Method and apparatus for encrypted tunnel communication with path dynamic optimization

Abstract

The application provides a path dynamic optimization encrypted tunnel communication method and device, relates to the technical field of block chains, and can be applied to the financial field and other fields.The method comprises the following steps: obtaining an initial node and a target node according to data packet analysis to be sent;obtaining a shared communication path calculated by an ant colony algorithm through the initial node and the target node in a block chain network; providing a message sending message to a corresponding target node according to the communication path, and obtaining a verification feedback result of the message sending message generated by the target node by using a Diffie-Hellman algorithm; establishing a secure channel with the target node according to the verification feedback result, and providing the data packet to the target node through the secure channel.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of blockchain technology, which can be applied to the financial field and other fields, and in particular to a path dynamic optimization encrypted tunnel communication method and device. BACKGROUND

[0002] In a public network environment, in order to achieve secure communication and data transmission, two conditions need to be met: on the one hand, to avoid the risk of eavesdropping and interference by attackers, to establish a multi-party shared security area for users, and to protect the security of multi-party information communication; on the other hand, to quickly locate the target address and make the best path decision according to the real-time network environment. Therefore, the industry urgently needs to develop fast, efficient and secure multi-point secure communication technology. In recent years, dynamic decision of the optimal path has become a hot spot of industry attention and research.

[0003] Traditional secure communication technology generally uses an encrypted tunnel protocol to provide data encryption, verification, anti-replay and authentication verification, which better meets the security of end-to-end peer-to-peer communication. For example: WireGuard is an encrypted tunnel tool based on a transport layer protocol, which builds a virtual interface, supports defining interface public and private keys, routing rules, listening ports and other security parameters, and realizes secure peer-to-peer transmission from end to end. Compared with IPsec, open VPN and other protocols, WireGuard has greatly improved in convenience and versatility, such as supporting standard IP, udp and other protocols to set routing and interface rules. On this basis, the datagram encrypted by the tunnel protocol needs to be quickly found the optimal path from the source node to the target node, so as to realize the rapid communication of data. At present, the industry's datagram routing discovery can be adjusted and changed according to the data link topology structure and link state, which can be divided into static routing algorithm and dynamic routing algorithm. The former is manually set by network administrators, which is time-consuming and laborious, and cannot be dynamically adjusted according to real-time network monitoring. The latter dynamically adjusts routing information according to real-time network monitoring by algorithm, which can be divided into two categories: distance-vector routing algorithm and link-state routing algorithm. Compared with the distance-vector routing algorithm, the link-state routing algorithm has strong real-time performance and considers many factors (cost, bandwidth, response time, etc.), and has gradually become a hot research direction. SUMMARY

[0004] The application aims to provide a path dynamic optimization encrypted tunnel communication method and device, simulate ant colony algorithm to solve the "row merchant problem", introduce pheromone gain or loss, realize IP data packet path dynamic optimization algorithm on the basis of encrypted tunnel protocol, meanwhile, utilize the characteristics of block chain decentralization and multi-party sharing to provide public key basic data, routing information and other sharing service capabilities, realize the organic integration of ant colony algorithm and encrypted tunnel, thereby realizing secure communication and optimized routing in multi-party communication process, and ensuring fast, easy-to-use, safe and reliable multi-party communication.

[0005] To achieve the above purpose, the path dynamic optimization encrypted tunnel communication method provided by the application specifically comprises: obtaining initial nodes and target nodes according to data packet analysis of data to be sent, obtaining shared communication paths calculated by ant colony algorithm through the initial nodes and the target nodes in the block chain network; providing message sending messages to the corresponding target nodes according to the communication paths, and obtaining the verification feedback results of the message sending messages generated by the target nodes by utilizing Diffie-Hellman algorithm; establishing a secure channel with the target nodes according to the verification feedback results, and providing the data packets to the target nodes through the secure channel.

[0006] In the above path dynamic optimization encrypted tunnel communication method, optionally, the method further comprises: generating corresponding node public keys and node private keys through an encryption function according to the node information of the communication nodes participating in multi-party secure communication in the block chain network; generating a common public key through the Diffie-Hellman algorithm according to the node public key, and storing the common public key in the block chain network.

[0007] In the above path dynamic optimization encrypted tunnel communication method, optionally, generating corresponding node public keys and node private keys through an encryption function according to the node information of the communication nodes participating in multi-party secure communication in the block chain network further comprises: initializing the node parameters of each communication node through an elliptic curve algorithm according to the node information of the communication nodes participating in multi-party secure communication in the block chain network; generating signature data by signing the corresponding node parameters stored in the block chain network through the node private keys of each communication node; and consensus the signature data to the block chain network.

