Two-layer message transmission method and system

Abstract

The invention provides a two-layer message transmission method and system, and relates to the technical field of communication. The method comprises the following steps: receiving a two-layer message sent by first user equipment, wherein the two-layer message comprises an MAC address and load data; carrying out packaging processing on the two-layer message to generate a packaged message; obtaining a quantum key forwarded by the SDN controller, and generating a quantum session key by using a pre-generated original session key and the quantum key; and encrypting the load data in the packaged message by using the quantum session key to generate an encrypted message, and forwarding the encrypted message to the target receiver routing device, thereby realizing secure transmission of the two-layer message, and the two-layer message has quantum cracking resistance in the transmission process, thereby improving the security of the two-layer message. The problem that an attacker tampers the message or attacks the network equipment by forging the message information is solved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a layer 2 message transmission method and system. Background Art

[0002] Layer 2 Virtual Private Network (L2VPN) is a technology that provides enterprise LAN or WAN interconnection in the service provider network. It allows users to create a private, isolated Layer 2 network connection through the service provider's infrastructure above the network layer (i.e. Layer 3), allowing enterprise branches in different geographical locations to communicate as if they were in the same physical network. Among them, L2VPN can support multiple Layer 2 protocols, including Ethernet, ATM (Asynchronous Transfer Mode), Frame Relay, etc., to meet the needs of different enterprises.

[0003] However, the Layer 2 VPN only provides isolation at the physical level and lacks certain security measures. It may be subject to the security threat of man-in-the-middle attacks, resulting in low security of message transmission. Summary of the invention

[0004] The purpose of the present invention is to provide a layer 2 message transmission method and system to solve the technical problems existing in the prior art in view of the above-mentioned deficiencies in the prior art.

[0005] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0006] In a first aspect, an embodiment of the present application provides a layer 2 message transmission method, which is applied to a sending routing device, and the method includes:

[0007] Receiving a layer 2 message sent by a first user equipment, wherein the layer 2 message includes: a MAC address and payload data;

[0008] Encapsulating the layer 2 message to generate an encapsulated message;

[0009] Obtain the quantum key forwarded by the SDN controller and generate a quantum session key using the pre-generated original session key and the quantum key;

[0010] The payload data in the encapsulated message is encrypted using the quantum session key to generate an encrypted message, and the encrypted message is forwarded to a target recipient routing device.

[0011] Optionally, encapsulating the layer 2 message to generate an encapsulated message includes:

[0012] The SRv6 tunnel of the sending routing device encapsulates an SRv6 message header into the outer layer of the layer 2 message to generate an encapsulated message, wherein the data packet structure of the encapsulated message includes: SRv6, MAC address and payload data, and the SRv6 message header includes: destination IPv6 address and source IPv6 address.

[0013] Optionally, the using a pre-generated original session key and a quantum key to generate a quantum session key comprises:

[0014] Determine a key generation method, wherein the key generation method includes: XOR operation or data summary;

[0015] The key generation method is used to process the original session key and the quantum key to generate the quantum session key.

[0016] Optionally, the using the quantum session key to encrypt the encapsulated message to generate an encrypted message includes:

[0017] The IPSec tunnel of the sender routing device uses the quantum session key to securely encrypt the payload data in the encapsulated message, and adds an ESP header to the encapsulated message to generate the encrypted message, wherein the data packet structure of the encrypted message includes: SRv6, ESP, MAC address and payload data.

[0018] Optionally, the receiving a layer 2 message sent by the first user equipment includes:

[0019] Receiving the layer 2 message from the first port of the first user equipment;

[0020] After receiving the layer 2 message sent by the first user equipment, the method further includes:

[0021] Determine transmission path information associated with the first port.

[0022] Optionally, forwarding the encrypted message to a target recipient routing device includes:

[0023] Determining a target receiving party routing device according to the transmission path information associated with the first port;

[0024] The encrypted message is forwarded to the target recipient routing device via the wide area network using a preset message forwarding method.

[0025] In a second aspect, an embodiment of the present application further provides a message transmission method, which is applied to a receiving routing device, and the method includes:

[0026] Receiving the encrypted message forwarded by the sending routing device;

[0027] Obtain the quantum key forwarded by the SDN controller;

[0028] Processing the original session key identical to that of the sending routing device and the quantum key to generate a quantum session key;

[0029] Decrypting the payload data in the encrypted message using the quantum session key to generate an encapsulated message;

[0030] Decapsulating the encapsulated message to generate a layer 2 message, wherein the layer 2 message includes: a MAC address and payload data;

[0031] The layer 2 message is forwarded to the second user equipment.

