes, and at the same time ensures the security of data transmission;

[0061] 2. The present invention registers each tunnel end node with a unified control center and authenticates the tunnel end point information on the control plane. This method can avoid directly establishing a point-to-point tunnel between tunnel end nodes on the forwarding plane, thereby reducing the complexity of the protocol stack of the tunnel end node and the complexity of the entire system;

[0062] 3. The tunnel of the present invention is applicable to point-to-point and point-to-multipoint tunnels, including GRE, VxLAN, IPSec and SRv6. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Attached Figure 1 It is a logical view of the computing power zero-trust security tunnel in an embodiment of the present invention;

[0064] Attached Figure 2 This is a flow chart of new node registration and tunnel forwarding in an embodiment of the present invention;

[0065] Attached Figure 3 It is a connection block diagram of the third embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the technical solution, the technical problem solved and the technical effect of the present invention more clearly understood, the technical solution of the present invention is clearly and completely described below in conjunction with specific embodiments.

[0067] Embodiment 1:

[0068] Combined with Figure 1 This embodiment proposes a computing power zero-trust security tunnel method to improve the security of a private network, which includes the following steps:

[0069] S1. Register each tunnel end node with a unified control center and authenticate the tunnel end point information on the control plane. Figure 2 The specific implementation process is as follows:

[0070] S1.1, New node registration request: When a new node (node ​​5) wishes to join the computing network, the new node (node ​​5) first needs to send a registration request to the control center, and the registration request contains the node identity, security authentication information and public key;

[0071] S1.2, Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node (node ​​5), and prepares a response after the verification. The response contains the relevant information of the previously registered nodes (node ​​1 and node 2) in the computing power network;

[0072] S1.3, secure tunnel authentication: using the response information provided by the control center, the new node (node ​​5) establishes a "virtual" secure tunnel with the previously registered nodes (node ​​1 and node 2) in the computing network; this process usually involves the following steps: each node (node ​​5, node 1, node 2) and the control center exchange information through a secure method, such as HTTPS, and the information between each node (node ​​5, node 1, node 2) is transferred through the control center;

[0073] S1.4, Information notification: After the new node (node ​​5) is successfully registered, the control center notifies the information of the new node (node ​​5) to all previously registered nodes (node ​​1 and node 2) in the computing power network.

[0074] After executing step S1:

[0075] (1) Control plane connection and security authentication: Establish a control plane connection between the control center and each node, and complete security authentication. This step ensures that the identity and security of all participating nodes are verified, providing a basis for subsequent tunnel establishment.

[0076] (2) Automatic establishment of a “virtual” secure tunnel: After completing the security authentication of the control plane, each node will automatically complete the establishment of a “virtual” secure tunnel. The “virtual” here means that the establishment and management of the tunnel is coordinated by the control center, rather than each node needing to establish a physical or logical connection with other nodes separately. For details, see the attached Figure 1 The dotted line in

[0077] (3) Business-level computing power routing notification: Combined with the business-level computing power routing notification, each node will have business-level routing information and secure tunnel encapsulation functions; this means that the node can not only dynamically adjust the route according to business needs, but also ensure the security of data during transmission.

[0078] S2. Select a routing protocol to notify the business layer routing information, computing power information, and network information.

[0079] Through the routing protocol, nodes schedule the computing network according to actual needs.

[0080] Select centralized routing protocol, distributed routing protocol, policy routing or local command line configuration to notify service layer routing information, computing power information, and network information, including:

[0081] Centralized routing protocols include PCEP (Path Computation Element Communication Protocol) and NETCONF (Network Configuration Protocol). PCEP is used to transmit path calculation requests and responses and is often used in traffic engineering and path selection to ensure efficient data transmission in the network. NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management, allowing network administrators to control the status of the entire network from a central point.

[0082] Distributed routing protocols include BGP (Border Gateway Protocol) and IGP IGP (Interior Gateway Protocols). BGP, as a border gateway protocol, is used for routing information exchange between autonomous systems and is one of the core protocols for Internet routing. IGP includes OSPF (Open Shortest Path First) and ISIS (Intermediate System to Intermediate System), which are used for routing information exchange within autonomous systems to ensure that data packets within large networks can find the best path.

[0083] Policy routing makes routing decisions based on user-defined policies, which can flexibly control the direction of data packets and is suitable for scenarios where traffic needs to be directed according to specific rules or policies;

[0084] Local command line configuration is performed directly on the network device through the command line interface. This method is suitable for small-scale or simple network environments and allows administrators to directly and finely control the device.

