Quantum security gateway device, data transmission system and method

Abstract

The invention discloses a quantum security gateway device and a data transmission system and method.The gateway device comprises an intranet area, an isolation area and an extranet area, and the intranet area is used for receiving data sent by a switch connected with the gateway device and distributing the received data of an opposite-end gateway to the switch connected with the gateway device; the isolation area is used for separating the internal network area and the external network area, interacting data of the internal network area with data of the external network area, and filtering other data except the external network area; and the external network area is used for communication between the gateway equipment and external opposite-end gateway equipment. According to the gateway equipment provided by the invention, all data needing to be transmitted outwards are aggregated by using the data aggregation unit, and the data types of ciphertext data and plaintext data are not distinguished; therefore, the deployed network topology structure does not need to be changed, the deployment difficulty in practical application is reduced, the existing network deployment is slightly changed, and the cost is saved.

Description

Technical Field

[0001] The present application relates to the field of data transmission technology, and in particular to a quantum secure gateway device, data transmission system and method. Background Art

[0002] With the continuous development and progress of informatization, digitization and networking, more and more computer terminals are involved in the circulation of network data, and there is a chance that data will be stolen during transmission. In particular, sometimes the information transmitted is in plain text, which is not only easy to be stolen, but also easy to be seen by unauthorized personnel; therefore, data security and confidentiality transmission have become important concerns, and the need for encrypted data transmission has emerged.

[0003] Using a global quantum security device proposed in the patent "A global quantum security device and system" with application number 2022109259497, the effect of encrypting data in the device can be achieved. However, if this encryption method is used, it is necessary to use the device proposed in this application to replace the original computer terminal device without encryption function, and the cost of transformation is too high. For a local transmission network, it may even be the case that some terminal devices are computer terminal devices without encryption function, and other terminal devices are computer terminal devices with encryption function. However, from the perspective of data transmission security, no matter what type of computer terminal the data is sent from, it should be encrypted when it enters the Internet for transmission.

[0004] In view of this, how to securely encrypt data sent from the original computer terminal device without encryption function without replacing the computer terminal device to ensure the security of data transmission is a technical problem that urgently needs to be solved. Summary of the invention

[0005] Purpose of the invention: In order to solve the relevant technical problems raised in the background technology, the present invention provides a quantum-safe gateway device, a data transmission system and a method, which adopt a full-packet encryption method, so that when the data is transmitted to the other end, the other end can completely receive the original data format content, and the other end is unaware of the encryption operation performed by the gateway device on the data, thereby achieving the effect of imperceptible transmission; at the same time, the security of data transmission is ensured.

[0006] Technical solution: The present invention provides a quantum-safe gateway device, which includes an intranet area, an isolation area and an extranet area. The intranet area is used to receive data sent by a switch connected to the gateway device, and to distribute the received data from the opposite gateway to the switch connected to the gateway device; the isolation area is used to separate the intranet area and the extranet area, and to interact the data in the intranet area with the data in the extranet area, and to filter out other data except the extranet area; the extranet area is used for the gateway device to communicate with an external opposite gateway device.

[0007] Further, the intranet area includes a data aggregation unit, a first data transmission unit, a first encryption and decryption unit, a ciphertext receiving unit, a first key relay unit, a key storage unit and a key generation unit, the data aggregation unit is connected to the first data transmission unit, the first data transmission unit is respectively connected to the first encryption and decryption unit, the ciphertext receiving unit, the first key relay unit and the key storage unit, and the key storage unit is also connected to the key generation unit;

[0008] The data aggregation unit is used to receive data sent by the switch connected to the gateway device, and distribute the data received from the first data transmission unit to the switch connected to the gateway device;

[0009] The first data transmission unit is used to receive data sent from a unit connected thereto, and to send data to a unit connected thereto;

[0010] The first encryption and decryption unit has a built-in encryption and decryption algorithm for performing encryption or decryption operations on data;

[0011] The ciphertext receiving unit is used to receive the data encrypted by the first encryption and decryption unit, and to perform data exchange with the ciphertext processing unit in the external network area;

[0012] The first key relay unit is used to obtain and send a key index, and to perform data exchange with a second key relay unit in the external network area;

[0013] The key storage unit is used to store a key file that is symmetrical to the key file in the peer gateway;

[0014] The key generation unit is used to generate a key for encrypting data.

[0015] Furthermore, the connection interface between the data aggregation unit and the gateway device connected to the switch is a network card or operating system level interface.