[0032] Optionally, the decrypting the encrypted message using the quantum session key to generate an encapsulated message includes:

[0033] The IPSec tunnel of the receiver's routing device uses the quantum session key to decrypt the encrypted message, remove the ESP header in the encrypted message, and generate the encapsulated message.

[0034] Optionally, the decapsulating the encapsulated message to generate a layer 2 message includes:

[0035] The SRv6 tunnel of the receiving routing device decapsulates the SRv6 message header of the outer layer of the encapsulated layer 2 message to generate the layer 2 message.

[0036] Optionally, forwarding the layer 2 message to a second user equipment includes:

[0037] Determine a second port on the second user device according to the transmission path information pre-stored on the receiving party routing device;

[0038] The layer 2 message is forwarded to the second port on the second user equipment.

[0039] In a third aspect, an embodiment of the present application further provides a layer 2 message transmission system, the system comprising: a first user device, a sender routing device, a receiver routing device, a second user device, an SDN controller, and a quantum cryptography service platform;

[0040] The sending party routing device is connected to the receiving party routing device via a wide area network communication;

[0041] The SDN controller is respectively connected to the sender routing device, the receiver routing device, and the quantum cryptography service platform for obtaining a quantum key from the quantum cryptography service platform and distributing the obtained quantum key to the sender routing device and the receiver routing device;

[0042] The sending party routing device is used to execute the method provided in the first aspect above;

[0043] The receiving routing device is used to execute the method provided in the second aspect above.

[0044] The beneficial effects of this application are:

[0045] The embodiment of the present application provides a method and system for transmitting a layer 2 message. In this solution, the routing device of the sending party encapsulates the received layer 2 message to generate an encapsulated message, and combines the quantum key with the original session key to generate a quantum enhanced session key, that is, a quantum session key, to encrypt the payload data in the encapsulated message to generate an encrypted message, and forward the encrypted message to the routing device of the target receiving party, thereby improving the anti-quantum cracking capability of the encrypted message, thereby enabling the safe and efficient transmission of the user's layer 2 message data; then, the routing device of the target receiving party uses the same quantum session key as the routing device of the sending party to decrypt and decapsulate the received encrypted message to generate a layer 2 message. Thus, the secure transmission of the layer 2 message is realized, and the layer 2 message has the ability to resist quantum cracking during the transmission process, which solves the problem of attackers tampering with messages or attacking network devices by forging message information. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A schematic diagram of the architecture of a layer 2 message transmission system provided in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of a flow chart of a layer 2 message transmission method provided in an embodiment of the present application;

[0049] Figure 3 A flowchart of another layer 2 message transmission method provided in an embodiment of the present application;

[0050] Figure 4A flowchart of another layer 2 message transmission method provided in an embodiment of the present application;

[0051] Figure 5 Flowchart of Layer 2 message encapsulation and decapsulation provided for this application.

[0052] Icons: 1-first user device; 2-sender routing device; 3-receiver routing device; 4-second user device; 5-SDN controller; 6-quantum cryptography service platform. DETAILED DESCRIPTION

[0053] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0054] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0055] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0056] First, the professional terms involved in this application are introduced.

[0057] 1. Internet Protocol Security (IPSec): It protects the network transmission protocol cluster (a collection of interrelated protocols) of the IP protocol by encrypting and authenticating IP protocol packets.

[0058] 2. Encapsulating Security Payload (ESP): It is a key component of the IPsec (Internet Protocol Security) protocol, mainly used to protect the confidentiality and integrity of IP data packets.

[0059] 3. Layer 2 Virtual Private Network (L2VPN): It is a virtual private network that carries Layer 2 services.

[0060] 4. Virtual Private LAN Service (VPLS): It is a Layer 2 network technology that simulates the behavior of a traditional local area network (LAN) on a service provider network. It allows multiple users from different geographical locations to share a virtual LAN environment, as if their devices were all connected to the same physical network.

[0061] 5. Virtual Private Wire Service (VPWS): It is a Layer 2 network service that is mainly used to create point-to-point connections on the service provider's network, simulating traditional dedicated line services. VPWS establishes a virtual dedicated line between two geographical locations, allowing devices at both ends to communicate as if they were directly connected.

