A computing power zero-trust security tunnel method and system for improving private network security

Abstract

This invention discloses a method and system for improving the security of dedicated networks using zero-trust computing power tunnels. Relating to the field of network communication technology, the method includes: registering each tunnel endpoint with a unified control center and authenticating tunnel endpoint information on the control plane; selecting a routing protocol and announcing service layer routing information, computing power information, and network information; scheduling computing power networks according to actual needs through the routing protocol; when a source node receives an uplink service message from a terminal, it adds tunnel encapsulation to the message based on the overlay routing information and includes comprehensive encrypted authentication security identifier information in the encapsulation before sending it out; upon receiving the message, the destination node classifies it and verifies the security identifier information of messages that conform to preset security characteristics, thus completing authentication in both tunnel and security dimensions. This invention eliminates the need for establishing tunnels between nodes actively or passively, and is applicable to point-to-point and point-to-multipoint tunnels.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, specifically to a method and system for improving the security of private networks through zero-trust computing tunnels. Background Technology

[0002] In the fields of computing power networks and mobile communication networks, various types of forwarding plane tunnels typically require the communicating parties to establish a tunnel before data forwarding. This method of tunnel establishment presents some significant problems and challenges, especially in scenarios with a large number of tunnel endpoints:

[0003] 1. The N-square tunnel problem: When there are many nodes, if an independent tunnel needs to be established between every two nodes, the total number of tunnels will be the square of the number of nodes (N^2). This leads to an exponential increase in the number of tunnels, greatly increasing the complexity of management and configuration.

[0004] 2. Resource Consumption Issues: The establishment, management, and maintenance of tunnels all consume host and network resources. As the number of tunnels increases, the consumption of these resources will also increase accordingly, which may lead to a decrease in system performance or insufficient resources.

[0005] 3. Tunnel Management Complexity: The host protocol stack of a node needs to allocate resources such as tunnel instances, forwarding tables, interfaces / IPs, service flow parsing, and encapsulation for various tunnel types (such as GRE / IPSec / VxLAN) and carried services (L2, L3). This further increases the complexity and redundancy of tunnel management.

[0006] 4. Convergence of Forwarding Plane Functions: In heterogeneous networks, after different devices implement separation of forwarding and control planes, their forwarding plane functions may converge, but their control plane functions may also converge. While this helps to achieve unification of heterogeneous networks, it also brings new challenges, such as how to ensure compatibility and interoperability between different devices.

[0007] To address these issues, the industry is exploring new technologies and methods. Summary of the Invention

[0008] This invention addresses the needs and shortcomings of current technological development by providing a method and system for enhancing the security of private networks through zero-trust computing tunnels.

[0009] Firstly, the present invention provides a method for improving the security of private networks using zero-trust secure tunnels, and the technical solution adopted to solve the above-mentioned technical problems is as follows:

[0010] A method for improving the security of private networks using zero-trust computing tunnels includes the following steps:

[0011] S1. Register each tunnel endpoint with a unified control center and authenticate the tunnel endpoint information on the control plane;

[0012] S2. Select a routing protocol to announce service layer routing information, computing power information, and network information; through the routing protocol, nodes schedule computing power and the network according to actual needs;

[0013] S3. When the source node in the computing power network receives an uplink service message from the terminal, the source node adds a tunnel encapsulation to the message based on the routing information of the overlay, and adds comprehensive encryption and authentication security identification information to the encapsulation before sending it out. After receiving the tunnel-encapsulated message, the destination node performs a "rough" classification based on the tunnel source address and security identification format, and verifies the security identification information of messages that meet the preset security characteristics to complete the authentication of both the tunnel and security dimensions.

[0014] Once the message passes the security check, the destination node removes its tunnel encapsulation and routes the original service message to the computing power service for processing. When the downlink service of the computing power service arrives at the destination node: the destination node adds a new tunnel encapsulation to the downlink service and routes it to the designated node. Subsequently, when the designated node receives the message of this downlink service, it removes the tunnel encapsulation and forwards the service message to the terminal.

[0015] Optionally, the specific implementation process of step S1 is as follows:

[0016] S1.1 New Node Registration Request: When a new node wants to join the computing power network, the new node first needs to send a registration request to the control center. The registration request includes the node's identity, security authentication information, and public key.