[0016] Further, the isolation area includes an FPGA, and the FPGA is used to interact the data in the internal network area with the data in the external network area, and filter other data outside the external network area;

[0017] The external network area includes a ciphertext processing unit, a second key relay unit, a key transmission unit and a second data transmission unit, the second data transmission unit is connected to the ciphertext processing unit, the second key relay unit and the key transmission unit respectively, the ciphertext processing unit is connected to the ciphertext receiving unit through the FPGA, the second key relay unit is connected to the first key relay unit through the FPGA, the key transmission unit is connected to the key storage unit through the FPGA, and the key transmission unit is also connected to the key generation unit through the FPGA;

[0018] The ciphertext processing unit is used to correspond the ciphertext to be sent with the gateway IP of the opposite end and transmit it to the second data transmission unit, and receive the ciphertext sent by the gateway of the opposite end and transmit it to the ciphertext receiving unit;

[0019] The second key relay unit is used to receive the key index sent by the first key relay unit and transmit it to the second data transmission unit; and receive the key index sent by the peer gateway from the second data transmission unit and transmit it to the first key relay unit;

[0020] The key transmission unit is used to synchronize the key file issued by the key center to the key storage unit, and transmit the key file generated by the key generation unit to the second data transmission unit to send to the peer gateway;

[0021] The second data transmission unit is used to receive data sent from a unit connected thereto and to send data to a unit connected thereto.

[0022] The present invention also includes a quantum-secure data transmission system, the system comprising a sender gateway and a receiver gateway connected in pairs, the sender gateway and the receiver gateway being gateway devices as described in any one of the above claims;

[0023] The sender gateway is connected to at least one sender-side switch, and the receiver gateway is connected to at least one receiver-side switch.

[0024] The present invention also includes a method based on a quantum-secure data transmission system as claimed in the above claims, comprising the following steps:

[0025] (1) The sender gateway and the receiver gateway perform network authentication. After the authentication is passed, the sender gateway and the receiver gateway respectively store the symmetric key file and the access address of the peer gateway;

[0026] (2) The sending gateway aggregates the first data sent by at least one switch on the sending side, and encrypts the first data using the first encryption key to obtain first ciphertext data;

[0027] (3) The sending gateway uses the second encryption key to perform an encryption operation on the first encryption key to obtain second ciphertext data; then the first ciphertext data, the second ciphertext data, and the key index of the second encryption key are sent to the receiving gateway;

[0028] (4) The receiving gateway decrypts the received data to obtain the first data, and distributes the first data to each computer terminal on the receiving side according to the receiving party information in the first data.

[0029] Furthermore, the sending gateway and the receiving gateway respectively storing the symmetric key files means:

[0030] The key storage unit of the intranet area of ​​the sender gateway and the receiver gateway obtains a symmetric key file from a key center independent of the gateway device via the key transmission unit and the second data transmission unit in the external network area; or, the key generation unit in the intranet area of ​​the sender gateway generates a key file, transmits the key file to the key storage unit for storage, and transmits the key file to the receiver gateway via the key transmission unit and the second data transmission unit in the external network area, and then transmits the key file to the key storage unit in the intranet area of ​​the receiver gateway via the second data transmission unit and the key transmission unit in the external network area of ​​the receiver gateway for storage; or, the receiver gateway generates a key file in the same way as the sender gateway and sends it to the sender gateway for storage.

[0031] Furthermore, in step (2), the first data is encrypted using the first encryption key to obtain the first ciphertext data in the following specific process:

[0032] 1) After receiving the first data data, the data aggregation unit in the intranet area of ​​the sender gateway adds a data header structure to the first data data to form second data; the fields in the data header structure include the data type and data length of the first data;

[0033] 2) The data aggregation unit sends the second data to the first encryption and decryption unit in the intranet area via the first data transmission unit in the intranet area using a socket, and the first encryption and decryption unit parses the first data data from the received second data, and parses the information of the first data from the data header structure of the second data;

[0034] 3) The first encryption and decryption unit applies for the first encryption key K1 from the key storage unit in the intranet area via the first data transmission unit according to the data length in the information of the parsed first data. The key storage unit calls the first encryption key K1 generated in real time by the key generation unit in the intranet area based on the application, and feeds back the obtained first encryption key K1 to the first encryption and decryption unit via the first data transmission unit;

[0035] 4) The first encryption / decryption unit uses the first encryption key K1 to perform an encryption operation on the first data data to obtain the first ciphertext data DATA1.

[0036] Furthermore, the first data data is one or both of plaintext data and ciphertext data.

[0037] Furthermore, the sending gateway uses the second encryption key to perform an encryption operation on the first encryption key to obtain the second ciphertext data:

[0038] The first encryption and decryption unit requests the second encryption key K2 from the key storage unit. The key storage unit responds to the request, extracts the second encryption key K2 from the locally stored key file, and feeds the second encryption key K2 back to the first encryption and decryption unit via the first data transmission unit. The first encryption and decryption unit uses the second encryption key K2 to encrypt the first encryption key K1 to obtain the second ciphertext data DATA2. At the same time, the key storage unit sends the key index index2 of the second encryption key K2 to the first key relay unit in the intranet area via the first data transmission unit.