[0085] S3. Reference Figure 2When the source node (node ​​2) in the computing network receives an uplink service message from a terminal (such as a personal computer, smart phone, or tablet device), the source node (node ​​2) adds a tunnel encapsulation to the message according to the overlay routing information, adds security identification information of comprehensive encryption authentication to the encapsulation, and then sends it out; after receiving the tunnel-encapsulated message, the destination node (assuming it is node 5) performs a "rough" classification according to the tunnel source address and security identification format, and verifies the security identification information of the message that meets the preset security features, so as to complete the authentication of the two dimensions of tunnel and security.

[0086] Once the message passes the security check, the destination node (assumed to be node 5) will remove its tunnel encapsulation and route the original business message to the computing service for processing; when the downlink business of the computing service reaches the destination node (assumed to be node 5), a similar process will be repeated: the destination node (assumed to be node 5) will add a new tunnel encapsulation for the downlink business and route it to the designated node (which can be the source node, i.e. node 2, or other registered nodes); then, when the designated node (assumed to be the source node, i.e. node 2) receives the message of this downlink business, the designated node (assumed to be the source node, i.e. node 2) removes the tunnel encapsulation and forwards the business message to the terminal.

[0087] In this step, depending on the security requirements, the strict mode or loose mode is used to perform security authentication of the message, where:

[0088] For strict mode, security authentication will be performed packet by packet. During this process, the network device will perform independent security authentication on each received message.

[0089] For the loose mode, a flow table is established, and network devices (such as switches, routers, firewalls, and computers) first perform strict security authentication on the first message (i.e., the first packet) of the data flow. Once the first packet authentication is passed, subsequent messages will be sampled based on the established flow table; if unqualified messages are found during the sample inspection, the predetermined policy will be executed.

[0090] Embodiment 2:

[0091] Combined with Figure 3 This embodiment proposes a computing power zero-trust security tunnel system for improving the security of a private network, which includes:

[0092] The control center is used to receive the registration request of each tunnel end node and perform the authentication process of the tunnel end point information on the control plane;

[0093] The notification module is used to select a routing protocol, notify the business layer routing information, computing power information, and network information, and also to assist the node in scheduling the computing power network according to actual needs through the selected routing protocol;

[0094] The network scheduling module is used to schedule the computing network according to the actual needs based on the selected routing protocol auxiliary node;

[0095] The message processing module is used to add tunnel encapsulation to the message according to the overlay routing information when the source node in the computing power network receives the uplink service message from the terminal, and add the security identification information of the comprehensive encryption authentication to the encapsulation, and then send it out;

[0096] The classification and verification module is used to perform "rough" classification according to the tunnel source address and security identification format after the destination node receives the tunnel-encapsulated message, and verify the security identification information of the message that meets the preset security characteristics to complete the authentication of the two dimensions of tunnel and security;

[0097] The encapsulation removal module is used to remove the tunnel encapsulation in the message after the message passes the security check, and route the original business message to the computing service for processing;

[0098] The routing processing module is used to route the original service message to the corresponding computing service, add a new tunnel encapsulation for the downlink service when the downlink service of the computing service arrives, and route it to the designated node;

[0099] The removal forwarding module is used to remove the tunnel encapsulation when the designated node receives the downlink service message and forward the service message to the terminal.

[0100] In this embodiment, the control center receives the registration request of each tunnel end node and performs the authentication process of the tunnel end point information on the control plane. This process specifically includes the following implementation process:

[0101] New node registration request: When a new node wishes to join the computing network, the new node first needs to send a registration request to the control center, which contains the node identity, security authentication information and public key;

[0102] Registration response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response after the verification is passed. The response contains relevant information about the previously registered nodes in the computing power network;

[0103] Secure tunnel authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing network; this process usually involves the following steps: Each node (node ​​5, node 1, node 2) exchanges information with the control center through a secure method, such as HTTPS, and the information between each node (node ​​5, node 1, node 2) is transferred through the control center;

[0104] Information notification: After the new node is successfully registered, the control center will notify the information of the new node to all previously registered nodes in the computing network.

[0105] In this embodiment, the control center receives the registration request of each tunnel end node, and after authenticating the tunnel endpoint information on the control plane:

[0106] Establish control plane connection between the control center and each node and complete security authentication;

[0107] After completing security authentication, the "virtual" secure tunnel can be automatically established between nodes;

[0108] Combined with the computing power routing notification at the business level, each node will have business-level routing information and secure tunnel encapsulation functions.