[0062] 6. Segment Routing over IPv6 (SRv6): It introduces the concept of source routing into the IPv6 protocol. In SRv6, the router sends the data packet directly to the destination address based on the source routing information in the message.

[0063] Secondly, the prior art involved in this application is introduced.

[0064] L2VPN (Layer 2 Virtual Private Network) is a technology that provides enterprise local area network (LAN) or wide area network (WAN) interconnection in the service provider network. It allows users to create a private, isolated Layer 2 network connection through the service provider's infrastructure above the network layer (i.e. Layer 3). It uses the network resources of the service provider to provide enterprises with a virtual Layer 2 network environment, allowing enterprise branches in different geographical locations to communicate as if they were in the same physical network. Among them, L2VPN can support multiple Layer 2 protocols, including Ethernet, ATM (Asynchronous Transfer Mode), Frame Relay, etc., to meet the needs of different enterprises.

[0065] However, as the current global network security situation faces increasingly severe challenges, network attacks and information theft incidents are frequent, posing a serious threat to governments, enterprises and individuals, involving important information such as personal privacy, business secrets, and state secrets. This not only harms the interests of the victims, but may also trigger a chain reaction and affect social stability and national security. Therefore, the traditional Layer 2 dedicated line has the following problems:

[0066] 1. Layer 2 dedicated lines provide isolation at the physical level, but lack proper encryption and security measures, and may be subject to security threats such as man-in-the-middle attacks;

[0067] 2. With the development of large-scale quantum computers, the session keys derived from the traditional IPSec protocol cannot effectively resist the attacks and cracking of quantum computing. Attackers can tamper with messages to achieve the purpose of message hijacking, or attack network devices by forging message information.

[0068] Therefore, the layer 2 message transmission method provided by the current layer 2 virtual private network has the problem of insufficient security and it is difficult to ensure the security of message transmission.

[0069] The embodiments of the present application are based on the above-mentioned problems. The present application provides a method for transmitting layer 2 messages, which encrypts and transmits layer 2 messages based on quantum keys and IPSec protocol combined with SRv6, and utilizes the powerful transmission capability of IPv6 network to safely and efficiently transmit user layer 2 messages. It not only realizes point-to-point and point-to-multipoint connections, but also ensures the integrity and confidentiality of user data when traversing the IPv6 network, providing users with a secure and flexible network communication environment, and solving the problem of insufficient security in the prior art.

[0070] Before describing the technical solution provided by the present application in detail, a brief description is first given of the application scenarios of layer 2 message transmission involved in the present application.

[0071] refer to Figure 1 As shown, it is a schematic diagram of the architecture of the layer 2 message transmission system provided in the embodiment of the present application; Figure 1 As shown, the layer 2 message transmission system includes: a first user device 1, a sender routing device 2, a receiver routing device 3, a second user device 4, an SDN controller 5 and a quantum cryptography service platform 6.

[0072] Exemplarily, for example, the first user device 1 and the second user device 4 may be data forwarding devices such as switches or routers; the sender routing device 2 and the receiver routing device 3 may be routers for implementing data packet forwarding between different networks.

[0073] The first user device 1 is directly connected to the sending routing device 2, the sending routing device 2 is connected to the receiving routing device 3 via a wide area network, and the receiving routing device 3 is directly connected to the second user device 4.

[0074] The sender routing device 2 and the receiver routing device 3 can also be called quantum security U devices, both located at the edge of the network, and are the endpoints of the quantum encryption tunnel. Through L2VPN over SRv6 over IPSec technology, the quantum security U device can establish a quantum encryption tunnel, encrypt the second layer message, and achieve end-to-end quantum-level secure transmission.

[0075] The SDN controller 5 is mainly used to uniformly manage the sender routing device 2 and the receiver routing device 3, and also acts as an agent for the application and distribution of quantum keys to ensure that the keys are safely and accurately transmitted to the sender routing device 2 and the receiver routing device 3, while optimizing the scheduling and utilization of network resources.

[0076] The quantum cryptography service platform 6 is the core module in the two-layer message transmission system. It is responsible for the generation, management and distribution of quantum keys, ensuring that every communication is based on anti-cracking quantum keys and providing a high level of security.

