Switch communication cryptographic encryption and decryption system and method

Abstract

The invention relates to the technical field of internal and external network data transmission encryption, provides a switch communication national secret encryption and decryption system and method, and aims to solve the problems that in the prior art, an encryption and decryption device is hung outside each network port of a link layer, and high cost is undoubtedly caused; and the technical problem that traditional encryption and decryption equipment often does not have high configurability is solved. Comprising a switch and a cipher machine. The switch provides a plurality of Ethernet ports, including a gigabit optical port and a 100M electrical port; the switch is used for managing data streams among the plurality of Ethernet ports, realizing uplink communication of data through the gigabit optical port, and realizing downlink communication of data through the 100M electrical port; and the cipher machine is connected with the switch and is used for encrypting or decrypting the data transmitted in the switch.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption for internal and external networks, and in particular relates to a national encryption and decryption system and method for switch communication. Background Art

[0002] With the rapid development of computer technology, computer communication technology has penetrated into our work and life. We use computers to transmit and exchange a lot of information every day. However, in some institutions that have extremely high requirements for network security, such as military departments and scientific research units, in order to ensure information security, trusted networks are usually physically isolated from untrusted networks. Although this isolation effectively prevents potential security threats, it also brings new challenges: when users need to access resources in untrusted networks from trusted networks, how to ensure information security while meeting the needs of information exchange has become an urgent problem to be solved.

[0003] In the prior art, encryption and decryption devices are installed on each computer connected to the trusted network, and these devices are used to encrypt and decrypt incoming and outgoing data messages. This method can encrypt communication data at the network boundary without changing the existing network structure or redeploying other network devices, thereby protecting the security of data transmission.

[0004] The prior art has the following technical problems:

[0005] 1. Adding an encryption and decryption device to each network port at the link layer will undoubtedly lead to high costs, which is a considerable burden for large-scale deployment.

[0006] 2. Traditional encryption and decryption equipment is often not highly configurable, which means that once the environment changes or security requirements are upgraded, it is difficult to quickly adapt to the new situation, resulting in a lag in security protection. Summary of the invention

[0007] The present invention provides a switch communication national secret encryption and decryption system and method, aiming to solve the technical problems existing in the above-mentioned prior art that each network port at the link layer is externally connected with an encryption and decryption device, which undoubtedly leads to high cost expenditure, which is a considerable burden for large-scale deployment; and traditional encryption and decryption devices often do not have a high degree of configurability, which means that once the environment changes or security requirements are upgraded, it is difficult to quickly adapt to the new situation, resulting in lagging security protection.

[0008] The technical solution of the present invention to solve the above technical problem is as follows: a switch communication national cipher encryption and decryption system, including a switch and a cipher machine;

[0009] The switch provides multiple Ethernet ports, including a Gigabit optical port and a 100M electrical port, wherein the Gigabit optical port is used to communicate with an external network, and the 100M electrical port is used to connect to a terminal device in an internal network;

[0010] The switch is used to manage the data flow between the plurality of Ethernet ports, and receive the encrypted downlink data transmitted from the external network through the Gigabit optical port, and transmit the decrypted downlink data to the internal network through the 100M electrical port;

[0011] The switch is also used for receiving unencrypted uplink data transmitted by the internal network through the 100M electrical port, and transmitting the encrypted uplink data to the external network through the 100M optical port;

[0012] The cipher machine is connected to the switch and is used to encrypt the uplink data transmitted in the switch or decrypt the downlink data transmitted.

[0013] Furthermore, the switch includes a decryption port G1 and a decryption port G2, and the cipher machine includes an internal network port P1 and an external network port P2;

[0014] Decryption port G2, connected to the external network port P2, for receiving the downlink data from the Gigabit optical port and sending it to the cipher machine for decryption processing;

[0015] The external network port P2 is used to receive the downlink data and submit it to the cipher machine for decryption processing to obtain decrypted data;

[0016] Intranet port P1, connected to the decryption port G1, for transmitting the decrypted data to the switch;

[0017] The decryption port G1 is used to receive the decrypted data and transmit the decrypted data to the 100M electrical port.