[0017] S1.2 Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response upon successful verification. The response contains relevant information about previously registered nodes in the computing power network.

[0018] S1.3 Secure Tunnel Authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing power network;

[0019] S1.4 Information Notification: After a new node successfully registers, the control center will notify all previously registered nodes in the computing power network of the new node's information.

[0020] Further optional, after performing step S1:

[0021] (1) Control plane connection and security authentication: Establish control plane connections between the control center and each node, and complete security authentication;

[0022] (2) Automatic establishment of “virtual” secure tunnels: After the security authentication of the control plane is completed, the establishment of “virtual” secure tunnels between nodes will be completed automatically;

[0023] (3) Business-level computing power routing announcement: Combined with business-level computing power routing announcement, each node will have business-level routing information and secure tunnel encapsulation function.

[0024] Optionally, users can choose a centralized routing protocol, a distributed routing protocol, policy-based routing, or local command-line configuration to announce service-layer routing information, computing power information, and network information.

[0025] Centralized routing protocols include two types: PCE and NETCONF. PCE is used to transmit path calculation requests and responses, while NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management.

[0026] Distributed routing protocols include BGP and IGP. BGP is a border gateway protocol used for exchanging routing information between autonomous systems. IGP includes OSPF and ISIS, used for exchanging routing information within an autonomous system.

[0027] Policy-based routing makes routing decisions based on user-defined policies, allowing for flexible control over the direction of data packets.

[0028] Local command-line configuration can be performed directly on the network device through the command-line interface.

[0029] Optionally, step S3 is performed to perform message security authentication using either strict mode or loose mode, depending on the security requirements, wherein:

[0030] In strict mode, security authentication is performed packet by packet. During this process, the network device performs independent security authentication on each received packet.

[0031] In loose mode, flow tables are established. The network device first performs strict security authentication on the first packet of the data flow. Once the first packet is authenticated, subsequent packets will be randomly checked based on the established flow tables. If unqualified packets are found during the random check, a predetermined policy will be executed.

[0032] Secondly, this invention provides a zero-trust secure tunnel system for improving the security of private networks. The technical solution adopted to solve the above-mentioned technical problems is as follows:

[0033] A zero-trust secure tunnel system for computing power to enhance private network security, comprising:

[0034] The control center is used to receive registration requests from each tunnel endpoint and to perform the authentication process of tunnel endpoint information on the control plane.

[0035] The announcement module is used to select a routing protocol and announce business layer routing information, computing power information, and network information. It is also used to assist nodes in scheduling computing power and the network according to actual needs based on the selected routing protocol.

[0036] The network scheduling module is used to assist nodes in scheduling the computing power network according to actual needs based on the selected routing protocol;

[0037] The message processing module is used to add tunnel encapsulation to the message based on the routing information of the overlay when the source node in the computing power network receives the uplink service message from the terminal, and add comprehensive encryption and authentication security identification information to the encapsulation before sending it out.

[0038] The classification and verification module is used to perform a "rough" classification based on the tunnel source address and security identifier format after the destination node receives the tunnel-encapsulated message, and to verify the security identifier information of the message that meets the preset security characteristics, so as to complete the authentication of both the tunnel and security dimensions.

[0039] The encapsulation removal module is used to remove the tunnel encapsulation from the message after the message passes the security check, and to route the original business message to the computing power service for processing.

[0040] The routing processing module is used to route the original service packets to the corresponding computing power service, add new tunnel encapsulation for the downlink service when the downlink service arrives, and route it to the specified node.

[0041] The removal forwarding module is used to remove tunnel encapsulation when a downlink service packet is received at a specified node, and then forward the service packet to the terminal.

[0042] Optionally, the control center receives registration requests from each tunnel endpoint and performs tunnel endpoint information authentication on the control plane. This process specifically includes the following implementation steps:

[0043] New node registration request: When a new node wants to join the computing power network, the new node first needs to send a registration request to the control center. The registration request contains the node's identity, security authentication information and public key.

[0044] Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response upon successful verification. The response contains relevant information about previously registered nodes in the computing power network.