[0077] For example, taking the sender routing device 2 as an example, the acquisition of the quantum key is specifically introduced. Specifically, the sender routing device 2 sends a request to obtain the quantum key to the SDN controller 5, and the SDN controller 5 sends the quantum key request to the quantum cryptography service platform 6. The quantum cryptography service platform 6 generates a first quantum key according to the quantum key request, and distributes the first quantum key to the sender routing device 2 via the SDN controller 5; at the same time, the identifier of the first quantum key is distributed to the receiver routing device 3, so that the receiver routing device 3 can obtain the first quantum key from the quantum cryptography service platform 6 using the identifier of the first quantum key in the subsequent decryption process.

[0078] In the layer 2 message transmission method provided in the present application, in order to improve the security of layer 2 message transmission, the IPSec tunnel of the sender routing device 2 can encrypt the payload data in the message to be forwarded based on the first quantum key obtained, generate an encrypted message, and forward the encrypted message to the target receiver routing device; then, the receiver routing device 3 obtains the first quantum key from the quantum cryptography service platform 6 using the identifier of the first quantum key, and the IPSec tunnel of the receiver routing device 3 uses the first quantum key to decrypt the received encrypted message to generate a layer 2 message. In this way, the security of layer 2 message transmission is improved, the integrity and confidentiality of layer 2 messages when traversing the IPv6 network are ensured, and a secure and flexible network communication environment is provided for users.

[0079] Optionally, the entire architecture of the Layer 2 message transmission system proposed in this solution is to carry EVPN VPLS services through SRv6 tunnels, encrypt and decrypt SRv6 messages by combining quantum keys and IPSec to derive quantum enhanced session keys, and use the powerful transmission capabilities of IPv6 networks to safely and efficiently transmit user Layer 2 data. It not only realizes point-to-point and point-to-multipoint connections, but also ensures the integrity and confidentiality of data when traversing the IPv6 network, providing users with a secure and flexible network communication environment.

[0080] Understandably, Figure 1 The structure described above is for illustration only. The layer 2 message transmission system may also include Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0081] The implementation principles and corresponding beneficial effects of the layer 2 message transmission method steps provided in this application will be described below through multiple specific embodiments.

[0082] In one embodiment, reference Figure 2 As shown, a layer 2 message transmission method is provided. Optionally, the execution subject of the method can be Figure 1 The sending routing device and the receiving routing device in the layer 2 message transmission method shown in .

[0083] It should be understood that in other embodiments, the order of some steps in the layer 2 message transmission method can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 2 As shown, the method includes:

[0084] S201: A sending routing device receives a layer 2 message sent by a first user equipment.

[0085] The layer 2 message includes: MAC address and payload data.

[0086] Optionally, the sending routing device U1 may obtain the layer 2 message, that is, the MAC address and the payload data Payload, from a forwarding port on the first user equipment CE1.

[0087] S202: The sending routing device encapsulates the layer 2 message to generate an encapsulated message.

[0088] It can be understood that when the message data is transmitted over the network, when the data is passed down layer by layer from the application layer, each layer will add header information to the outer layer of the message to form a new message format. The added header information includes: source port number, destination port number, etc.

[0089] In this embodiment, the routing device of the sending party can encapsulate the layer 2 message to generate an encapsulated message, that is, the header information of the transport layer can be added to the outer layer of the layer 2 message to generate an encapsulated message. The header information of the transport layer includes: source address, destination address, etc.

[0090] S203. The sending routing device obtains the quantum key forwarded by the SDN controller, and uses the pre-generated original session key and the quantum key to generate a quantum session key.

[0091] Alternatively, considering that the session keys derived from the traditional IPSec protocol cannot effectively resist the attack and cracking of quantum computing, attackers can tamper with messages to achieve the purpose of message hijacking, or attack network devices by forging message information.

[0092] Therefore, in this solution, in order to provide the security of Layer 2 message transmission, it is proposed to introduce quantum keys, that is, the sending routing device sends a request to obtain the quantum key to the SDN controller, and the SDN controller obtains the first quantum key from the quantum cryptography service platform according to the quantum key request, and forwards the first quantum key to the sending routing device; then, the sending routing device fuses the pre-generated original session key with the first quantum key to generate a fused quantum session key, which has the advantage of resisting attacks and cracking by quantum computing.

[0093] S204. The sending routing device uses the quantum session key to encrypt the payload data in the encapsulated message to generate an encrypted message.