[0109] In this embodiment, the notification module involved selects a centralized routing protocol, a distributed routing protocol, a policy routing or a local command line configuration to notify the service layer routing information, computing power information and network information, wherein:

[0110] Centralized routing protocols include PCEP (Path Computation Element Communication Protocol) and NETCONF (Network Configuration Protocol). PCEP is used to transmit path calculation requests and responses and is often used in traffic engineering and path selection to ensure efficient data transmission in the network. NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management, allowing network administrators to control the status of the entire network from a central point.

[0111] Distributed routing protocols include BGP (Border Gateway Protocol) and IGP IGP (Interior Gateway Protocols). BGP, as a border gateway protocol, is used for routing information exchange between autonomous systems and is one of the core protocols for Internet routing. IGP includes OSPF (Open Shortest Path First) and ISIS (Intermediate System to Intermediate System), which are used for routing information exchange within autonomous systems to ensure that data packets within large networks can find the best path.

[0112] Policy routing makes routing decisions based on user-defined policies, which can flexibly control the direction of data packets and is suitable for scenarios where traffic needs to be directed according to specific rules or policies;

[0113] Local command line configuration is performed directly on the network device through the command line interface. This method is suitable for small-scale or simple network environments and allows administrators to directly and finely control the device.

[0114] In this embodiment, the classification verification module involved adopts a strict mode or a loose mode to perform security authentication of the message according to different security requirements, wherein:

[0115] For strict mode, security authentication will be performed packet by packet. During this process, the network device will perform independent security authentication on each received message.

[0116] For loose mode, a flow table is established, and the network device first performs strict security authentication on the first message (i.e., the first packet) of the data flow. Once the first packet authentication passes, subsequent messages will be sampled based on the established flow table; if unqualified messages are found during the sample inspection, the predetermined policy will be executed.

[0117] In summary, the computing power zero-trust security tunnel method and system of the present invention for improving the security of a private network does not need to establish tunnels between nodes in an active or passive manner, simplifies the problem of the host protocol stack of the node managing multiple types and multiple tunnel instances, and solves the N-square problem of establishing tunnels between large-scale nodes.

[0118] The above specific examples are used to explain the principles and implementation methods of the present invention in detail. These examples are only used to help understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made to the present invention by technicians in this technical field without departing from the principles of the present invention should fall within the scope of patent protection of the present invention.

Claims

1. A computing power zero-trust secure tunnel method for improving the security of a private network, characterized in that: The steps include: S1. Register each tunnel end node with a unified control center and authenticate the tunnel endpoint information on the control plane; S2. Select a routing protocol to notify the business layer routing information, computing power information, and network information; Through the routing protocol, nodes schedule the computing network according to actual needs; S3: When the source node in the computing network receives an uplink service message from the terminal, the source node adds a tunnel encapsulation to the message according to the overlay routing information, adds security identification information of comprehensive encryption and authentication to the encapsulation, and then sends it out; After receiving the tunnel-encapsulated message, the destination node performs a "rough" classification based on the tunnel source address and security identification format, and verifies the security identification information of the message that meets the preset security characteristics to complete the authentication of the two dimensions of tunnel and security; Once the message passes the security check, the destination node removes its tunnel encapsulation and routes the original business message to the computing service for processing; when the downlink business of the computing service reaches the destination node: the destination node adds a new tunnel encapsulation for the downlink business and routes it to the designated node; then, when the designated node receives the message of this downlink business, it removes the tunnel encapsulation and forwards the business message to the terminal.

2. According to claim 1, a computing power zero-trust secure tunnel method for improving the security of a private network is characterized in that: The specific implementation process of step S1 is as follows: S1.

1. New node registration request: When a new node wishes to join the computing network, the new node first needs to send a registration request to the control center, which contains the node identity, security authentication information and public key; S1.2, Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response after the verification is passed. The response contains the relevant information of the previously registered nodes in the computing power network; S1.3, secure tunnel authentication: using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing network; S1.4, Information notification: After the new node is successfully registered, the control center will notify the information of the new node to all previously registered nodes in the computing power network.

3. According to claim 2, a computing power zero-trust secure tunnel method for improving the security of a private network is characterized in that: After executing step S1: (1) Control plane connection and security authentication: Establish a control plane connection between the control center and each node, and complete security authentication; (2) Automatic establishment of a "virtual" secure tunnel: After completing the security authentication of the control plane, a "virtual" secure tunnel will be automatically established between nodes; (3) Business-level computing power routing notification: Combined with the business-level computing power routing notification, each node will have business-level routing information and secure tunnel encapsulation functions.