[0039] Furthermore, the specific process of then sending the first ciphertext data, the second ciphertext data and the key index of the second encryption key to the receiving gateway is:

[0040] A: The first encryption and decryption unit sends the first ciphertext data DATA1 and the second ciphertext data DATA2 to the ciphertext receiving unit in the internal network area via the first data transmission unit, and then the ciphertext receiving unit sends the ciphertext data to the ciphertext processing unit in the external network area; the ciphertext processing unit is configured with the access address of the receiving party's gateway, and based on the access address of the receiving party's gateway, sends the first ciphertext data DATA1 and the second ciphertext data DATA2 to the second data transmission unit in the external network area of ​​the receiving party's gateway via the second data transmission unit in the external network area;

[0041] B: The second data transmission unit of the sending gateway obtains the access address of the receiving gateway during the process of sending the first ciphertext data DATA1 and the second ciphertext data DATA2;

[0042] C: The first key relay unit sends the key index index2 of the second encryption key K2 to the second data transmission unit through the second key relay unit in the external network area. The second data transmission unit sends the key index index2 to the second data transmission unit in the external network area of ​​the receiving gateway based on the access address of the receiving gateway.

[0043] Furthermore, the specific process of the receiving gateway decrypting the received data to obtain the first data is:

[0044] a: The second data transmission unit of the receiving gateway sends the received first ciphertext data DATA1 and the second ciphertext data DATA2 to the ciphertext receiving unit of the intranet area through the ciphertext processing unit, and the ciphertext receiving unit sends the received first ciphertext data DATA1 and the second ciphertext data DATA2 to the first encryption and decryption unit of the intranet area through the first data transmission unit;

[0045] b: The second data transmission unit sends the key index index2 to the first key relay unit in the intranet area through the second key relay unit, and the first key relay unit sends the received key index index2 to the key storage unit in the intranet area via the first data transmission unit;

[0046] c: The key storage unit obtains the second decryption key K2' from the stored key file according to the key index index2, and sends the second decryption key K2' to the first encryption and decryption unit in the intranet area via the first data transmission unit;

[0047] d: The first encryption / decryption unit uses the second decryption key K2' to decrypt the second ciphertext DATA2 to obtain the first decryption key K1'; and then uses the first decryption key K1' to decrypt the first ciphertext DATA1 to obtain the first data data.

[0048] Beneficial effects of the present invention:

[0049] (1) Currently, routers (or switches) are often used directly as gateways in the market, and different routers are required for data forwarding for different data types. The gateway device proposed in the present invention uses a data aggregation unit to aggregate all data that needs to be transmitted externally, without distinguishing between ciphertext data and plaintext data types; therefore, the network topology structure that has been deployed does not need to be changed, and only the output ports of all routers (or switches) that originally served as gateways need to be connected to the gateway device proposed in the present invention. The deployment is simple, which reduces the deployment difficulty in actual applications, and requires little change to the existing network deployment, saving costs;

[0050] (2) The data sent by the gateway device proposed in the present invention adopts a full-packet encryption method, so when the data is transmitted to the other end, the other end can completely receive the original data format content. The other end is unaware of the encryption operation performed on the data by the gateway device, thereby achieving the effect of imperceptible transmission; at the same time, the security of data transmission is ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0052] Figure 1 A schematic diagram of a connection between a computer terminal and a network in the prior art;

[0053] Figure 2 A schematic diagram of the connection position of the gateway device of the present invention in the network;

[0054] Figure 3 It is a schematic diagram of the structure of the gateway device of the present invention;

[0055] Figure 4 It is a structural schematic diagram of the data transmission system of the present invention;

[0056] Figure 5 A schematic diagram of a flow chart of a data transmission method of the present invention;

[0057] Figure 6 The diagram is a schematic diagram of message format changes during transmission of plaintext data within a sender's gateway according to the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0059] As described in the background technology, for a local transmission network, it is even possible that some terminal devices are computer terminal devices without encryption functions, while other terminal devices are computer terminal devices with encryption functions. For such terminal deployment scenarios, different transmission paths are often set to transmit data sent by different types of computer terminals via different data transmission links.

[0060] like Figure 1As shown, in some local area networks including multiple computer terminal devices, the multiple computer terminals include an ordinary computer cluster composed of ordinary computer terminals without encryption function and a quantum security privacy computer cluster composed of quantum security privacy computers with encryption function. The data sent by the ordinary computer is plain text, which is sent to the Internet via the data transmission link where the first switch is located. The data sent by the quantum security privacy computer is ciphertext, which is sent to the Internet via the data transmission link where the second switch is located. In such a data transmission system, the plaintext data sent by the ordinary computer is easily stolen, threatening data security.