[0008] In the above path dynamic optimization encrypted tunnel communication method, optionally, the method further comprises: setting state transition rules for all communication processes of the communication nodes participating in multi-party secure communication in the block chain network; calculating the pheromone concentration of the communication paths between the communication nodes through the simulated ant colony algorithm according to the state transition rules; calculating the communication paths between the communication nodes according to the pheromone concentration, updating the routing table through the communication paths, and uploading the routing table to the block chain network for sharing.

[0009] In the method for dynamic optimization of the communication path of the encrypted tunnel, optionally, the pheromone concentration of the communication path between the communication nodes calculated by simulating the ant colony algorithm according to the state transition rule comprises: a pheromone parameter of the communication path between the communication nodes calculated by simulating the ant colony algorithm according to the state transition rule; and the pheromone concentration of the communication path between the communication nodes is cyclically updated according to the pheromone parameter.

[0010] In the method for dynamic optimization of the communication path of the encrypted tunnel, optionally, providing the message sending packet to the corresponding target node according to the communication path comprises: generating the message sending packet by splicing the identity information of the initial node and the node public key of the target node; and providing the message sending packet to the corresponding target node according to the communication path.

[0011] In the method for dynamic optimization of the communication path of the encrypted tunnel, optionally, obtaining the verification feedback result of the message sending packet by the common public key generated by the target node by using the Diffie-Hellman algorithm comprises: performing signature verification on the message sending packet by a decryption function, a node private key of the target node, and a common public key generated by the communication nodes participating in the multi-party secure communication in the blockchain network by using the Diffie-Hellman algorithm; and obtaining the verification feedback result by verifying the identity information of the initial node according to the signature verification result by using the node public key of the initial node information and the common public key.

[0012] The application also provides a device for dynamic optimization of the communication path of the encrypted tunnel, which comprises an analysis module, a verification module, and an interaction module; the analysis module is used to obtain an initial node and a target node by analyzing a data packet to be sent, and to obtain a shared communication path calculated by an ant colony algorithm through the initial node and the target node in a blockchain network; the verification module is used to provide a message sending packet to the corresponding target node according to the communication path, and to obtain a verification feedback result of the message sending packet by a common public key generated by the target node by using the Diffie-Hellman algorithm; and the interaction module is used to establish a secure channel with the target node according to the verification feedback result, and to provide the data packet to the target node through the secure channel.

[0013] The application also provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0014] The application also provides a computer readable storage medium storing a computer program for executing the above method.

[0015] The application also provides a computer program product comprising computer programs / instructions which, when executed by a processor, implement the steps of the above method.

[0016] The beneficial technical effects of the application are that: an architecture of path dynamic optimization of encrypted tunnel communication is provided, the architecture provides an interface by referring to an encrypted tunnel, simulates an ant colony algorithm to solve a "row merchant problem", and implements an IP data packet path dynamic optimization algorithm on the basis of an encrypted tunnel protocol, thereby improving route access efficiency; a path dynamic optimization algorithm is provided, the algorithm uses parameters such as pheromone and distance to iteratively optimize an optimal solution of path access, implements high-concurrency path searching and dynamic updating, and shortens time consumption of multi-party secure communication; and a method combining an encrypted tunnel and path dynamic optimization is provided, the algorithm proposes a message structure, effectively combines an interactive mode of sending and responding messages, implements signature verification and identity authentication of participating nodes, and improves security and efficiency of multi-party communication. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are included to provide a further understanding of the application and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0018] Figure 1A A flowchart of a path dynamic optimization encrypted tunnel communication method provided by an embodiment of the application;

[0019] Figure 1B A structure diagram of a blockchain network provided by an embodiment of the application;

[0020] Figure 2A A flowchart of a route table updating process provided by an embodiment of the application;

[0021] Figure 2B A structure diagram of a communication node module provided by an embodiment of the application;

[0022] Figure 2C A flowchart of an update process of pheromone concentration provided by an embodiment of the application;

[0023] Figure 3 A structure diagram of a consensus node module provided by an embodiment of the application;

[0024] Figure 4A A flowchart of an acquisition process of a common public key provided by an embodiment of the application;

[0025] Figure 4B A flowchart of an acquisition process of signature data provided by an embodiment of the application;

[0026] Figure 5A sending flowchart of a message sending packet provided by an embodiment of the present application is shown in the figure.

[0027] Figure 6 A flowchart of signature verification and identity verification provided by an embodiment of the present application is shown in the figure.

[0028] Figure 7 A flowchart of encrypted tunnel communication of path dynamic optimization provided by an embodiment of the present application is shown in the figure.

[0029] Figure 8 A structural diagram of an encrypted tunnel communication device of path dynamic optimization provided by an embodiment of the present application is shown in the figure.

[0030] Figure 9 An application logic diagram of an encrypted tunnel communication device of path dynamic optimization provided by an embodiment of the present application is shown in the figure.