[0045] Secure tunnel authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing power network;

[0046] Information notification: After a new node successfully registers, the control center will notify all previously registered nodes in the computing power network of the new node's information.

[0047] Optionally, the control center receives registration requests from each tunnel endpoint and authenticates the tunnel endpoint information on the control plane:

[0048] The control center establishes control plane connections with each node and completes security authentication.

[0049] Once security authentication is completed, a "virtual" secure tunnel can be automatically established between the nodes;

[0050] By combining business-level computing power routing announcements, each node will have business-level routing information and secure tunnel encapsulation capabilities.

[0051] Optionally, the involved announcement module can select a centralized routing protocol, a distributed routing protocol, policy-based routing, or local command-line configuration to announce service-layer routing information, computing power information, and network information, wherein:

[0052] Centralized routing protocols include two types: PCEP and NETCONF. PCEP is used to transmit path calculation requests and responses, while NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management.

[0053] Distributed routing protocols include BGP and IGP. BGP is a border gateway protocol used for exchanging routing information between autonomous systems. IGP includes OSPF and ISIS, used for exchanging routing information within an autonomous system.

[0054] Policy-based routing makes routing decisions based on user-defined policies, allowing for flexible control over the direction of data packets.

[0055] Local command-line configuration can be performed directly on the network device through the command-line interface.

[0056] Optionally, the classification and verification modules involved may employ either strict or loose modes for message security authentication, depending on the specific security requirements.

[0057] In strict mode, security authentication is performed packet by packet. During this process, the network device performs independent security authentication on each received packet.

[0058] In loose mode, flow tables are established. The network device first performs strict security authentication on the first packet of the data flow. Once the first packet is authenticated, subsequent packets will be randomly checked based on the established flow tables. If unqualified packets are found during the random check, a predetermined policy will be executed.

[0059] The computing power zero-trust secure tunnel method and system for improving private network security, as proposed in this invention, have the following advantages compared to existing technologies:

[0060] 1. When performing tunnel forwarding, this invention eliminates the need to establish tunnels between nodes through active or passive means, simplifying the management of multiple types and multiple tunnel instances by the node's host protocol stack, solving the N-squared problem of establishing tunnels between large-scale nodes, and ensuring the security of data transmission at the same time.

[0061] 2. This invention registers each tunnel endpoint with a unified control center and authenticates the tunnel endpoint information on the control plane. This method can avoid directly establishing point-to-point tunnels between tunnel endpoints on the forwarding plane, thereby reducing the protocol stack complexity of the tunnel endpoints and the complexity of the entire system.

[0062] 3. The tunnel of the present invention is applicable to point-to-point and point-to-multipoint tunnels, including GRE, VxLAN, IPSec and SRv6. Attached Figure Description

[0063] Appendix Figure 1 This is a logical view of the zero-trust secure tunnel for computing power in this embodiment of the invention;

[0064] Appendix Figure 2 This is a flowchart of the new node registration and tunnel forwarding process in an embodiment of the present invention;

[0065] Appendix Figure 3 This is a connection block diagram of Embodiment 3 of the present invention. Detailed Implementation

[0066] To make the technical solution, the technical problem solved, and the technical effect of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with specific embodiments.

[0067] Example 1:

[0068] Combined with appendix Figure 1 This embodiment proposes a zero-trust secure tunnel method for improving the security of private networks, which includes the following steps:

[0069] S1. Register each tunnel endpoint with the unified control center and authenticate the tunnel endpoint information on the control plane. (Refer to Appendix) Figure 2 The specific implementation process is as follows:

[0070] S1.1 New Node Registration Request: When a new node (Node 5) wants to join the computing power network, the new node (Node 5) first needs to send a registration request to the control center. The registration request includes the node's identity, security authentication information, and public key.

[0071] S1.2 Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node (node ​​5), and prepares a response after the verification is passed. The response contains relevant information of the previously registered nodes (node ​​1 and node 2) in the computing power network.