[0061] In view of this, without replacing the computer terminal equipment, the present invention proposes a quantum-safe gateway device, which can be used after the switch, receives data from at least one switch for encryption, and transmits the encrypted data to the Internet. The connection position of the gateway device in the network is as follows: Figure 2 As shown, the gateway device is connected to at least one switch, such as a first switch and a second switch, receives data from at least one switch, processes the data, and then sends it to the Internet, specifically, it can be sent to another gateway device in the Internet.

[0062] The gateway device proposed by the present invention is as follows Figure 3 As shown, the gateway device includes an intranet area 1, an isolation area 2 and an external network area 3, wherein the intranet area 1 is used to receive data sent by a switch connected to the gateway device, and to distribute the received data from the opposite gateway to the switch connected to the gateway device; the isolation area 2 is used to separate the intranet area 1 and the external network area 3, and to interact the data of the intranet area 1 with the data of the external network area 3, and to filter other data except the external network area 3, so as to avoid other devices on the Internet directly accessing the devices connected to the intranet area 1 via the gateway device; the external network area 3 is used for the gateway device to communicate with the external opposite gateway device.

[0063] The intranet zone 1 includes a data aggregation unit 11, a first data transmission unit 12, a first encryption and decryption unit 13, a ciphertext receiving unit 14, a first key relay unit 15, a key storage unit 16 and a key generation unit 17. The data aggregation unit 11 is connected to the first data transmission unit 12, the first data transmission unit 12 is respectively connected to the first encryption and decryption unit 13, the ciphertext receiving unit 14, the first key relay unit 15 and the key storage unit 16, and the key storage unit 16 is also connected to the key generation unit 17;

[0064] The data aggregation unit 11 is used to receive data sent by the switch connected to the present gateway device, and to distribute the data received from the first data transmission unit 12 to the switch connected to the present gateway device; that is, the data aggregation unit 11 is used to receive data sent by at least one switch on the sending side, and to distribute the data received from the first data transmission unit 12 to at least one switch on the sending side. The connection interface between the data aggregation unit 11 and the switch connected to the present gateway device is an interface at the network card or operating system level, and cannot be an interface at the application level. The first data transmission unit 12 is configured as a data transfer unit within the intranet area 1, and is used to receive data sent from a unit connected to it, and to send data to a unit connected to it; the first encryption and decryption unit 13 has a built-in encryption and decryption algorithm, such as a one-time XOR algorithm, which is used to perform encryption or decryption operations on data; the ciphertext receiving unit 14 is used to receive data encrypted by the first encryption and decryption unit 13, and to interact with the ciphertext processing unit 31 of the external network area 3; the first key relay unit 15 is used to obtain and send a key index, and the first key relay unit 15 corresponds to the second key relay unit 32 of the external network area 3 to interact with data; the key storage unit 16 is used to store a key file that is symmetrical to the key file in the peer gateway; the key generation unit 17 is used to generate a key for data encryption.

[0065] Currently, routers (or switches) are often used directly as gateways in the market, and different routers are required for data forwarding for different data types. The present invention uses a data aggregation unit 11 to aggregate all data that need to be transmitted externally, without distinguishing between encrypted data and plain text data; therefore, the network topology structure that has been deployed does not need to be changed, and it is only necessary to connect the output ports of all routers (or switches) that originally acted as gateways to the gateway device proposed in the present invention, which is simple to deploy and reduces the difficulty of deployment in practical applications.

[0066] The external network area 3 includes a ciphertext processing unit 31, a second key relay unit 32, a key transmission unit 33, and a second data transmission unit 34. The second data transmission unit 34 is connected to the ciphertext processing unit 31, the second key relay unit 32, and the key transmission unit 33 respectively. The ciphertext processing unit 31 is connected to the ciphertext receiving unit 14 via the FPGA, the second key relay unit 32 is connected to the first key relay unit 15 via the FPGA, the key transmission unit 33 is connected to the key storage unit 16 via the FPGA, and the key transmission unit 33 is also connected to the key generation unit 17 via the FPGA.

[0067] The ciphertext processing unit 31 is used to match the ciphertext to be sent with the gateway IP of the other end and transmit it to the second data transmission unit 34, so that the second data transmission unit 34 can address the other end according to the gateway IP of the other end to realize the sending of the ciphertext, and receive the ciphertext sent by the gateway of the other end and transmit it to the ciphertext receiving unit 14; the second key relay unit 32 is used to receive the key index sent by the first key relay unit 15 and transmit it to the second data transmission unit 34; and receive the key index sent by the gateway of the other end from the second data transmission unit 34 and transmit it to the first key relay unit 15; the key transmission unit 33 corresponds to the key generation unit 17 and the key storage unit 16, and is used to synchronize the key file issued by the key center to the key storage unit 16, and transmit the key file generated by the key generation unit 17 to the second data transmission unit 34 and send it to the gateway of the other end; the second data transmission unit 34 is configured as a data transfer unit in the external network area 3, and is used to receive data sent from the unit connected to it and send data to the unit connected to it, including sending ciphertext and key to the gateway of the other end.