[0031] Figure 10 A structural diagram of an electronic device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0032] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and embodiments, so that how the present application applies technical means to solve technical problems and achieves technical effects can be fully understood and implemented. It should be noted that, as long as there is no conflict, each embodiment in the present application and each feature in each embodiment can be combined with each other, and the technical solutions formed thereby are all within the protection scope of the present application.

[0033] In addition, the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0034] Reference is made to Figure 1A The encrypted tunnel communication method of path dynamic optimization provided by the present application specifically includes:

[0035] S101, obtaining an initial node and a target node according to a data packet to be sent, and obtaining a shared communication path calculated by an ant colony algorithm through a blockchain network via the initial node and the target node;

[0036] S102, providing a message sending packet to a corresponding target node according to the communication path, and obtaining a verification feedback result of the message sending packet generated by the target node by using a Diffie-Hellman algorithm;

[0037] S103 establishing a secure channel with the target node according to the verification feedback result, and providing the data packet to the target node through the secure channel.

[0038] In the above embodiment, the overall logic is to solve the value problem (TSP), which is defined as follows: Definition 1: TSP problem, let v = {a,...,z} be a communication node, A = {{r,s}: r,s∈V} be a set of edges, δ(r,s) = δ(s,r) represent the cost metric of edge (r,s) ∈ A, and the TSP problem is to find the lowest cost path from the source address to the destination address. Definition 2: ATSP problem, if δ(r,s) ≠ δ(s,r), the TSP problem is converted into an asymmetric ATSP problem. Specifically, the application scenario of the above-mentioned path dynamic optimization encrypted tunnel communication method can be referred to as Figure 1B As shown in FIG. 1, the uses of the communication node 1, the communication node 2, the communication node 3, and the user client 4 are as follows: the communication node 1: a node participating in multi-party secure communication, which can be located inside or outside a NAT (network address translation node), responsible for establishing a secure channel with other nodes in the public network and conducting secure communication. In this example, the communication node 1, the communication node 2, and the communication node 3 are connected to form a multi-party communication network. The communication node 2: a node participating in multi-party secure communication, which can be located inside or outside a NAT (network address translation node), responsible for establishing a secure channel with other nodes in the public network and conducting secure communication. It is assumed that the communication node 1, the communication node 2, and the communication node 3 in this example are connected to form a multi-party communication network. The communication node 3: a node participating in multi-party secure communication, which can be located inside or outside a NAT (network address translation node), responsible for establishing a secure channel with other nodes in the public network and conducting secure communication. It is assumed that the communication node 1, the communication node 2, and the communication node 3 in this example are connected to form a multi-party communication network. The user client 4: responsible for sending and receiving user access communication node transaction requests, forwarding transaction requests to corresponding multi-party communication nodes, and receiving multi-party communication data from multi-party communication nodes and returning to users.

[0039] Please refer to Figure 2A As shown in FIG. 1, the uses of the communication node 1, the communication node 2, the communication node 3, and the user client 4 are as follows: the communication node 1: a node participating in multi-party secure communication, which can be located inside or outside a NAT (network address translation node), responsible for establishing a secure channel with other nodes in the public network and conducting secure communication. In this example, the communication node 1, the communication node 2, and the communication node 3 are connected to form a multi-party communication network. The communication node 2: a node participating in multi-party secure communication, which can be located inside or outside a NAT (network address translation node), responsible for establishing a secure channel with other nodes in the public network and conducting secure communication. It is assumed that the communication node 1, the communication node 2, and the communication node 3 in this example are connected to form a multi-party communication network. The communication node 3: a node participating in multi-party secure communication, which can be located inside or outside a NAT (network address translation node), responsible for establishing a secure channel with other nodes in the public network and conducting secure communication. It is assumed that the communication node 1, the communication node 2, and the communication node 3 in this example are connected to form a multi-party communication network. The user client 4: responsible for sending and receiving user access communication node transaction requests, forwarding transaction requests to corresponding multi-party communication nodes, and receiving multi-party communication data from multi-party communication nodes and returning to users.

[0040] S201 setting a state transition rule for all communication processes of a communication node participating in multi-party secure communication in a blockchain network;

[0041] S202 calculating the pheromone concentration of the communication path between the communication nodes according to the state transition rule through an ant colony algorithm;

[0042] S203 calculating the communication path between the communication nodes according to the pheromone concentration, updating the routing table through the communication path, and uploading the routing table to the blockchain network for sharing.