[0094] In this embodiment, the sending routing device uses the quantum session key to encrypt the payload data in the encapsulated message to generate an encrypted message. Therefore, in this solution, the quantum key is combined with the pre-derived session key to generate a quantum enhanced session key, and the quantum enhanced session key is used to encrypt the encapsulated message, which improves the anti-quantum cracking ability of the encrypted message, thereby enabling the user's second-layer message data to be transmitted safely and efficiently.

[0095] S205: The sending routing device forwards the encrypted message to the target receiving routing device.

[0096] In one achievable manner, for example, the sending routing device forwards the encrypted message to the target receiving routing device U2 according to the transmission path information of the encrypted message and through SRv6 BE or TE.

[0097] S206. The receiving routing device obtains the quantum key forwarded by the SDN controller.

[0098] S207: The receiving routing device processes the original session key and quantum key that are the same as those of the sending routing device to generate a quantum session key.

[0099] In this example, the SDN controller forwards the first quantum key to the sending routing device and sends the identifier of the first quantum key to the receiving routing device. The receiving routing device sends the identifier of the first quantum key to the SDN controller when decryption is required. The SDN controller obtains the first quantum key from the quantum cryptography service platform according to the identifier of the first quantum key and forwards the first quantum key to the receiving routing device. Then, the receiving routing device fuses the original session key that is the same as the sending routing device with the first quantum key to generate a quantum enhanced session key, namely, a quantum session key.

[0100] S208. The receiving routing device uses the quantum session key to decrypt the payload data in the encrypted message to generate an encapsulated message.

[0101] S209: The receiving routing device decapsulates the encapsulated message to generate a layer 2 message, and forwards the layer 2 message to the second user equipment.

[0102] Optionally, the receiving routing device uses the quantum session key generated above to decrypt the payload data in the received encrypted message to generate an encapsulated message; and decapsulates the encapsulated message, that is, removes the message header of the outer layer of the encapsulated message to generate a layer 2 message, which includes: MAC address and payload data Payload; then, the receiving routing device determines the second forwarding port AC associated with the transmission path information End.DX2 SID in the layer 2 message based on the pre-stored transmission path information End.DX2 SID in the layer 2 message, and forwards the layer 2 message to the second user device CE2 through the second forwarding port. At this point, the secure transmission of the layer 2 message is realized, and the layer 2 message has the ability to resist quantum cracking during the transmission process, which solves the problem of attackers tampering with messages or attacking network devices by forging message information.

[0103] In summary, the embodiment of the present application provides a method for transmitting a layer 2 message. In this scheme, the sending party routing device encapsulates the received layer 2 message to generate an encapsulated message, and combines the quantum key with the original session key to generate a quantum enhanced session key, that is, a quantum session key, to encrypt the payload data in the encapsulated message to generate an encrypted message, and forward the encrypted message to the target receiving party routing device, thereby improving the anti-quantum cracking capability of the encrypted message, thereby enabling the user's layer 2 message data to be transmitted safely and efficiently; then, the target receiving party routing device uses the same quantum session key as the sending party routing device to decrypt and decapsulate the received encrypted message to generate a layer 2 message. At this point, the secure transmission of the layer 2 message is achieved, and the layer 2 message has the ability to resist quantum cracking during the transmission process, which solves the problem of attackers tampering with messages or attacking network devices by forging message information.

[0104] Optionally, the above step S202 includes:

[0105] The SRv6 tunnel of the sending routing device encapsulates the SRv6 message header into the outer layer of the Layer 2 message to generate an encapsulated message. The data packet structure of the encapsulated message includes: SRv6, MAC address and payload data. The SRv6 message includes: destination IPv6 address and source IPv6 address.

[0106] In this embodiment, since it is a forwarding of the layer 2 message, the SRv6 tunnel of the sending routing device U1 can encapsulate the layer 2 message, that is, the sending routing device U1 encapsulates the SRv6 message header for the outer layer of the layer 2 message, wherein the destination IPv6 address in the SRv6 message header is the End.DX2 SID, and the source IPv6 address is the source address of the configured L2VPN over SRv6 encapsulation IPv6 message header. Therefore, the data packet structure of the encapsulated message includes: SRv6, MAC address and payload data.

[0107] Optionally, refer to Figure 3 As shown, in the above step S203, the pre-generated original session key and the quantum key are used to generate the quantum session key, including:

[0108] S301. Determine a key generation method.