4. According to claim 1, a computing power zero-trust secure tunnel method for improving the security of a private network is characterized in that: Select centralized routing protocol, distributed routing protocol, policy routing or local command line configuration to notify service layer routing information, computing power information, and network information, including: Centralized routing protocols include PCE and NETCONF. PCEP is used to transmit path calculation requests and responses. NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management. Distributed routing protocols include BGP and IGP. BGP, as a border gateway protocol, is used to exchange routing information between autonomous systems. IGP includes OSPF and ISIS, which are used to exchange routing information within autonomous systems. Policy routing makes routing decisions based on user-defined policies and can flexibly control the direction of data packets; Local command line configuration is performed directly on the network device through the command line interface.

5. According to claim 1, a computing power zero-trust secure tunnel method for improving the security of a private network is characterized in that: Execute step S3 to perform security authentication of the message in strict mode or loose mode according to different security requirements, where: For strict mode, security authentication will be performed packet by packet. During this process, the network device will perform independent security authentication on each received message. For loose mode, a flow table is established, and the network device first performs strict security authentication on the first message of the data flow. Once the first message passes the authentication, subsequent messages will be sampled based on the established flow table; if unqualified messages are found during the sample inspection, the predetermined policy will be executed.

6. A computing power zero-trust security tunnel system for improving the security of a private network, characterized in that: It includes: The control center is used to receive the registration request of each tunnel end node and perform the authentication process of the tunnel end point information on the control plane; The notification module is used to select a routing protocol, notify the business layer routing information, computing power information, and network information, and also to assist the node in scheduling the computing power network according to actual needs through the selected routing protocol; The network scheduling module is used to schedule the computing network according to the actual needs based on the selected routing protocol auxiliary node; The message processing module is used to add tunnel encapsulation to the message according to the overlay routing information when the source node in the computing power network receives the uplink service message from the terminal, and add the security identification information of the comprehensive encryption authentication to the encapsulation, and then send it out; The classification and verification module is used to perform "rough" classification according to the tunnel source address and security identification format after the destination node receives the tunnel-encapsulated message, and to verify the security identification information of the message that meets the preset security features to complete the authentication of the two dimensions of tunnel and security. The encapsulation removal module is used to remove the tunnel encapsulation in the message after the message passes the security check, and route the original business message to the computing service for processing; The routing processing module is used to route the original service message to the corresponding computing service, add a new tunnel encapsulation for the downlink service when the downlink service of the computing service arrives, and route it to the designated node; The removal forwarding module is used to remove the tunnel encapsulation when the designated node receives the downlink service message and forward the service message to the terminal.

7. A computing power zero-trust secure tunnel system for improving private network security according to claim 6, characterized in that: The control center receives the registration request of each tunnel end node and performs the authentication process of the tunnel end point information on the control plane. This process specifically includes the following implementation process: New node registration request: When a new node wishes to join the computing network, the new node first needs to send a registration request to the control center, which contains the node identity, security authentication information and public key; Registration response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response after the verification is passed. The response contains relevant information about the previously registered nodes in the computing power network; Secure tunnel authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing network; Information notification: After the new node is successfully registered, the control center will notify the information of the new node to all previously registered nodes in the computing network.

8. A computing power zero-trust secure tunnel system for improving private network security according to claim 7, characterized in that: The control center receives the registration request from each tunnel end node and authenticates the tunnel endpoint information on the control plane: Establish control plane connection between the control center and each node and complete security authentication; After completing the security authentication, the "virtual" security tunnel can be automatically established between nodes; Combined with the computing power routing notification at the business level, each node will have business-level routing information and secure tunnel encapsulation functions.

9. A computing power zero-trust secure tunnel system for improving private network security according to claim 6, characterized in that: The selection notification module selects a centralized routing protocol, a distributed routing protocol, a policy routing or a local command line configuration to notify the service layer routing information, computing power information and network information, wherein: Centralized routing protocols include PCEP and NETCONF. PCEP is used to transmit path calculation requests and responses, while NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management. Distributed routing protocols include BGP and IGP. BGP, as a border gateway protocol, is used to exchange routing information between autonomous systems. IGP includes OSPF and ISIS, which are used to exchange routing information within autonomous systems. Policy routing makes routing decisions based on user-defined policies and can flexibly control the direction of data packets; Local command line configuration is performed directly on the network device through the command line interface.

10. A computing power zero-trust secure tunnel system for improving private network security according to claim 6, characterized in that: The classification verification module adopts a strict mode or a loose mode to perform security authentication of the message according to different security requirements, wherein: For strict mode, security authentication will be performed packet by packet. During this process, the network device will perform independent security authentication on each received message. For loose mode, a flow table is established, and the network device first performs strict security authentication on the first message of the data flow. Once the first message passes the authentication, subsequent messages will be sampled based on the established flow table; if unqualified messages are found during the sample inspection, the predetermined policy will be executed.

Images