[0018] Furthermore, the decryption port G1 is also used to receive the uplink data from the 100M electrical port and send it to the cipher machine for encryption processing;

[0019] The internal network port P1 is also used for the uplink data, and is submitted to the encryption machine for encryption processing to obtain encrypted data;

[0020] The external network port P2 is also used to transmit the encrypted data to the switch;

[0021] The decryption port G2 is also used to receive the encrypted data and transmit the encrypted data to the Gigabit optical port.

[0022] Further, for the encryption processing of uplink data, the cipher machine includes:

[0023] Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine;

[0024] The data encryption and decryption module is used to generate a session key and encrypt the uplink data received by the internal network port P1 according to a preset encryption algorithm to obtain encrypted data;

[0025] The data output module is used to output the encrypted data to the external network port P2.

[0026] Further, for the decryption process of downlink data, the cipher comprises:

[0027] Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine;

[0028] The data encryption and decryption module is also used to generate a session key, and set the preset encryption algorithm to a decryption mode, decrypt the downlink data received by the external network port P2 to obtain decrypted data;

[0029] The data output module is also used to output the decrypted data to the internal network port P1.

[0030] In a second aspect, the present invention provides a method for encrypting and decrypting national secrets in switch communication, which is applied to a system for encrypting and decrypting national secrets in switch communication of the present invention, comprising:

[0031] Acquire uplink data of uplink communication and downlink data of downlink communication by using the Ethernet port of the switch, and transmit the uplink data and the downlink data to the cryptographic machine;

[0032] Using the cipher machine to encrypt the uplink data to obtain encrypted data, and transmitting the encrypted data to the switch; and using the cipher machine to decrypt the downlink data to obtain decrypted data, and transmitting the decrypted data to the cipher machine;

[0033] The encrypted data and the decrypted data are received by a switch, and are transmitted to an external network and an internal network respectively through an Ethernet port.

[0034] Furthermore, the switch includes a decryption port G1 and a decryption port G2, and the cipher includes an internal network port P1 and an external network port P2; the specific process of downlink communication is:

[0035] Utilize the decryption port G2 to receive the encrypted downlink data transmitted from the external network, and transmit the downlink data to the external network port P2;

[0036] Receive the downlink data by using the external network port P2, and submit it to the cipher machine for decryption processing to obtain decrypted data, and transmit the decrypted data to the decryption port G1 through the internal network port P1;

[0037] The decrypted data is received by the decryption port G1 and transmitted to the internal network through the switch.

[0038] Furthermore, the specific process of the above uplink communication is as follows:

[0039] Receive unencrypted uplink data transmitted by the internal network using the decryption port G1, and transmit the uplink data to the internal network port P1;

[0040] Receive the uplink data by using the internal network port P1, and submit it to the cipher machine for encryption processing to obtain encrypted data, and transmit the encrypted data to the decryption port G2 through the external network port P2;

[0041] The encrypted data is received by the decryption port G2 and transmitted to the external network through the switch.

[0042] Furthermore, the specific process of using the cipher machine to encrypt the uplink data is as follows:

[0043] Initialize the cipher machine and load the configuration parameters of the cipher machine;

[0044] Generate a session key using a data encryption module, and encrypt the uplink data received by the internal network port P1 according to a preset encryption algorithm to obtain encrypted data;

[0045] The encrypted data is output to the external network port P2.

[0046] Furthermore, the specific process of using the cipher machine to decrypt the downlink data is as follows:

[0047] Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine;

[0048] Using the data decryption module, a session key is generated, and the preset encryption algorithm is set to the decryption mode to decrypt the downlink data received by the external network port P2 to obtain decrypted data;

[0049] The decrypted data is output to the intranet port P1.

[0050] Compared with the prior art, the present invention has the following advantages:

[0051] 1. The system of the present invention includes a switch with multiple types of Ethernet ports and a cryptographic machine connected thereto. Since the encryption and decryption processing is concentrated on the cryptographic machine, there is no need to deploy encryption and decryption equipment on each network port, which greatly reduces the hardware cost of the overall system.