[0043] In actual work, please refer to Figure 2B As shown in FIG. 1, the communication node of the path dynamic optimization encrypted tunnel communication method can include a communication module 21, a connection module 22, a security calculation module 23, a message processing module 24, and a routing management module 25. The application logic of each node is as follows: the communication module 21 serves as the entrance of the communication node and implements the data message transceiving of the recommendation system; the connection module 22 is responsible for establishing a secure channel for the communication node, managing the secure channel, and implementing the connection, termination, and reconnection of communication; the security calculation module 23 is responsible for using cryptographic algorithms to encrypt and decrypt the generated data messages; the message processing module 24 is responsible for executing the parsing and splitting of user data, forming data vectors, and assembling user data messages. The routing management module 25 is responsible for managing the routing of communication messages, saving, deleting, and adding routing information, etc. The execution process includes two stages: initialization and dynamic updating of pheromones. The initialization process of the first stage is as follows: step 1: set the initial node of the data message as a and the destination node as b; step 2: set the loop flag; step 2.1: in the loop, each ant colony (routing selection) process adds a state transition rule to establish a path solution and prepare for local pheromone updating in iteration; step 2.2: until all ant colonies complete the establishment of the path solution.

[0044] Please refer to Figure 2C In the above embodiment, the pheromone concentration of the communication path between the communication nodes calculated by simulating the ant colony algorithm according to the state transition rule includes:

[0045] S2021 calculating the pheromone parameters of the communication path between the communication nodes according to the state transition rule by simulating the ant colony algorithm;

[0046] S2022 cyclically updating the pheromone concentration of the communication path between the communication nodes according to the pheromone parameters.

[0047] Specifically, the dynamic updating of the pheromone concentration belongs to the second stage in actual work, and the process of this stage is as follows:

[0048] Step 1: the ant colony dynamically updates the pheromone in the path according to the state transition rule in the first stage (initialization), and the state transition rule is defined as follows:

[0049]

[0050] In the above formula, assume that the path selection k (ant colony) is from the source node a to the target node b, a and b both represent communication nodes, τ represents pheromone, μ = 1 / δ represents the reciprocal of the path distance δ (a, b) of a and b, J k (r) is the set of communication nodes available for the ant colony k (from a to b); β is a parameter that determines the relative importance of pheromone and distance, and generally β > 0.

[0051] Step 2: update the pheromone τ according to the path distance μ and the pheromone "concentration", and the pheromone update rule is as follows:

[0052]

[0053] Wherein:

[0054]

[0055] In the above formula, 0 < α < 1 represents a pheromone decay factor, L k represents the path length walked by the ant colony k, and m represents the number of ant colonies.

[0056] Step 3: optimal routing, that is, selecting the best path s according to the "concentration" of pheromone:

[0057]

[0058] Wherein, q is a random number distributed in [0...1], q0 (0 ≤ q0 ≤ 1) is a constant parameter, and S is a randomly selected variable, which follows the state transition rule (refer to step 1).

[0059] Please refer to Figure 3 In an embodiment of the present application, in the blockchain network for performing the encrypted tunnel communication method for dynamic optimization of paths, the consensus node can include a communication module 31, a ciphertext processing module 32, a transaction processing module 33, and a key storage module 34: the communication module 31 is responsible for communication interaction between nodes in the blockchain, and completes general blockchain node communication information transmission, including transaction broadcast information, consensus information, block synchronization information, network state information, etc.; the ciphertext processing module 32 is responsible for encryption and decryption processing of the data packets received and transmitted by the communication module 31; the transaction processing module 33 is responsible for generating a transaction unique identifier, a contract unique identifier, and a call parameter according to a transaction request provided by the ciphertext processing module 32, assembling them into a transaction packet, and calling a smart contract transaction to calculate a result. The key storage module 34 is responsible for storing the key generated by the communication nodes in a trusted space.

[0060] Please refer to Figure 4A In an embodiment of the present application, the method further includes:

[0061] S401 generates a corresponding node public key and node private key respectively according to node information of a communication node participating in multi-party secure communication in a blockchain network through an encryption function;

[0062] S402 generates a common public key according to the node public key through a Diffie-Hellman algorithm, and stores the common public key in a blockchain network.

[0063] Specifically, in actual work, the public and private keys of each node can be set in a loop for all communication nodes i (i [1, n]); the GenKey() function is executed, and for each communication node i (i [1, n]), the public key pk(i) and the private key sk(i) of the communication node i are generated in a loop, and pk(i) is uploaded to the blockchain for storage; formally:

[0064] (pk(i),sk(i))=genkey(1 k ));

[0065] After that, assuming that the communication node i initiates a multi-party communication request, the multi-common public key generation is started through a blockchain smart contract. Assuming that the number of communication nodes is k, the loop iteration is started from 1 to k, and the following operations are performed; the Diffie-Hellman algorithm is executed to generate a common public key, and the common public key is set as PK, and PK is initialized as PK(j) (1≤j≤K), and the calculation process is iterated as follows:

[0066] PK=DH(PK(i),PK);

[0067] The generated common public key PK is further stored on the chain.