[0068] The isolation area 2 includes FPGA 21 (Field Programmable Gate Array), which is used to interact the data of the internal network area 1 with the data of the external network area 3, and filter other data outside the external network area 3; the FPGA 21 connects the internal network area 1 and the external network area 3. Specifically, the FPGA 21 makes a data mark for the data transmitted in the gateway when the internal and external network areas are started. This mark is generated by the internal and external network area processes at each startup, which is equivalent to dynamic, and the FPGA 21 does not support the system response of the network protocol stack; that is, when the processes of the internal and external network areas of the gateway are not running, the external data cannot obtain the data mark, and it cannot be recognized by the FPGA, which cuts off the communication between the internal and external network areas. Therefore, the isolation area 2 has the ability of hardware isolation.

[0069] For ease of description, the present invention refers to the gateway connected to the switch on the data sending side as the sending gateway, and the gateway connected to the switch on the data receiving side as the receiving gateway. Figure 4 As shown, the sender gateway is connected to the receiver gateway to form a quantum secure data transmission system; that is, the system includes a sender gateway and a receiver gateway connected in pairs, and the sender gateway and the receiver gateway are both the gateway devices mentioned above;

[0070] The sender gateway is connected to at least one sender switch, such as sender switch 1 and sender switch 2; the receiver gateway is connected to at least one receiver switch, such as receiver switch 1 and receiver switch 2.

[0071] The present invention also proposes a data transmission method based on the above data transmission system, such as Figure 5 As shown, the following steps are included:

[0072] (1) The sender gateway and the receiver gateway perform network authentication. After the authentication is passed, the sender gateway and the receiver gateway respectively store the symmetric key file and the access address of the peer gateway;

[0073] Specifically, storing a symmetric key file means that: the key storage unit 16 of the intranet area 1 of the sender gateway and the receiver gateway obtains the symmetric key file from a key center independent of the gateway device via the key transmission unit 33 and the second data transmission unit 34 of the external network area 3; or, the key generation unit 17 of the intranet area 1 of the sender gateway generates a key file, transmits the key file to the key storage unit 16 for storage, and transmits the key file to the receiver gateway via the key transmission unit 33 and the second data transmission unit 34 of the external network area 3, and then transmits the key file to the key storage unit 16 of the intranet area 1 of the receiver gateway via the second data transmission unit 34 and the key transmission unit 33 of the external network area 3 of the receiver gateway for storage; or, the receiver gateway generates a key file in the same way as the sender gateway and sends it to the sender gateway for storage, that is, the receiver gateway can also generate a key file and send it to the sender gateway for storage.

[0074] The access address of the peer gateway is stored in the ciphertext processing unit 31 of the external network area 3. The access address may be, for example, the IP address of the peer gateway.

[0075] (2) The sending gateway aggregation server receives first data data sent by at least one switch on the sending side, where the first data data is one or both of plaintext data and ciphertext data. In this embodiment, the first data includes, for example, plaintext data in a common computer cluster sent by the sending side switch 1 and ciphertext data in a quantum security privacy computer cluster sent by the sending side switch 2. The first data is encrypted using a first encryption key to obtain first ciphertext data. The specific process is as follows:

[0076] 1) After receiving the first data data, the data aggregation unit 11 of the intranet zone 1 of the sender gateway adds a data header structure to the first data data to form second data; the fields in the data header structure include but are not limited to the data type and data length of the first data and other data information;

[0077] 2) The data aggregation unit 11 sends the second data to the first encryption and decryption unit 13 of the intranet zone 1 via the first data transmission unit 12 of the intranet zone 1 using a socket. The first encryption and decryption unit 13 parses the first data data from the received second data, and parses the information of the first data from the data header structure of the second data;

[0078] 3) The first encryption and decryption unit 13 applies for the first encryption key K1 from the key storage unit 16 of the intranet zone 1 via the first data transmission unit 12 according to the data length in the information of the parsed first data. The key storage unit 16 calls the first encryption key K1 generated in real time by the key generation unit 17 of the intranet zone 1 based on the application, and feeds back the obtained first encryption key K1 to the first encryption and decryption unit 13 via the first data transmission unit 12;

[0079] 4) The first encryption and decryption unit 13 uses the first encryption key K1 to perform an encryption operation on the first data data to obtain the first ciphertext data DATA1. It can be seen that the data aggregation unit 11 sends the first data to the first encryption and decryption unit 13 via the first data transmission unit 12 for encryption operation to obtain the first ciphertext data DATA1. The encryption key in this step is generated in real time by the key generation unit 17 and sent to the first encryption and decryption unit 13 via the key storage unit 16 and the first data transmission unit 12. The encryption key is recorded as the first encryption key K1.