[0052] 2. The cipher machine can dynamically adjust the encryption strategy according to different security requirements, enhancing the flexibility and adaptability of the system.

[0053] 3. Using a dedicated cipher machine to handle encryption tasks not only improves the security of data transmission, but also reduces network delays and improves overall communication efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 It shows a schematic diagram of the structure of a national encryption and decryption system for switch communication according to an embodiment of the present invention;

[0056] Figure 2 A schematic diagram of the process of a method for encrypting and decrypting national secrets in switch communication according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] Figure 1 FIG. 4 shows a schematic diagram of a switch communication encryption and decryption system according to an embodiment of the present invention. Figure 1 As shown, a switch communication national cipher encryption and decryption system according to an embodiment of the present invention includes:

[0059] a switch and a cipher machine;

[0060] The switch provides multiple Ethernet ports, including a Gigabit optical port and a 100M electrical port;

[0061] The switch is used to manage data flows between multiple Ethernet ports, and implements uplink data communication (e.g., connecting to a core network or the Internet) through a Gigabit optical port, and implements downlink data communication (e.g., connecting to a terminal device or other network component in a local network) through a 100M electrical port. The switch determines the forwarding path of a data frame by identifying a MAC address, and optimizes network traffic management;

[0062] The cipher machine is connected to the switch and is used to encrypt or decrypt data transmitted through the switch to ensure the security and integrity of the data during transmission. The cipher machine works in a transparent encryption mode and can encrypt data streams without changing the existing network architecture.

[0063] Among them, encryption processing protects the security of data and prevents unauthorized access; decryption processing ensures that the recipient can correctly read the encrypted information.

[0064] In this embodiment, a Gigabit optical port refers to a port that supports optical fiber connection and can provide a maximum data transmission rate of 1Gbps. This port is usually used for high-speed data transmission, especially in long-distance transmission or application scenarios with high bandwidth requirements. A 100M electrical port refers to a port that uses a twisted pair (usually UTP or STP cable) to connect and supports a maximum transmission rate of 100Mbps. This port is more common in a local area network and is suitable for connecting devices such as PCs and printers.

[0065] In this embodiment, the switch can be the switch RTL8332M I-VB-CG of Realtek, which has 24 100M ports and 4 1000M ports built in; the switch RTL8332M I-VB-CG provides 2 1000M optical ports for uplink communication and 8 100M electrical ports for downlink communication.

[0066] Optionally, the switch includes a decryption port G1 and a decryption port G2, and the cryptographic machine includes an internal network port P1 and an external network port P2;

[0067] Decryption port G2, connected to the external network port P2, for receiving the downlink data from the Gigabit optical port and sending it to the cipher machine for decryption processing;

[0068] The external network port P2 is used to receive the downlink data and submit it to the cipher machine for decryption processing to obtain decrypted data;

[0069] Intranet port P1, connected to the decryption port G1, for transmitting the decrypted data to the switch;

[0070] The decryption port G1 is used to receive the decrypted data and transmit the decrypted data to the 100M electrical port.

[0071] Optionally, the decryption port G1 is also used to receive the uplink data from the 100M electrical port and send it to the cipher machine for encryption processing;

[0072] The internal network port P1 is also used for the uplink data, and is submitted to the encryption machine for encryption processing to obtain encrypted data;

[0073] The external network port P2 is also used to transmit the encrypted data to the switch;

[0074] The decryption port G2 is also used to receive the encrypted data and transmit the encrypted data to the Gigabit optical port.

[0075] Optionally, for encryption processing of uplink data, the cryptographic machine includes:

[0076] Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine;

[0077] The data encryption and decryption module is used to generate a session key and encrypt the uplink data received by the internal network port P1 according to a preset encryption algorithm to obtain encrypted data;

[0078] The data output module is used to output the encrypted data to the external network port P2.

[0079] In this embodiment, the encryption algorithm includes SM series algorithms, such as SM2 public key encryption algorithm, SM3 hash algorithm, SM4 symmetric encryption algorithm, etc. The selection of a specific encryption algorithm depends on the application requirements and security requirements on site.