[0068] Further, please refer to Figure 4B In the above embodiment, generating a corresponding node public key and node private key according to node information of a communication node participating in multi-party secure communication in a blockchain network through an encryption function further includes:

[0069] S4011 initializes node parameters of each communication node according to node information of a communication node participating in multi-party secure communication in a blockchain network through an elliptic curve algorithm;

[0070] S4012 generates signature data by signing the corresponding node parameters stored in the blockchain network through the node private key of each communication node;

[0071] S4013 consensus the signature data to the blockchain network.

[0072] Specifically, in actual work, initialization parameters such as the elliptic curve algorithm X25519 can be used; the initialization parameters are stored in the blockchain network; and then the data shared by the blockchain network can be used to complete the related verification during multi-party secure communication.

[0073] Reference is made to Figure 5 As shown in the embodiment of the present application, providing the message sending packet to the corresponding target node according to the communication path comprises:

[0074] S501 concatenating the identity information of the initial node and the node public key of the target node to generate a message sending packet;

[0075] S502 providing the message sending packet to the corresponding target node according to the communication path.

[0076] In actual work, the message sending packet can also be handshake information, which can include message type, receiver public key, sender public key, temporary credential, occurrence timestamp, physical address, static information including public key, and the like. The specific format will be described in detail in subsequent embodiments, and will not be described one by one here.

[0077] Reference is made to Figure 6 As shown in the embodiment of the present application, obtaining the verification feedback result of the message sending packet by the common public key generated by the target node using the Diffie-Hellman algorithm comprises:

[0078] S601 performing signature verification on the message sending packet by a decryption function, a node private key of the target node, and a common public key generated by a communication node participating in multi-party secure communication in a blockchain network using the Diffie-Hellman algorithm;

[0079] S602 obtaining a verification feedback result according to the signature verification result by verifying the identity information of the initial node by a node public key of the initial node information and the common public key.

[0080] On this basis, an encrypted tunnel is constructed, and then data interaction can be performed. In actual work, the verification process can include the following two stages: (1) identifying third-party node information and performing signature authentication; and (2) identifying common public key information and implementing identity authentication, as follows:

[0081] 1. Signature verification

[0082] The Verifysign(PK, sk(i)) function is executed to verify the digital signature of PK. If the verification is passed, the next step is performed, otherwise the communication connection is rejected. The function is executed as follows:

[0083] bool = Verifysign(PK, sk(i))

[0084] Wherein sk(i) represents the private key of node i, PK represents the common public key, and bool represents the result of verifying the signature. bool=true indicates success, and bool=false indicates failure.

[0085] 2. Identity authentication

[0086] The AuthenKey(PK, PK(i)) function is executed to verify the third-party node identity information of PK, and if the identity authentication is passed, the next step is processed, otherwise the communication connection is rejected, and the function is executed as follows:

[0087] bool = AuthenKey(PK, PK(i))

[0088] Wherein PK(i) represents the public key of node i, PK represents the common public key, and bool represents the result of verifying the signature, bool = true indicates that the identity authentication is successful, and bool = false indicates that the identity authentication fails.

[0089] The handshake information data format is shown in Table 1 as follows:

[0090] Table 1

[0091]

[0092]

[0093] Wherein the IP header represents the data packet header, and the next hop represents the next hop routing information; type represents the message type, TYPE = 0X1 represents a sending message, TYPE = 0x2 represents a receiving message, and the like; reserved represents the receiver public key; sender represents the sender public key; ephemeral represents a temporary credential; timestamp represents the sending timestamp; mac1 represents the physical address 1; mac2 represents the physical address 2; static represents static information, including the common public key PK and the header information H in the form of hash i

[0094] H i = Hash(Hash(Construct) || PK(i))

[0095] Wherein Hash represents the hash algorithm SHA-256, Construct represents the content information of the structure body, PK(i) represents the public key of the communication node i, and || represents the byte sequence concatenation operator symbol.

[0096] After receiving the communication request, the communication request is fed back with a message, and the success or failure result is output if the communication is successful. The response message format is shown in Table 2 as follows:

[0097] Table 2

[0098]

[0099] ​Wherein type represents the message type, TYPE=0X1 represents sending a message; TYPE=0x2 represents receiving a message, etc.; reserved represents the receiver public key; sender represents the sender public key; ephemeral represents the temporary credentials; static represents static information, Timestamp represents the sending timestamp; mac1 represents the physical address 1; mac2 represents the physical address 2.