[0072] S1.3 Secure Tunnel Authentication: Using the response information provided by the control center, the new node (node ​​5) establishes a "virtual" secure tunnel with the previously registered nodes (node ​​1 and node 2) in the computing power network. This process typically involves the following steps: each node (node ​​5, node 1, node 2) interacts with the control center using secure methods, such as HTTPS, and information between each node (node ​​5, node 1, node 2) is relayed through the control center.

[0073] S1.4 Information Notification: After the new node (node ​​5) is successfully registered, the control center will notify all previously registered nodes (node ​​1 and node 2) in the computing power network of the information of the new node (node ​​5).

[0074] After executing step S1:

[0075] (1) Control plane connection and security authentication: Establish control plane connection between the control center and each node and complete security authentication; this step ensures that the identity and security of all participating nodes are verified, providing a foundation for the subsequent tunnel construction;

[0076] (2) Automatic Establishment of “Virtual” Secure Tunnels: After the security authentication of the control plane is completed, “virtual” secure tunnels will be automatically established between the nodes. Here, “virtual” means that the establishment and management of the tunnels are coordinated by the control center, rather than each node needing to establish separate physical or logical connections with other nodes. See Appendix for details. Figure 1 The dashed line in the middle;

[0077] (3) Business-level computing power routing announcement: Combined with business-level computing power routing announcement, each node will have business-level routing information and secure tunnel encapsulation function; this means that the node can not only dynamically adjust the route according to business needs, but also ensure the security of data during transmission.

[0078] S2. Select a routing protocol and announce service layer routing information, computing power information, and network information.

[0079] Through routing protocols, nodes schedule computing power networks according to actual needs.

[0080] Choose a centralized routing protocol, a distributed routing protocol, policy-based routing, or local command-line configuration to announce service-layer routing information, computing power information, and network information, including:

[0081] Centralized routing protocols include two types: PCEP (Path Computation Element Communication Protocol) and NETCONF (Network Configuration Protocol). PCEP is used to transmit path calculation requests and responses and is often used in traffic engineering and path selection to ensure efficient data transmission in the network. NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management, enabling network administrators to control the status of the entire network from a central point.

[0082] Distributed routing protocols include two types: BGP (Border Gateway Protocol) and IGP (Interior Gateway Protocols). BGP, as a border gateway protocol, is used for the exchange of routing information between autonomous systems and is one of the core protocols for Internet routing. IGP includes OSPF (Open Shortest Path First) and ISIS (Intermediate System to Intermediate System), which are used for the exchange of routing information within autonomous systems to ensure that data packets within large networks can find the best path.

[0083] Policy-based routing makes routing decisions based on user-defined policies, which can flexibly control the direction of data packets and is suitable for scenarios that need to guide traffic according to specific rules or policies.

[0084] Local command-line configuration is performed directly on the network device through the command-line interface. This method is suitable for small-scale or simple network environments and allows administrators to directly control the device with fine precision.

[0085] S3, Reference Appendix Figure 2When the source node (node ​​2) in the computing power network receives an uplink service message from a terminal (such as a personal computer, smartphone, or tablet), the source node (node ​​2) adds a tunnel encapsulation to the message based on the routing information of the overlay, and adds comprehensive encryption and authentication security identification information to the encapsulation before sending it out. After receiving the tunnel-encapsulated message, the destination node (assuming it is node 5) performs a "rough" classification based on the tunnel source address and security identification format, and verifies the security identification information of messages that meet the preset security characteristics, so as to complete the authentication of both the tunnel and security dimensions.

[0086] Once the message passes the security check, the destination node (assuming it is node 5) will remove its tunnel encapsulation and route the original service message to the computing power service for processing. When the downlink service of the computing power service arrives at the destination node (assuming it is node 5), a similar process will be repeated: the destination node (assuming it is node 5) will add a new tunnel encapsulation for the downlink service and route it to the designated node (which can be the source node, i.e., node 2, or another registered node). Subsequently, when the designated node (assuming it is the source node, i.e., node 2) receives the message of this downlink service, the designated node (assuming it is the source node, i.e., node 2) will remove the tunnel encapsulation and forward the service message to the terminal.

[0087] In this step, depending on the different security requirements, either strict mode or loose mode is used for message security authentication, wherein:

[0088] In strict mode, security authentication is performed packet by packet. During this process, the network device performs independent security authentication on each received packet.