[0109] Among them, the key generation method includes: XOR operation or data summary.

[0110] S302: Using a key generation method, the original session key and the quantum key are processed to generate a quantum session key.

[0111] In this embodiment, in order to generate a quantum enhanced session key, any key generation method, such as XOR operation, can be used to fuse the original session key and the quantum key to generate a quantum session key. For example, if the original session key is 101 and the quantum key is 110, then the original session key and the quantum key can be XORed bit by bit, that is, 1^1=0, 0^1=1, 1^0=1, so it can be determined that the generated quantum session key is 011. In this way, the quantum session key can be enhanced to resist quantum cracking.

[0112] Optionally, the above step S204 includes:

[0113] The IPSec tunnel of the sender's routing device uses the quantum session key to securely encrypt the payload data in the encapsulated message, and adds an ESP header to the encapsulated message to generate an encrypted message. The data packet structure of the encrypted message includes: SRv6, ESP, MAC address and payload data.

[0114] In this embodiment, for example, in the transmission mode of the IPSec tunnel, the IPSec tunnel of the sender's routing device encrypts and protects the payload data Payload in the encapsulated message based on the ESP protocol and the quantum session key, and inserts the ESP header between the SRv6 header and the encrypted layer 2 message, and the ESP header contains: the source IP address and the destination IP address of the IPSec tunnel. That is, the IPSec tunnel operates the encapsulated message, encrypts the payload data Payload in the inner layer of SRv6 by ESP, and inserts the ESP header and the ESP-encrypted user data into the inner layer of SRv6.

[0115] Among them, the use of the ESP protocol can provide data encryption and integrity protection, thereby improving the security of Layer 2 message transmission.

[0116] Optionally, the above step S201 includes:

[0117] A layer 2 message is received from a first port of a first user device.

[0118] The first port may also be referred to as an access control interface (Access Control, AC for short).

[0119] After receiving the layer 2 message sent by the first user equipment, the method further includes:

[0120] Transmission path information associated with the first port is determined.

[0121] In one achievable manner, for example, after the first user equipment CE1 receives the layer 2 message, the sender routing device U1 may receive the layer 2 message from the AC1 port of the first user equipment CE1, and search for the SRv6 PW (i.e., the SRv6 tunnel) associated with the AC1 port, and find the transmission path information End.DX2 SID corresponding to the SRv6PW, i.e., the transmission path information End.DX2 SID allocated by the receiving routing device UE2 to the sender routing device U1.

[0122] Optionally, refer to Figure 4 As shown, the above step S205 includes:

[0123] S401. Determine a target receiving routing device according to transmission path information associated with a first port.

[0124] S402: using a preset message forwarding method, forwarding the encrypted message to a target receiver routing device via a wide area network.

[0125] In this embodiment, for example, the sending routing device U1 searches the target IPv6 routing table according to the transmission path information End.DX2SID determined above, and determines the target receiving routing device of the layer 2 message to be received according to the target IPv6 routing table, and forwards the encrypted message to the target receiving routing device U2 via the wide area network through a preset message forwarding method, such as SRv6BE or TE. Therefore, the sending routing device U1 forwards the layer 2 message encapsulated by SRv6 and encrypted by IPSec to the receiving routing device U2 in the wide area network.

[0126] The following embodiments will explain in detail how the receiving routing device decrypts and decapsulates the received encrypted message to generate a layer 2 message.

[0127] Optionally, the above step S208 includes:

[0128] The IPSec tunnel of the receiving router uses the quantum session key to decrypt the encrypted message and remove the ESP header in the encrypted message to generate an encapsulated message.

[0129] In this embodiment, for example, in the transmission mode of the IPSec tunnel, the IPSec tunnel of the receiving routing device U2 uses the quantum session key to decrypt the encrypted message, and removes the ESP header in the encrypted message to generate an encapsulated message.

[0130] Optionally, the above step S209 includes:

[0131] The SRv6 tunnel of the receiving routing device decapsulates the SRv6 packet in the outer layer of the encapsulated Layer 2 packet to generate a Layer 2 packet.

[0132] In this embodiment, the receiving routing device U2 searches the local node Local SID table according to the pre-stored transmission path information End.DX2 SID to obtain the SRv6 message, and then decapsulates the SRv6 message in the outer layer of the encapsulated layer 2 message through the SRv6 tunnel to generate a layer 2 message.