[0100] In order to more clearly understand the actual application process of the path dynamic optimization encrypted tunnel communication method provided in the present application, please refer to the following Figure 7 The overall process is as follows:

[0101] S701: Initialize the security parameters, such as the initialization parameters of the elliptic curve algorithm X25519 used in this example; execute the GenKey() function, and for each communication node i (i∈[1,n]), loop to generate the public key pk(i) and private key sk(i) of the communication node i, and upload pk(i) to the blockchain for notarization; formally:

[0102] (pk(i),sk(i))=genkey(1 k ))

[0103] S702: For all communication processes or ant colonies k (k∈[1,n]), loop to set the state transition rule;

[0104] S703: Add an initial state transition rule to each path search process (ant colony), and the state transition rule is defined as follows:

[0105]

[0106] In the above formula, it is assumed that the path selection k (ant colony) is from the source node a to the target node b, a and b represent communication nodes, τ represents pheromone, μ=1 / δ represents the reciprocal of the path distance δ(a,b) between a and b, J k (r) is the set of communication nodes available for selection by the ant colony k (from a to b); β is a parameter that determines the relative importance of pheromone and distance, and in general cases β>0.

[0107] S704: Prepare to add pheromone information to each ant colony;

[0108] S705: For all ant colonies k (k∈[1,n]), loop to update the pheromone parameters.

[0109] S706: The specific method for updating the pheromone is to update the pheromone τ according to the path distance μ and the pheromone "concentration", and the pheromone update rule is as follows:

[0110]

[0111] wherein:

[0112]

[0113] In the above formula, 0 < a < 1 represents the pheromone attenuation factor, L k represents the path length walked by the ant colony k, and m represents the number of ant colonies.

[0114] S707: Perform the optimized path selection function to select the optimal path, and perform the following operations: select the best path s according to the "concentration" of the pheromone:

[0115]

[0116] wherein q is a random number distributed in [0...1], q0 (0 ≤ q0 ≤ 1) is a constant parameter, and S is a randomly selected variable that follows the state transition rule (see step 403).

[0117] S708: Collect the optimized combined path nodes and update the routing table.

[0118] S709: Store the latest routing table on the blockchain for evidence, and realize sharing across the network.

[0119] S710: When starting multi-party secure communication, the third party sends a data report according to the dynamic routing table.

[0120] S711: After receiving the communication request, the other party feeds back a message to the communication request, and outputs the success or failure result if the communication is successful.

[0121] Please refer to Figure 8 The application also provides a path dynamic optimization encrypted tunnel communication device, which comprises an analysis module, a verification module and an interaction module; the analysis module is used to obtain initial nodes and target nodes by analyzing a data packet to be sent, and obtain a shared communication path calculated by an ant colony algorithm through the initial nodes and the target nodes in a blockchain network; the verification module is used to provide a message sending message to a corresponding target node according to the communication path, and obtain a verification feedback result of the message sending message generated by the target node by using a Diffie-Hellman algorithm; and the interaction module is used to establish a secure channel with the target node according to the verification feedback result, and provide the data packet to the target node through the secure channel.

[0122] In actual work, the path dynamic optimization encrypted tunnel communication device provided by the application mainly applies two stages of processing, which can be referred to Figure 9 as shown in the figure:

[0123] Stage 1: Initialization stage

[0124] S901: Initialize security parameters, such as initialization parameters of the elliptic curve algorithm X25519 used in this example, calculate the public key and private key information of the communication node (initiator), in the form of:

[0125] (pk(i),sk(i))=genkey(1 k ))

[0126] S902: Upload the security parameters to the blockchain network for information notarization;

[0127] S903: The communication node (receiver 1) calls the smart contract, reads the security parameters notarized by the blockchain network, and then signs the security parameters with the private key sk(1) of the communication node (receiver 1);

[0128] S904: The communication node (receiver 2) calls the smart contract, reads the security parameters notarized by the blockchain network, and then signs the security parameters with the private key sk(2) of the communication node (receiver 2);

[0129] S905: Perform the Diffie-Hellman algorithm to generate a common public key, and upload it to the blockchain for notarization. Let PK be the common public key, initialize PK=PK(j)(1≤j≤K), and the calculation process is iterated as follows:

[0130] PK=DH(PK(i),PK).

[0131] Phase two: path dynamic optimization phase

[0132] S1001: The communication node (initiator) starts the communication path optimization process; for all communication processes or ant colonies k(k∈[1,n]), set the state transition rule in a loop; add an initialization state transition rule to each path search process (ant colony), and the state transition rule is defined as follows:

[0133]

[0134] In the above formula, assume that the path selection k (ant colony) is from the source node a to the target node b, a and b represent communication nodes, τ represents pheromone, μ=1 / δ represents the reciprocal of the path distance δ(a,b) between a and b, J k (r) is the set of communication nodes available for selection by ant colony k (from a to b); β is a parameter that determines the relative importance of pheromone and distance, and in general cases β>0;

[0135] S1002: For all ant colonies k(k∈[1,n]), update the pheromone parameters in a loop. The specific method for updating the pheromone is: update the pheromone τ according to the path distance μ and the pheromone "concentration", and the pheromone update rule is as follows:

[0136]

[0137] wherein:

[0138]

[0139] In the above formula, 0 < a < 1 represents the pheromone decay factor, L k represents the path length walked by the ant colony k, and m represents the number of ant colonies.