[0080] Cryptographic machines manage and store keys through a secure key management system. Key security is the core of the entire encryption process, so key generation, storage, distribution and destruction must strictly comply with security specifications.

[0081] In this embodiment, an encryption process based on session management is provided, which is applicable to the encryption process of a cipher machine in processing data encryption from an internal network to an external network, specifically:

[0082] 1. Get data from the intranet port:

[0083] The cipher machine receives unencrypted data packets from the internal network through the internal network port P1.

[0084] 2. Get the five-tuple of IP through the datagram:

[0085] Analyze the data message and extract the source IP address, destination IP address, source port number, destination port number and protocol type (TCP or UDP, etc.), which is called the IP quintuple.

[0086] 3. Query the session based on the five-tuple:

[0087] Check the session table inside the cipher machine to see if there is a session record corresponding to the current five-tuple.

[0088] If the session does not exist, create a new session record and proceed to the next step.

[0089] If the session exists, jump to step (4).

[0090] 4. Check the legitimacy of the session key:

[0091] Verify that the key used for the current session is still valid (for example, whether the key has expired or been revoked).

[0092] If the session key is invalid, the key negotiation process is initiated to generate a new session key.

[0093] If the session key is valid, proceed to the next step.

[0094] 5. Check the length of the data message in groups according to the length of the session key group encryption:

[0095] According to the requirements of the encryption algorithm (such as packet size), check whether the length of the data message meets the encryption standard.

[0096] If the data message length does not meet the requirements, it may need to be padded or split to meet the requirements of the encryption algorithm.

[0097] 6. Use the session key to encrypt the data message in groups and generate the encrypted payload:

[0098] The data message is encrypted using the session key to generate an encrypted data payload.

[0099] 7. Send the IP message and encrypted payload to the external network port:

[0100] The original IP message header and the encrypted data payload are combined to form a new encrypted message.

[0101] The encrypted data message is sent to the external network through the external network port P2.

[0102] In this embodiment, when the session key is illegal, the cipher machine needs to establish a new session key with the external entity through a key negotiation protocol (such as the Diffie-Hellman protocol). This process should ensure the secure exchange of keys. The encryption algorithm selects the SM4 algorithm. The cipher machine maintains a session table to record the status information of all active sessions, including session ID, key, validity period, etc.

[0103] Optionally, a data integrity verification process is also added, using HMAC or digital signature technology to ensure that the data has not been tampered with during transmission.

[0104] Optionally, for decryption processing of downlink data, the cryptographic machine includes:

[0105] Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine;

[0106] The data encryption and decryption module is also used to generate a session key, and set the preset encryption algorithm to a decryption mode, decrypt the downlink data received by the external network port P2 to obtain decrypted data;

[0107] The data output module is also used to output the decrypted data to the internal network port P1.

[0108] Based on Figure 1 The same principle as the method shown in the embodiment of the present invention, the embodiment of the present invention also provides a switch communication national key encryption and decryption method, which is applied to a switch communication national key encryption and decryption system of the present invention, such as Figure 2 As shown, including:

[0109] Acquire uplink data of uplink communication and downlink data of downlink communication by using the Ethernet port of the switch, and transmit the uplink data and the downlink data to the cryptographic machine;

[0110] Using the cipher machine to encrypt the uplink data to obtain encrypted data, and transmitting the encrypted data to the switch; and using the cipher machine to decrypt the downlink data to obtain decrypted data, and transmitting the decrypted data to the cipher machine;

[0111] The encrypted data and the decrypted data are received by a switch, and are transmitted to an external network and an internal network respectively through an Ethernet port.

[0112] In this embodiment, the cipher generates and distributes the session key (WSK) through the key management protocol to ensure that the correct key is used for each encryption and decryption operation. During the encryption and decryption process, the cipher also generates a message digest to verify the integrity of the data to ensure that the data has not been tampered with during transmission.