[0089] In loose mode, flow tables are established. Network devices (such as switches, routers, firewalls, and computers) first perform strict security authentication on the first packet of the data flow (i.e., the first packet). Once the first packet is authenticated, subsequent packets will be randomly checked based on the established flow tables. If unqualified packets are found during the random check, a predetermined policy will be executed.

[0090] Example 2:

[0091] Combined with appendix Figure 3 This embodiment proposes a zero-trust secure tunnel system for computing power to improve the security of private networks, which includes:

[0092] The control center is used to receive registration requests from each tunnel endpoint and to perform the authentication process of tunnel endpoint information on the control plane.

[0093] The announcement module is used to select a routing protocol and announce business layer routing information, computing power information, and network information. It is also used to assist nodes in scheduling computing power and the network according to actual needs based on the selected routing protocol.

[0094] The network scheduling module is used to assist nodes in scheduling the computing power network according to actual needs based on the selected routing protocol;

[0095] The message processing module is used to add tunnel encapsulation to the message based on the routing information of the overlay when the source node in the computing power network receives the uplink service message from the terminal, and add comprehensive encryption and authentication security identification information to the encapsulation before sending it out.

[0096] The classification and verification module is used to perform a "rough" classification based on the tunnel source address and security identifier format after the destination node receives the tunnel-encapsulated message, and to verify the security identifier information of the message that meets the preset security characteristics, so as to complete the authentication of both the tunnel and security dimensions.

[0097] The encapsulation removal module is used to remove the tunnel encapsulation from the message after the message passes the security check, and to route the original business message to the computing power service for processing.

[0098] The routing processing module is used to route the original service packets to the corresponding computing power service, add new tunnel encapsulation for the downlink service when the downlink service arrives, and route it to the specified node.

[0099] The removal forwarding module is used to remove tunnel encapsulation when a downlink service packet is received at a specified node, and then forward the service packet to the terminal.

[0100] In this embodiment, the control center receives registration requests from each tunnel endpoint and performs an authentication process for the tunnel endpoint information on the control plane. This process specifically includes the following implementation steps:

[0101] New node registration request: When a new node wants to join the computing power network, the new node first needs to send a registration request to the control center. The registration request contains the node's identity, security authentication information and public key.

[0102] Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response upon successful verification. The response contains relevant information about previously registered nodes in the computing power network.

[0103] Secure Tunnel Authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing power network. This process typically involves the following steps: Each node (node ​​5, node 1, node 2) interacts with the control center using secure methods, such as HTTPS, and information between each node (node ​​5, node 1, node 2) is relayed through the control center.

[0104] Information notification: After a new node successfully registers, the control center will notify all previously registered nodes in the computing power network of the new node's information.

[0105] In this embodiment, the control center receives the registration requests from each tunnel endpoint and authenticates the tunnel endpoint information on the control plane:

[0106] The control center establishes control plane connections with each node and completes security authentication.

[0107] Once security authentication is completed, a "virtual" secure tunnel can be automatically established between the nodes;

[0108] By combining business-level computing power routing announcements, each node will have business-level routing information and secure tunnel encapsulation capabilities.

[0109] In this embodiment, the selection and announcement module selects a centralized routing protocol, a distributed routing protocol, policy routing, or local command-line configuration to announce service layer routing information, computing power information, and network information, wherein:

[0110] Centralized routing protocols include two types: PCEP (Path Computation Element Communication Protocol) and NETCONF (Network Configuration Protocol). PCEP is used to transmit path calculation requests and responses and is often used in traffic engineering and path selection to ensure efficient data transmission in the network. NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management, enabling network administrators to control the status of the entire network from a central point.

[0111] Distributed routing protocols include two types: BGP (Border Gateway Protocol) and IGP (Interior Gateway Protocols). BGP, as a border gateway protocol, is used for the exchange of routing information between autonomous systems and is one of the core protocols for Internet routing. IGP includes OSPF (Open Shortest Path First) and ISIS (Intermediate System to Intermediate System), which are used for the exchange of routing information within autonomous systems to ensure that data packets within large networks can find the best path.