[0140] S1003: update the routing table information and store it on the blockchain;

[0141] S1004: generate a sending packet, and the packet information data format is shown in Table 3 as follows:

[0142] Table 3

[0143]

[0144] wherein the IP header represents the data packet header, Next hop represents the next hop routing information; type represents the message type, TYPE = 0X1 represents a sending message; TYPE = 0x2 represents a receiving message, etc.; reserved represents the receiver public key; sender represents the sender public key; ephemeral represents a temporary credential; timestamp represents the sending timestamp; mac1 represents the physical address 1; mac2 represents the physical address 2; static represents static information, including the common public key PK, the header information H in the form of hash i ,

[0145] H i = Hash(Hash(Construct) || PK(i))

[0146] wherein Hash represents the hash algorithm SHA-256, Construct represents the content information of the structure body, PK(i) represents the public key of the communication node i, and || represents the byte sequence concatenation operator symbol.

[0147] S1005: the receiving node sends a response packet, and the response message format is shown in Table 4 as follows:

[0148] Table 4

[0149]

[0150] Wherein the IP header represents the datagram header, the next hop represents the next hop routing information; the type represents the message type, TYPE=0X1 represents the sending message; TYPE=0x2 represents the receiving message; reserved represents the receiver public key; sender represents the sender public key; ephemeral represents the temporary credentials; static represents static information, Timestamp represents the sending timestamp; mac1 represents the physical address 1; mac2 represents the physical address 2.

[0151] The beneficial technical effects of the present application are: an architecture of path dynamic optimization of encrypted tunnel communication is proposed, which provides an interface by referring to the encrypted tunnel, simulates the ant colony algorithm to solve the "row merchant problem", and realizes the path dynamic optimization algorithm of IP data packet based on the encrypted tunnel protocol, thereby improving the routing access efficiency; a path dynamic optimization algorithm is proposed, which uses pheromone and distance parameters to iteratively optimize the optimal solution of path access, realizes high-concurrency path search and dynamic update, and shortens the time consumption of multi-party secure communication; a method combining encrypted tunnel and path dynamic optimization is proposed, which proposes a message structure, effectively combines the interaction mode of sending and responding messages, realizes the signature verification and identity authentication of participating nodes, and improves the security and efficiency of multi-party communication.

[0152] The present application also provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0153] The present application also provides a computer readable storage medium, which stores a computer program for executing the above method.

[0154] The present application also provides a computer program product, comprising computer programs / instructions, which are executed by a processor to implement the steps of the above method.

[0155] As shown in Figure 10 , the electronic device 600 can also include a communication module 110, an input unit 120, an audio processor 130, a display 160, and a power supply 170. It is worth noting that the electronic device 600 does not necessarily include all the components shown in Figure 10 ; in addition, the electronic device 600 can also include components not shown in Figure 10 , which can refer to the prior art.

[0156] As shown in Figure 10As shown, the central processing unit 100, which is sometimes referred to as a controller or operating control, can include a microprocessor or other processor device and / or logic device that receives input and controls the operation of the various components of the electronic device 600.

[0157] The memory 140, for example, can be one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. Information relating to failures can be stored, and in addition, programs for executing the information can be stored. The central processing unit 100 can execute the programs stored in the memory 140 to achieve information storage or processing, etc.

[0158] The input unit 120 provides input to the central processing unit 100. The input unit 120 is, for example, a key or touch input device. The power supply 170 is used to provide power to the electronic device 600. The display 160 is used to display display objects such as images and text. The display can be, for example, an LCD display, but is not limited thereto.

[0159] The memory 140 can be a solid state memory such as a read only memory (ROM), a random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROM, etc. The memory 140 can also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 can include an application / function storage section 142 for storing application programs and function programs or for storing a flow for executing the operation of the electronic device 600 by the central processing unit 100.

[0160] The memory 140 can also include a data storage section (data 143) for storing data such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. A driver storage section (drivers 144) of the memory 140 can include various drivers of the electronic device for communication functions and / or for performing other functions of the electronic device such as a messaging application, an address book application, etc.

[0161] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via an antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processing unit 100 to provide input signals and receive output signals, which can be the same as in the case of a conventional mobile communication terminal.

[0162] Based on different communication technologies, multiple communication modules 110, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module, can be provided in the same electronic device. The communication modules (transmitters / receivers) 110 are also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide audio output via the speaker 131 and to receive audio input from the microphone 132 to enable typical telecommunication functions. The audio processor 130 can include any suitable buffers, decoders, amplifiers, etc. In addition, the audio processor 130 is coupled to the central processor 100 to enable recording of audio on the local device via the microphone 132 and to enable playing of stored audio on the local device via the speaker 131.