[0080] Among them, the first data data has a complete data structure, for example, including the IP address of the sending computer (the sending computer refers to the computer that sends the data data), the IP address of the receiving computer, the transmission protocol, the load content, etc., and does not change the data structure of the data sent by the sending side switch.

[0081] Here, the message format of the first data data changes during the transmission process as follows: Figure 6 The encryption operation is to encrypt the entire first data data, rather than just encrypting the payload content in the data.

[0082] (3) The sending gateway uses the second encryption key to perform an encryption operation on the first encryption key to obtain second ciphertext data; then the first ciphertext data, the second ciphertext data, and the key index of the second encryption key are sent to the receiving gateway;

[0083] Among them, performing an encryption operation to obtain the second ciphertext data means: the first encryption and decryption unit 13 requests the second encryption key K2 from the key storage unit 16, the key storage unit 16 responds to the request, extracts the second encryption key K2 from the locally stored key file, and feeds the second encryption key K2 back to the first encryption and decryption unit 13 via the first data transmission unit 12, the first encryption and decryption unit 13 uses the second encryption key K2 to encrypt the first encryption key K1 to obtain the second ciphertext data DATA2; at the same time, the key storage unit 16 sends the key index index2 of the second encryption key K2 to the first key relay unit 15 in the intranet area 1 via the first data transmission unit 12.

[0084] Then the specific process of the sending gateway sending the first ciphertext data DATA1, the second ciphertext data DATA2 and the key index index2 of the second encryption key to the receiving gateway is:

[0085] A: The first encryption and decryption unit 13 sends the first ciphertext data DATA1 and the second ciphertext data DATA2 to the ciphertext receiving unit 14 of the internal network area 1 via the first data transmission unit 12, and then the ciphertext receiving unit 14 sends the ciphertext processing unit 31 of the external network area 3; the ciphertext processing unit 31 is configured with the access address of the receiving party's gateway, and based on the access address of the receiving party's gateway, the ciphertext processing unit 31 sends the first ciphertext data DATA1 and the second ciphertext data DATA2 to the second data transmission unit 34 of the external network area 3 in the receiving party's gateway via the second data transmission unit 34 of the external network area 3;

[0086] B: The second data transmission unit 34 of the sending gateway obtains the access address of the receiving gateway during the process of sending the first ciphertext data DATA1 and the second ciphertext data DATA2;

[0087] C: The first key relay unit 15 sends the key index index2 of the second encryption key K2 to the second data transmission unit 34 through the second key relay unit 32 of the external network area 3. The second data transmission unit 34 sends the key index index2 to the second data transmission unit 34 of the external network area 3 in the receiving gateway based on the access address of the receiving gateway.

[0088] (4) The receiving gateway decrypts the received data to obtain the first data, and distributes the first data to each computer terminal on the receiving side according to the receiving party information in the first data. The specific process is as follows:

[0089] a: The second data transmission unit 34 of the receiving gateway sends the received first ciphertext data DATA1 and the second ciphertext data DATA2 to the ciphertext receiving unit 14 of the intranet zone 1 through the ciphertext processing unit 31, and the ciphertext receiving unit 14 sends the received first ciphertext data DATA1 and the second ciphertext data DATA2 to the first encryption and decryption unit 13 of the intranet zone 1 through the first data transmission unit 12;

[0090] b: The second data transmission unit 34 sends the key index index2 to the first key relay unit 15 of the intranet zone 1 via the second key relay unit 32, and the first key relay unit 15 sends the received key index index2 to the key storage unit 16 of the intranet zone 1 via the first data transmission unit 12;

[0091] c: The key storage unit 16 obtains the second decryption key K2' from the stored key file according to the key index index2, and sends the second decryption key K2' to the first encryption and decryption unit 13 of the intranet zone 1 via the first data transmission unit 12;

[0092] d: The first encryption / decryption unit 13 uses the second decryption key K2' to decrypt the second ciphertext DATA2 to obtain the first decryption key K1'; and then uses the first decryption key K1' to decrypt the first ciphertext DATA1 to obtain the first data data.

[0093] Then, the first encryption and decryption unit 13 sends the decrypted first data data to the data aggregation unit 11 via the first data transmission unit 12, and the data aggregation unit 11 distributes the data to each computer terminal on the receiving side according to the recipient information in the first data data.