[0112] Policy-based routing makes routing decisions based on user-defined policies, which can flexibly control the direction of data packets and is suitable for scenarios that need to guide traffic according to specific rules or policies.

[0113] Local command-line configuration is performed directly on the network device through the command-line interface. This method is suitable for small-scale or simple network environments and allows administrators to directly control the device with fine precision.

[0114] In this embodiment, the classification and verification module uses either a strict mode or a loose mode for packet security authentication based on different security requirements, wherein:

[0115] In strict mode, security authentication is performed packet by packet. During this process, the network device performs independent security authentication on each received packet.

[0116] In loose mode, flow tables are established. The network device first performs strict security authentication on the first packet of the data flow (i.e., the first packet). Once the first packet is authenticated, subsequent packets will be sampled based on the established flow tables. If unqualified packets are found during the sampling, a predetermined policy will be executed.

[0117] In summary, the zero-trust secure tunnel method and system for improving private network security of the present invention eliminates the need to establish tunnels between nodes through active or passive means, simplifies the management of multiple types and multiple tunnel instances by the host protocol stack of nodes, and solves the N-squared problem of establishing tunnels between large-scale nodes.

[0118] The above specific examples illustrate the principles and implementation methods of the present invention in detail. These embodiments are merely for the purpose of helping to understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made to the present invention by those skilled in the art without departing from the principles of the present invention should fall within the patent protection scope of the present invention.

Claims

1. A method for improving the security of a private network using a zero-trust computing tunnel, characterized in that, Includes the following steps: S1. Register each tunnel endpoint with the unified control center and authenticate the tunnel endpoint information on the control plane. The specific implementation process is as follows: S1.1 New Node Registration Request: When a new node wants to join the computing power network, the new node first needs to send a registration request to the control center. The registration request includes the node's identity, security authentication information, and public key. S1.2 Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response upon successful verification. The response contains relevant information about previously registered nodes in the computing power network. S1.3 Secure Tunnel Authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing power network; S1.4 Information Notification: After a new node successfully registers, the control center will notify all previously registered nodes in the computing power network of the new node's information. Then, perform the following operations: (1) Control plane connection and security authentication: Establish control plane connection between the control center and each node, and complete security authentication; (2) Automatic establishment of "virtual" secure tunnels: After the security authentication of the control plane is completed, the establishment of "virtual" secure tunnels between nodes will be completed automatically; (3) Business-level computing power routing announcement: Combined with business-level computing power routing announcement, each node will have business-level routing information and secure tunnel encapsulation function; S2. Select a routing protocol and announce service layer routing information, computing power information, and network information; Through routing protocols, nodes schedule computing power networks according to actual needs; S3. When the source node in the computing power network receives an uplink service message from the terminal, the source node adds tunnel encapsulation to the message according to the routing information of the overlay, adds comprehensive encryption and authentication security identification information to the encapsulation, and then sends it out. After receiving the tunnel-encapsulated message, the destination node performs a "rough" classification based on the tunnel source address and security identifier format, and verifies the security identifier information of messages that meet the preset security characteristics, so as to complete the authentication of both the tunnel and security dimensions. Once the message passes the security check, the destination node removes its tunnel encapsulation and routes the original service message to the computing power service for processing. When the downlink service of the computing power service arrives at the destination node: the destination node adds a new tunnel encapsulation to the downlink service and routes it to the designated node. Subsequently, when the designated node receives the message of this downlink service, it removes the tunnel encapsulation and forwards the service message to the terminal.

2. The zero-trust secure tunnel method for improving private network security according to claim 1, characterized in that, Choose a centralized routing protocol, a distributed routing protocol, policy-based routing, or local command-line configuration to announce service-layer routing information, computing power information, and network information, including: Centralized routing protocols include two types: PCE and NETCONF. PCE is used to transmit path calculation requests and responses, while NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management. Distributed routing protocols include BGP and IGP. BGP is a border gateway protocol used for exchanging routing information between autonomous systems. IGP includes OSPF and ISIS, used for exchanging routing information within an autonomous system. Policy-based routing makes routing decisions based on user-defined policies, allowing for flexible control over the direction of data packets. Local command-line configuration can be performed directly on the network device through the command-line interface.