[0163] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer-readable program code.

[0164] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams block or blocks.

[0165] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart illustrations and / or block diagrams block or blocks.

[0166] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks.

[0167] The specific embodiments described above are intended to be illustrative of the present application and are not intended to limit the scope of the present application. Various modifications of the specific embodiments described above could be made by persons of ordinary skill in the art without departing from the spirit and scope of the present application.

Claims

1. A method for path dynamic optimization of encrypted tunnel communication, characterized in that, The method comprises: According to the data packet to be sent, the initial node and the target node are obtained, and a shared communication path is obtained through the initial node and the target node in the blockchain network; the communication path is a state transition rule set for all communication processes of the communication nodes participating in the multi-party secure communication in the blockchain network, and is obtained through an ant colony algorithm simulation according to the state transition rule; a routing table is updated through the communication path, and the routing table is uploaded to the blockchain network for sharing; According to the communication path, a message sending message is provided to the corresponding target node, and a verification feedback result of the message sending message by the target node through a common public key is obtained; the message sending message comprises identity information of the initial node and a node public key of the target node; The common public key is generated by the communication nodes participating in the multi-party secure communication in the blockchain network using the Diffie-Hellman algorithm, and is used for signature verification of the message sending message; according to the signature verification result, the identity information of the initial node is verified through the node public key of the initial node information and the common public key; According to the verification feedback result, a secure channel is established with the target node, and the data packet is provided to the target node through the secure channel.

2. The method of claim 1, wherein, The method further comprises: According to the node information of the communication nodes participating in the multi-party secure communication in the blockchain network, a corresponding node public key and a node private key are respectively generated through an encryption function; According to the node public key, a common public key is generated through the Diffie-Hellman algorithm, and the common public key is stored in the blockchain network.

3. The method of claim 2, wherein, According to the node information of the communication nodes participating in the multi-party secure communication in the blockchain network, a corresponding node public key and a node private key are respectively generated through an encryption function, which further comprises: According to the node information of the communication nodes participating in the multi-party secure communication in the blockchain network, the node parameters of each communication node are initialized through an elliptic curve algorithm; The corresponding node parameters stored in the blockchain network are signed through the node private key of each communication node to generate signature data; The signature data is consensus to the blockchain network.

4. The method of claim 1, wherein the path dynamic optimization of the encrypted tunnel communication is performed by a network device. According to the state transition rule, the information concentration of the communication path between the communication nodes is calculated through the ant colony algorithm simulation; According to the information concentration, the communication path between the communication nodes is calculated. According to the state transition rule, the information concentration of the communication path between the communication nodes is calculated through the ant colony algorithm simulation, which comprises:

5. The method of claim 4, wherein, According to the state transition rule, the information concentration of the communication path between the communication nodes is calculated through the ant colony algorithm simulation, which comprises: According to the information concentration, the communication path between the communication nodes is calculated. The common public key is generated by the communication nodes participating in the multi-party secure communication in the blockchain network using the Diffie-Hellman algorithm, which comprises:

6. The method of claim 1, wherein the path dynamic optimization of encrypted tunnel communication is characterized by, The common public key is generated by the communication nodes participating in the multi-party secure communication in the blockchain network using the Diffie-Hellman algorithm through a decryption function, a node private key of the target node and the common public key. The device comprises an analysis module, a verification module and an interaction module; 7. A path dynamically optimized encrypted tunnel communication apparatus, characterized by, ​ The analysis module is used for obtaining an initial node and a target node according to a data packet to be sent, and obtaining a shared communication path in a blockchain network through the initial node and the target node; the communication path is a state transition rule set for all communication processes of communication nodes participating in multi-party secure communication in the blockchain network, and is obtained through an ant colony algorithm simulation according to the state transition rule; a routing table is updated through the communication path, and the routing table is uploaded to the blockchain network for sharing; The verification module is used for providing a message sending message to a corresponding target node according to the communication path, and obtaining a verification feedback result of the message sending message by the target node through a common public key; the message sending message contains identity information of an initial node and a node public key of the target node; The common public key is generated by a communication node participating in multi-party secure communication in the blockchain network using a Diffie-Hellman algorithm, and is used for signature verification of the message sending message; the identity information of the initial node is verified according to a signature verification result through a node public key of the initial node information and the common public key; The interaction module is used for establishing a secure channel with the target node according to the verification feedback result, and providing the data packet to the target node through the secure channel.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program for executing the method of any one of claims 1 to 6 by a computer.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instruction is executed by the processor to realize the steps of the method according to any one of claims 1 to 6.

Images