[0094] For the first ciphertext DATA1, the present invention adopts a full-packet encryption method, so the data format of the first data data obtained after decryption is the same as the data format sent by the sending computer, and the encryption processing of the data by the gateway does not cause any impact on the data format of the first data data; therefore, when the receiving computer terminal on the receiving side receives the first data data, it will not have any perception of the processing of the gateway, and truly achieves senseless transmission; at the same time, the security of data transmission is ensured.

Claims

1. A quantum-safe gateway device, characterized in that: The gateway device includes an intranet area, an isolation area and an extranet area. The intranet area is used to receive data sent by a switch connected to the gateway device, and distribute the received data from the opposite gateway to the switch connected to the gateway device; the isolation area is used to separate the intranet area and the extranet area, and to interact the data in the intranet area with the data in the extranet area, and filter out other data except the extranet area; the extranet area is used for the gateway device to communicate with an external opposite gateway device.

2. A quantum-safe gateway device according to claim 1, characterized in that: The intranet area includes a data aggregation unit, a first data transmission unit, a first encryption and decryption unit, a ciphertext receiving unit, a first key relay unit, a key storage unit and a key generation unit, wherein the data aggregation unit is connected to the first data transmission unit, the first data transmission unit is respectively connected to the first encryption and decryption unit, the ciphertext receiving unit, the first key relay unit and the key storage unit, and the key storage unit is also connected to the key generation unit; The data aggregation unit is used to receive data sent by the switch connected to the gateway device, and distribute the data received from the first data transmission unit to the switch connected to the gateway device; The first data transmission unit is used to receive data sent from a unit connected thereto, and to send data to a unit connected thereto; The first encryption and decryption unit has a built-in encryption and decryption algorithm for performing encryption or decryption operations on data; The ciphertext receiving unit is used to receive the data encrypted by the first encryption and decryption unit, and to perform data exchange with the ciphertext processing unit in the external network area; The first key relay unit is used to obtain and send a key index, and to perform data exchange with a second key relay unit in the external network area; The key storage unit is used to store a key file that is symmetrical to the key file in the peer gateway; The key generation unit is used to generate a key for encrypting data.

3. A quantum-safe gateway device according to claim 2, characterized in that: The connection interface between the data aggregation unit and the gateway device connected to the switch is a network card or operating system level interface.

4. A quantum-safe gateway device according to claim 1, characterized in that: The isolation area includes an FPGA, and the FPGA is used to interact the data of the internal network area with the data of the external network area and filter other data outside the external network area; The external network area includes a ciphertext processing unit, a second key relay unit, a key transmission unit and a second data transmission unit, the second data transmission unit is connected to the ciphertext processing unit, the second key relay unit and the key transmission unit respectively, the ciphertext processing unit is connected to the ciphertext receiving unit through the FPGA, the second key relay unit is connected to the first key relay unit through the FPGA, the key transmission unit is connected to the key storage unit through the FPGA, and the key transmission unit is also connected to the key generation unit through the FPGA; The ciphertext processing unit is used to correspond the ciphertext to be sent with the gateway IP of the opposite end and transmit it to the second data transmission unit, and receive the ciphertext sent by the gateway of the opposite end and transmit it to the ciphertext receiving unit; The second key relay unit is used to receive the key index sent by the first key relay unit and transmit it to the second data transmission unit; and receive the key index sent by the peer gateway from the second data transmission unit and transmit it to the first key relay unit; The key transmission unit is used to synchronize the key file issued by the key center to the key storage unit, and transmit the key file generated by the key generation unit to the second data transmission unit to send to the peer gateway; The second data transmission unit is used to receive data sent from a unit connected thereto and to send data to a unit connected thereto.

5. A quantum-secure data transmission system, characterized in that: The system comprises a sender gateway and a receiver gateway connected in pairs, wherein the sender gateway and the receiver gateway are both gateway devices according to any one of claims 1 to 4; The sender gateway is connected to at least one sender-side switch, and the receiver gateway is connected to at least one receiver-side switch.

6. A method based on the quantum secure data transmission system of claim 5, characterized in that: The following steps are involved: (1) The sender gateway and the receiver gateway perform network authentication. After the authentication is passed, the sender gateway and the receiver gateway respectively store the symmetric key file and the access address of the peer gateway; (2) The sending gateway aggregates the first data sent by at least one switch on the sending side, and encrypts the first data using a first encryption key to obtain first ciphertext data; (3) The sending gateway then uses the second encryption key to perform an encryption operation on the first encryption key to obtain second ciphertext data; Then the first ciphertext data, the second ciphertext data and the key index of the second encryption key are sent to the receiving gateway; (4) The receiving gateway decrypts the received data to obtain the first data, and distributes the first data to each computer terminal on the receiving side according to the receiving party information in the first data.