[0133] Optionally, the above step S210 includes:

[0134] According to the transmission path information pre-stored on the receiving party routing device, a second port on the second user device is determined; and the layer 2 message is forwarded to the second port on the second user device.

[0135] In this embodiment, the receiving routing device U2 finds the second port associated with the transmission path information End.DX2 SID, namely AC2, according to the pre-stored transmission path information End.DX2 SID, and forwards the layer 2 message to the second user equipment CE2 through A2. Thus, the secure transmission of the layer 2 message is realized.

[0136] Optionally, refer to Figure 5 As shown, it is a flowchart of layer 2 message encapsulation and decapsulation provided by the present application, and the method includes:

[0137] Step 1: The first user equipment CE1 sends the layer 2 message to the sending routing device U1;

[0138] Step 2: After receiving the Layer 2 message from the AC1 port of the first user equipment CE1, the sending routing device U1 searches for the SRv6 tunnel associated with the AC1 port and determines the transmission path information End.DX2 SID corresponding to the SRv6 tunnel.

[0139] In the third step, the SRv6 tunnel of the sending routing device U1 encapsulates the outer layer of the Layer 2 message with an SRv6 message header to generate an encapsulated message.

[0140] The SRv6 packet header includes: destination IPv6 address and source IPv6 address. The destination IPv6 address is End.DX2SID, and the source IPv6 address is the source address of the configured L2VPN over SRv6 encapsulation IPv6 packet header.

[0141] Step 4: The IPSec tunnel (transmission mode) on the sender routing device U1 uses the quantum session key to encrypt the payload data in the encapsulated message (i.e., the original layer 2 message), and inserts the ESP header between the SRv6 message header and the original layer 2 message to generate an encrypted message.

[0142] Among them, the quantum session key is generated based on the fusion of the original session key and the quantum key forwarded by the SDN controller. That is, by integrating the true random characteristics of the quantum key with the IPSec protocol, the quantum enhanced session key shared by the communicating devices is dynamically generated and used to build the IPSec tunnel. This session key with integrated quantum characteristics is applied to the encryption and decryption process of information transmission, which significantly improves the security level of data exchange, effectively resists the potential risk of leakage of sensitive information, and provides unprecedented security for critical communications.

[0143] Step 5: The sending routing device U1 searches the IPv6 routing table according to the pre-stored transmission path information End.DX2SID, determines the target receiving routing device U2, and forwards the encrypted message to the target receiving routing device U2 through the SRv6 BE or TE message forwarding method;

[0144] Step 6: The IPSec tunnel (transmission mode) on the target receiving router U2 uses the same quantum session key as the sending router to decrypt the encrypted message and remove the ESP header in the encrypted message to generate an encapsulated message.

[0145] Step 7: The target receiving routing device U2 searches the local node Local SID table according to the pre-stored transmission path information End.DX2 SID, determines the SRv6 message header to be removed, and decapsulates the SRv6 message header of the outer layer of the encapsulated Layer 2 message through the SRv6 tunnel of the receiving routing device to generate a Layer 2 message, matches the AC2 associated with it according to the transmission path information End.DX2 SID, and forwards the Layer 2 message to the second user equipment CE2 through the AC2.

[0146] It can be seen that in the layer 2 message transmission method provided by this scheme, the first user device CE1 sends a layer 2 message to the sending routing device U1, and the SRv6 tunnel on the sending routing device U1 adds an SRv6 header to the layer 2 message to generate an encapsulated message; then the IPSec tunnel on the sending routing device U1 performs ESP encryption on the payload data Payload in the inner layer of the encapsulated message, and the ESP header and the ESP-encrypted user data are placed in the SRv6 inner layer. After the IPSec-encrypted message is forwarded to the target receiving routing device U2 in the wide area network, the IPSec tunnel on the target receiving routing device U2 first decrypts the encrypted message, then removes the SRv6 encapsulation to restore it to the original layer 2 message, and then forwards it to the second user device CE2. Therefore, this scheme proposes a method for protecting the encryption and decryption transmission of layer 2 messages by integrating the IPSec protocol with quantum keys and combining L2VPN and SRv6 technologies, which significantly improves the security level of data exchange, effectively resists the potential risk of leakage of sensitive information, and provides unprecedented security protection for critical communications.