[0113] Optionally, the switch includes a decryption port G1 and a decryption port G2, and the cipher includes an internal network port P1 and an external network port P2; the specific process of downlink communication is:

[0114] Utilize the decryption port G2 to receive the encrypted downlink data transmitted from the external network, and transmit the downlink data to the external network port P2;

[0115] Receive the downlink data by using the external network port P2, and submit it to the cipher machine for decryption processing to obtain decrypted data, and transmit the decrypted data to the decryption port G1 through the internal network port P1;

[0116] The decrypted data is received by the decryption port G1 and transmitted to the internal network through the switch.

[0117] Optionally, the specific process of uplink communication is:

[0118] Receive unencrypted uplink data transmitted by the internal network using the decryption port G1, and transmit the uplink data to the internal network port P1;

[0119] Receive the uplink data by using the internal network port P1, and submit it to the cipher machine for encryption processing to obtain encrypted data, and transmit the encrypted data to the decryption port G2 through the external network port P2;

[0120] The encrypted data is received by the decryption port G2 and transmitted to the external network through the switch.

[0121] Optionally, the specific process of using the cipher machine to encrypt the uplink data is:

[0122] 1. Initialization:

[0123] The cipher machine is started and the necessary configuration parameters are loaded, including encryption algorithm type, key length, etc.

[0124] The user or system administrator enters or selects a master key.

[0125] 2. Key management:

[0126] If necessary, the cryptographic machine generates one or more session keys for this encryption operation. These session keys are usually temporary and valid only in this encryption session.

[0127] The cipher machine uses the master key to protect the session key, for example by encrypting the session key.

[0128] 3. Data preparation:

[0129] The uplink data to be encrypted is sent to the input buffer of the cipher machine.

[0130] Perform preprocessing steps on the data, padding it to meet the requirements of the block cipher algorithm, or adding an initialization vector (IV) to support encryption in CBC mode or other modes.

[0131] 4. Encryption process:

[0132] The uplink data is encrypted using the selected encryption algorithm and session key.

[0133] The data blocks are sequentially passed through multiple iterations of the algorithm to produce the encrypted output.

[0134] 5. Data output:

[0135] The encrypted data is output to the external network port P2.

[0136] Optionally, the specific process of using the cipher machine to decrypt the downlink data is:

[0137] 1. Initialization:

[0138] As with the encryption process, the cipher machine is initialized and the necessary configuration parameters are loaded.

[0139] 2. Key management:

[0140] The master key is loaded into the cipher machine and the session key is first decrypted using the master key.

[0141] 3. Data preparation:

[0142] The encrypted downlink data is sent to the input buffer of the cipher machine.

[0143] 4. Decryption process:

[0144] The downlink data is decrypted using the same encryption algorithm (but in decryption mode) and the same session key.

[0145] The data blocks are decrypted and iterated by the algorithm in turn, and finally restored to the original plaintext data.

[0146] 5. Data output:

[0147] The decrypted data is output to the intranet port P1.

[0148] The above description is only a preferred embodiment of the present invention and an explanation of the technical principles used. Those skilled in the art should understand that the disclosure scope involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) by each other.

Claims

1. A national encryption and decryption system for switch communication, characterized in that: Includes a switch and a cipher machine; The switch provides multiple Ethernet ports, including a Gigabit optical port and a 100M electrical port. The Gigabit optical port is used to communicate with an external network, and the 100M electrical port is used to connect to a terminal device in an internal network. The switch is used to manage the data flow between the plurality of Ethernet ports, and receive the encrypted downlink data transmitted from the external network through the Gigabit optical port, and transmit the decrypted downlink data to the internal network through the 100M electrical port; The switch is also used for receiving unencrypted uplink data transmitted by the internal network through the 100M electrical port, and transmitting the encrypted uplink data to the external network through the 100M optical port; The cipher machine is connected to the switch and is used to encrypt the uplink data transmitted in the switch or decrypt the downlink data transmitted.

2. A switch communication national secret encryption and decryption system according to claim 1, characterized in that: The switch includes a decryption port G1 and a decryption port G2, and the cipher machine includes an internal network port P1 and an external network port P2; Decryption port G2, connected to the external network port P2, for receiving the downlink data from the Gigabit optical port and sending it to the cipher machine for decryption processing; The external network port P2 is used to receive the downlink data and submit it to the cipher machine for decryption processing to obtain decrypted data; Intranet port P1, connected to the decryption port G1, for transmitting the decrypted data to the switch; The decryption port G1 is used to receive the decrypted data and transmit the decrypted data to the 100M electrical port.