7. The method according to claim 6, characterized in that The sending gateway and the receiving gateway store symmetric key files respectively, which means: The key storage unit of the intranet area of ​​the sender gateway and the receiver gateway obtains a symmetric key file from a key center independent of the gateway device via the key transmission unit and the second data transmission unit in the external network area; or, the key generation unit in the intranet area of ​​the sender gateway generates a key file, transmits the key file to the key storage unit for storage, and transmits the key file to the receiver gateway via the key transmission unit and the second data transmission unit in the external network area, and then transmits the key file to the key storage unit in the intranet area of ​​the receiver gateway via the second data transmission unit and the key transmission unit in the external network area of ​​the receiver gateway for storage; or, the receiver gateway generates a key file in the same way as the sender gateway and sends it to the sender gateway for storage.

8. The method according to claim 6, characterized in that In step (2), the first data is encrypted using the first encryption key to obtain the first ciphertext data in the following specific process: 1) After receiving the first data data, the data aggregation unit in the intranet area of ​​the sender gateway adds a data header structure to the first data data to form second data; the fields in the data header structure include the data type and data length of the first data; 2) The data aggregation unit sends the second data to the first encryption and decryption unit in the intranet area via the first data transmission unit in the intranet area using a socket, and the first encryption and decryption unit parses the first data data from the received second data, and parses the information of the first data from the data header structure of the second data; 3) The first encryption and decryption unit applies for the first encryption key K1 from the key storage unit in the intranet area via the first data transmission unit according to the data length in the information of the parsed first data. The key storage unit calls the first encryption key K1 generated in real time by the key generation unit in the intranet area based on the application, and feeds back the obtained first encryption key K1 to the first encryption and decryption unit via the first data transmission unit; 4) The first encryption / decryption unit uses the first encryption key K1 to perform an encryption operation on the first data data to obtain the first ciphertext data DATA1.

9. The method according to claim 8, characterized in that: The first data data is one or both of plaintext data and ciphertext data.

10. The method according to claim 8, characterized in that The sending gateway then uses the second encryption key to perform an encryption operation on the first encryption key to obtain the second ciphertext data: The first encryption and decryption unit requests the second encryption key K2 from the key storage unit. The key storage unit responds to the request, extracts the second encryption key K2 from the locally stored key file, and feeds the second encryption key K2 back to the first encryption and decryption unit via the first data transmission unit. The first encryption and decryption unit uses the second encryption key K2 to encrypt the first encryption key K1 to obtain the second ciphertext data DATA2. At the same time, the key storage unit sends the key index index2 of the second encryption key K2 to the first key relay unit in the intranet area via the first data transmission unit.

11. The method according to claim 10, characterized in that The specific process of then sending the first ciphertext data, the second ciphertext data and the key index of the second encryption key to the receiving gateway is: A: The first encryption and decryption unit sends the first ciphertext data DATA1 and the second ciphertext data DATA2 to the ciphertext receiving unit in the internal network area via the first data transmission unit, and then the ciphertext receiving unit sends the ciphertext data to the ciphertext processing unit in the external network area; the ciphertext processing unit is configured with the access address of the receiving party's gateway, and based on the access address of the receiving party's gateway, sends the first ciphertext data DATA1 and the second ciphertext data DATA2 to the second data transmission unit in the external network area of ​​the receiving party's gateway via the second data transmission unit in the external network area; B: The second data transmission unit of the sending gateway obtains the access address of the receiving gateway during the process of sending the first ciphertext data DATA1 and the second ciphertext data DATA2; C: The first key relay unit sends the key index index2 of the second encryption key K2 to the second data transmission unit through the second key relay unit in the external network area. The second data transmission unit sends the key index index2 to the second data transmission unit in the external network area of ​​the receiving gateway based on the access address of the receiving gateway.

12. The method according to claim 11, characterized in that The specific process of the receiving gateway decrypting the received data to obtain the first data is as follows: a: The second data transmission unit of the receiving gateway sends the received first ciphertext data DATA1 and the second ciphertext data DATA2 to the ciphertext receiving unit of the intranet area through the ciphertext processing unit, and the ciphertext receiving unit sends the received first ciphertext data DATA1 and the second ciphertext data DATA2 to the first encryption and decryption unit of the intranet area through the first data transmission unit; b: The second data transmission unit sends the key index index2 to the first key relay unit in the intranet area through the second key relay unit, and the first key relay unit sends the received key index index2 to the key storage unit in the intranet area via the first data transmission unit; c: The key storage unit obtains the second decryption key K2' from the stored key file according to the key index index2, and sends the second decryption key K2' to the first encryption and decryption unit in the intranet area via the first data transmission unit; d: The first encryption / decryption unit uses the second decryption key K2' to decrypt the second ciphertext DATA2 to obtain the first decryption key K1'; The first decryption key K1' is then used to decrypt the first ciphertext DATA1 to obtain the first data data.

Images