[0147] Optionally, the present invention also provides a program product, such as a computer-readable storage medium, comprising a program, which is used to execute the above method embodiment when executed by a processor.

[0148] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0149] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0150] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0151] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), disk or optical disk and other media that can store program codes.

Claims

1. A layer 2 message transmission method, characterized in that: Applied to a routing device of a sender, the method comprises: Receiving a layer 2 message sent by a first user equipment, wherein the layer 2 message includes: a MAC address and payload data; Encapsulating the layer 2 message to generate an encapsulated message; Obtain the quantum key forwarded by the SDN controller and generate a quantum session key using the pre-generated original session key and the quantum key; The payload data in the encapsulated message is encrypted using the quantum session key to generate an encrypted message, and the encrypted message is forwarded to a target recipient routing device.

2. The method according to claim 1, characterized in that The step of encapsulating the layer 2 message to generate an encapsulated message includes: The SRv6 tunnel of the sending routing device encapsulates an SRv6 message header into the outer layer of the layer 2 message to generate an encapsulated message, wherein the data packet structure of the encapsulated message includes: SRv6, MAC address and payload data, and the SRv6 message header includes: destination IPv6 address and source IPv6 address.

3. The method according to claim 1, characterized in that The method of using the pre-generated original session key and the quantum key to generate the quantum session key comprises: Determine a key generation method, wherein the key generation method includes: XOR operation or data summary; The key generation method is used to process the original session key and the quantum key to generate the quantum session key.

4. The method according to claim 1, characterized in that The step of encrypting the encapsulated message using the quantum session key to generate an encrypted message includes: The IPSec tunnel of the sender routing device uses the quantum session key to securely encrypt the payload data in the encapsulated message, and adds an ESP header to the encapsulated message to generate the encrypted message, wherein the data packet structure of the encrypted message includes: SRv6, ESP, MAC address and payload data.

5. The method according to claim 1, characterized in that The receiving a layer 2 message sent by the first user equipment includes: Receiving the layer 2 message from the first port of the first user equipment; After receiving the layer 2 message sent by the first user equipment, the method further includes: Determine transmission path information associated with the first port.

6. The method according to claim 5, characterized in that The step of forwarding the encrypted message to a target receiver routing device includes: Determining a target receiving party routing device according to the transmission path information associated with the first port; The encrypted message is forwarded to the target recipient routing device via the wide area network using a preset message forwarding method.

7. A message transmission method, characterized in that: Applied to a receiving routing device, the method includes: Receiving the encrypted message forwarded by the sending routing device; Obtain the quantum key forwarded by the SDN controller; Processing the original session key identical to the sending routing device and the quantum key to generate a quantum session key; Decrypting the payload data in the encrypted message using the quantum session key to generate an encapsulated message; Decapsulating the encapsulated message to generate a layer 2 message, wherein the layer 2 message includes: a MAC address and payload data; The layer 2 message is forwarded to the second user equipment.

8. The method according to claim 7, characterized in that The decrypting the encrypted message using the quantum session key to generate an encapsulated message includes: The IPSec tunnel of the receiver's routing device uses the quantum session key to decrypt the encrypted message, remove the ESP header in the encrypted message, and generate the encapsulated message.

9. The method according to claim 7, characterized in that: The decapsulating the encapsulated message to generate a layer 2 message includes: The SRv6 tunnel of the receiving routing device decapsulates the SRv6 message header of the outer layer of the encapsulated layer 2 message to generate the layer 2 message.

10. The method according to claim 7, characterized in that The forwarding of the layer 2 message to the second user equipment includes: Determine a second port on the second user device according to the transmission path information pre-stored on the receiving party routing device; The layer 2 message is forwarded to the second port on the second user equipment.

11. A layer 2 message transmission system, characterized in that: The system includes: a first user device, a sender routing device, a receiver routing device, a second user device, an SDN controller and a quantum cryptography service platform; The sending party routing device is connected to the receiving party routing device via a wide area network communication; The SDN controller is respectively connected to the sender routing device, the receiver routing device, and the quantum cryptography service platform for communication, and is used to obtain a quantum key from the quantum cryptography service platform, and distribute the obtained quantum key to the sender routing device and the receiver routing device; The sender routing device is used to execute the method according to any one of claims 1 to 6 above; The receiving routing device is used to execute the method described in any one of claims 7 to 10.

Images