3. A switch communication national secret encryption and decryption system according to claim 2, characterized in that: The decryption port G1 is also used to receive the uplink data from the 100M electrical port and send it to the cipher machine for encryption processing; The internal network port P1 is also used for the uplink data, and is submitted to the encryption machine for encryption processing to obtain encrypted data; The external network port P2 is also used to transmit the encrypted data to the switch; The decryption port G2 is also used to receive the encrypted data and transmit the encrypted data to the Gigabit optical port.

4. A switch communication national secret encryption and decryption system according to claim 3, characterized in that: For the encryption processing of uplink data, the cipher machine includes: Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine; The data encryption and decryption module is used to generate a session key and encrypt the uplink data received by the internal network port P1 according to a preset encryption algorithm to obtain encrypted data; The data output module is used to output the encrypted data to the external network port P2.

5. A switch communication national secret encryption and decryption system according to claim 4, characterized in that: For decryption processing of downlink data, the cipher machine includes: Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine; The data encryption and decryption module is also used to generate a session key, and set the preset encryption algorithm to a decryption mode, decrypt the downlink data received by the external network port P2 to obtain decrypted data; The data output module is also used to output the decrypted data to the internal network port P1.

6. A method for encrypting and decrypting national secrets in switch communication, applied to a system for encrypting and decrypting national secrets in switch communication as claimed in any one of claims 1 to 5, characterized in that: include: Acquire uplink data of uplink communication and downlink data of downlink communication by using the Ethernet port of the switch, and transmit the uplink data and the downlink data to the cryptographic machine; Using the cipher machine to encrypt the uplink data to obtain encrypted data, and transmitting the encrypted data to the switch; and using the cipher machine to decrypt the downlink data to obtain decrypted data, and transmitting the decrypted data to the cipher machine; The encrypted data and the decrypted data are received by a switch, and are transmitted to an external network and an internal network respectively through an Ethernet port.

7. A method for encrypting and decrypting national secrets in switch communication according to claim 6, characterized in that: The switch includes a decryption port G1 and a decryption port G2, and the cipher includes an internal network port P1 and an external network port P2; the specific process of downlink communication is: Utilize the decryption port G2 to receive the encrypted downlink data transmitted from the external network, and transmit the downlink data to the external network port P2; Receive the downlink data by using the external network port P2, and submit it to the cipher machine for decryption processing to obtain decrypted data, and transmit the decrypted data to the decryption port G1 through the internal network port P1; The decrypted data is received by the decryption port G1 and transmitted to the internal network through the switch.

8. A method for encrypting and decrypting national secrets in switch communication according to claim 6, characterized in that: The specific process of uplink communication is as follows: Receive unencrypted uplink data transmitted by the internal network using the decryption port G1, and transmit the uplink data to the internal network port P1; Receive the uplink data by using the internal network port P1, and submit it to the cipher machine for encryption processing to obtain encrypted data, and transmit the encrypted data to the decryption port G2 through the external network port P2; The encrypted data is received by the decryption port G2 and transmitted to the external network through the switch.

9. A method for encrypting and decrypting national secrets in switch communication according to claim 8, characterized in that: The specific process of using the cipher machine to encrypt the uplink data is as follows: Initialize the cipher machine and load the configuration parameters of the cipher machine; Generate a session key using a data encryption module, and encrypt the uplink data received by the internal network port P1 according to a preset encryption algorithm to obtain encrypted data; The encrypted data is output to the external network port P2.

10. A method for encrypting and decrypting national secrets in switch communication according to claim 9, characterized in that: The specific process of using the cipher machine to decrypt the downlink data is as follows: Initialization module, used to initialize the cipher machine and load the configuration parameters of the cipher machine; Using the data decryption module, a session key is generated, and the preset encryption algorithm is set to the decryption mode to decrypt the downlink data received by the external network port P2 to obtain decrypted data; The decrypted data is output to the intranet port P1.

Images