3. The zero-trust secure tunnel method for improving private network security according to claim 1, characterized in that, Execute step S3, and depending on the different security requirements, perform security authentication of the message using either strict mode or loose mode, wherein: In strict mode, security authentication is performed packet by packet. During this process, the network device performs independent security authentication on each received packet. In loose mode, flow tables are established. The network device first performs strict security authentication on the first packet of the data flow. Once the first packet is authenticated, subsequent packets will be randomly checked based on the established flow tables. If unqualified packets are found during the random check, a predetermined policy will be executed.

4. A zero-trust secure computing tunnel system for enhancing private network security, characterized in that, It includes: The control center receives registration requests from each tunnel endpoint and performs tunnel endpoint information authentication on the control plane. This process specifically includes the following implementation steps: New node registration request: When a new node wants to join the computing power network, the new node first needs to send a registration request to the control center. The registration request contains the node's identity, security authentication information and public key. Registration Response: After receiving the registration request, the control center first verifies the node identity and security authentication information of the new node, and prepares a response upon successful verification. The response contains relevant information about previously registered nodes in the computing power network. Secure tunnel authentication: Using the response information provided by the control center, the new node establishes a "virtual" secure tunnel with the previously registered nodes in the computing power network; Information notification: After a new node successfully registers, the control center will notify all previously registered nodes in the computing power network of the new node's information; Subsequently, the control center establishes control plane connections with each node and completes security authentication; After security authentication is completed, a "virtual" secure tunnel can be automatically established between nodes; combined with the computing power routing announcement at the business level, each node will have business-level routing information and secure tunnel encapsulation capabilities. The announcement module is used to select a routing protocol and announce business layer routing information, computing power information, and network information. It is also used to assist nodes in scheduling computing power and the network according to actual needs based on the selected routing protocol. The network scheduling module is used to assist nodes in scheduling the computing power network according to actual needs based on the selected routing protocol; The message processing module is used to add tunnel encapsulation to the message based on the routing information of the overlay when the source node in the computing power network receives the uplink service message from the terminal, and add comprehensive encryption and authentication security identification information to the encapsulation before sending it out. The classification and verification module is used to perform a "rough" classification based on the tunnel source address and security identifier format after the destination node receives the tunnel-encapsulated message, and to verify the security identifier information of the message that meets the preset security characteristics, so as to complete the authentication of both the tunnel and security dimensions. The encapsulation removal module is used to remove the tunnel encapsulation from the message after the message passes the security check, and to route the original business message to the computing power service for processing. The routing processing module is used to route the original service packets to the corresponding computing power service, add new tunnel encapsulation for the downlink service when the downlink service arrives, and route it to the specified node. The removal forwarding module is used to remove tunnel encapsulation when a downlink service packet is received at a specified node, and then forward the service packet to the terminal.

5. A zero-trust secure computing power tunnel system for enhancing private network security according to claim 4, characterized in that, The selection and announcement module selects a centralized routing protocol, a distributed routing protocol, policy-based routing, or a local command-line configuration to announce service-layer routing information, computing power information, and network information, wherein: Centralized routing protocols include two types: PCEP and NETCONF. PCEP is used to transmit path calculation requests and responses, while NETCONF provides a mechanism to install, delete, modify, and query data for device configuration and management. Distributed routing protocols include BGP and IGP. BGP is a border gateway protocol used for exchanging routing information between autonomous systems. IGP includes OSPF and ISIS, used for exchanging routing information within an autonomous system. Policy-based routing makes routing decisions based on user-defined policies, allowing for flexible control over the direction of data packets. Local command-line configuration can be performed directly on the network device through the command-line interface.

6. A zero-trust secure computing power tunnel system for enhancing private network security according to claim 4, characterized in that, The classification and verification module employs either a strict mode or a loose mode for message security authentication based on different security requirements, wherein: In strict mode, security authentication is performed packet by packet. During this process, the network device performs independent security authentication on each received packet. In loose mode, flow tables are established. The network device first performs strict security authentication on the first packet of the data flow. Once the first packet is authenticated, subsequent packets will be randomly checked based on the established flow tables. If unqualified packets are found during the random check, a predetermined policy will be executed.

Images