Data transmission method of quantum security firewall

Abstract

The invention discloses a data transmission method of a quantum security firewall, and the method comprises the following steps: the quantum security firewall creates N virtual interfaces corresponding to a local physical network port, and allocates a corresponding IP address to each virtual interface; the quantum key service device distributes symmetrical key files to the quantum security firewall and each extranet device in the extranet device cluster; and the xth extranet equipment generates a communication data packet MES sent to the yth intranet equipment by using a local key file, the communication data packet MES is sent to a first current virtual interface of the quantum security firewall, and the quantum security firewall judges whether an IP address needs to be switched so as to switch to a second current virtual interface for transmission of the communication data packet MES. According to the method, the real IP address of the firewall is comprehensively protected through combination of technologies such as physical interface hiding, flow management, dynamic path selection and efficient hash verification, and targeted attacks are resisted.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a data transmission method of quantum security firewall. BACKGROUND

[0002] As a core network security system, the firewall is responsible for monitoring and controlling network traffic, and deciding the transmission permission of data packets according to preset security rules. Its main function is to protect the internal network from external threats, prevent unauthorized access, and build a security barrier between the enterprise network and the Internet. By performing traffic filtering, resisting malicious attacks, and recording network activities, the firewall significantly enhances the security and stability of the network, and becomes an indispensable first line of defense in various network environments.

[0003] In actual operation, the firewall needs to continuously communicate and interact with internal and external network devices. At present, such communication generally relies on the real IP address of the firewall physical network port for addressing and data routing. However, this real IP-based communication mechanism has significant security risks: the real IP address of the firewall is extremely easy to expose during network interaction. Once this address is obtained by malicious parties, attackers can launch targeted distributed denial of service (DDOS) attacks, directly impacting the processing capacity of the firewall by constructing a large number of invalid access requests.

[0004] Such attacks can cause multiple hazards: first, the firewall may crash due to resource overload when subjected to DDOS attacks, causing it to lose its security protection function and exposing the internal network to threats; second, even if the firewall fails to completely block attack traffic, a large number of invalid requests may still penetrate the internal network, unnecessarily consuming the processing resources of the terminal server and affecting normal business operation; third, since the core responsibility of the firewall is traffic filtering and security checking, it needs to handle a large number of requests during DDOS attacks, which is likely to form a performance bottleneck. How to ensure the continuous and stable operation of the firewall under high-intensity attacks has become a key technical problem in the current network security field that needs to be solved.

[0005] Therefore, there is a lack of effective concealment and protection mechanism for the real IP address of the firewall in the prior art, which makes it difficult to deal with the risk of targeted DDOS attacks caused by IP exposure. There is an urgent need for a technical solution that can effectively protect the real IP address of the firewall and enhance its anti-attack capability while maintaining its normal communication and filtering functions, to ensure the continuity and overall security of network services. SUMMARY

[0006] The present application provides a data transmission method of quantum security firewall to solve the problems mentioned in the background.

[0007] Technical solution: The application provides a data transmission method of a quantum security firewall, the participants of the method include an intranet device cluster, a quantum security firewall, a quantum key service device, and an extranet device cluster, wherein the intranet device cluster includes n intranet devices including a yth intranet device, and the extranet device cluster includes m extranet devices including an xth extranet device; the method includes the following steps:

[0008] Step 1: The quantum security firewall creates N virtual interfaces corresponding to the local physical network port, and allocates a corresponding IP address to each virtual interface;

[0009] Step 2: The quantum key service device distributes symmetric key files to the quantum security firewall and each extranet device in the extranet device cluster;

[0010] Step 3: The xth extranet device uses the local key file to generate a communication data packet MES sent to the yth intranet device, and sends the communication data packet MES to the first current virtual interface of the quantum security firewall, and the quantum security firewall judges whether it needs to switch the IP address to switch to the second current virtual interface to transmit the communication data packet MES.

[0011] As an improvement of the application, the specific process of step 2 includes:

[0012] The quantum key service device distributes symmetric first key file file1 to mth key file filem to the quantum security firewall and each extranet device in the extranet device cluster based on the identity ID1 to IDm of each extranet device in the extranet device cluster;

[0013] The quantum key service device establishes an association relationship between the identity of each extranet device and the key file, and sends the association relationship to the quantum security firewall;

[0014] The quantum security firewall corresponds the received first key file file1 to mth key file filem to each extranet device based on the association relationship.

[0015] As an improvement of the application, the generation process of the communication data packet MES includes:

[0016] Step 3-1: The xth extranet device obtains a first encryption key k1 from the local xth key file filex, records the key index idx-k1, encrypts the communication information mes to be sent to the yth intranet device using the first encryption key k1 to obtain the communication information ciphertext enc(mes)=mes⊕k1; wherein 1≤x≤m, 1≤y≤n;

[0017] Step 3-2: The xth external network device obtains a first hash value H1 and a first hash parameter based on its own identity IDx: a string str1 and an input random number s1.

[0018] Step 3-3: The xth external network device merges the communication information ciphertext enc(mes), the key index idx-k1, its own identity IDx, the identity idy of the yth internal network device, the first hash value H1 and the first hash parameter to generate a communication data packet MES=[enc(mes), idx-k1, IDx, idy, H1, str1, s1].

[0019] As an improvement of the present application, in step 3-2, the obtaining process of the first hash value H1 and the first hash parameter is as follows:

[0020] The xth external network device locally generates an irreducible polynomial p1(x) and obtains an input random number s1 from the local xth key file filex, and a string str1 composed of the coefficient of each term of the irreducible polynomial p1(x) except the highest term; the first hash function h p1,s1 is generated using the irreducible polynomial p1(x) and the input random number s1. p1,s1 The identity IDx is input into the first hash function h p1,s1 to obtain a first hash value H1=h p1,s1 (IDx).

[0021] As an improvement of the present application, in step 3, the specific process of sending the communication data packet MES to the first current virtual interface of the quantum security firewall includes:

[0022] Step 3-4: The xth external network device inquires the currently available virtual interfaces from the quantum security firewall, and the quantum security firewall responds to the inquiry and feeds back the IP address set of the currently local idle virtual interfaces to the xth external network device.

[0023] Step 3-5: The xth external network device selects a first current IP address from the received IP address set of the idle virtual interfaces, and the virtual interface corresponding to the first current IP address is recorded as the first current virtual interface.

[0024] Step 3-6: The xth external network device sends the generated communication data packet MES to the first current IP address, and the first current virtual interface corresponding to the first current IP address in the quantum security firewall receives the communication data packet MES.

[0025] As an improvement of the present invention, in step 3, the specific process by which the quantum-safe firewall determines whether it needs to switch IP addresses to switch to the second current virtual interface for transmitting the communication data packet MES includes:

[0026] Steps 3-7: Determine the traffic threshold M-thre for the first current virtual interface switch;

[0027] Steps 3-8: The quantum-safe firewall determines whether the data traffic in the first current virtual interface has reached the traffic threshold M-thre. If it has not reached the traffic threshold M-thre, the IP address will not be switched; if it has, the IP address will be switched.

[0028] As an improvement of the present invention, the process of switching IP addresses in response to the data traffic in the first current virtual interface reaching the traffic threshold M-thre includes:

[0029] The quantum-safe firewall notifies the xth external network device of data transmission failure. The xth external network device then re-executes steps 3-4 and 3-5 to select a new IP address as the second current IP address. The virtual interface corresponding to the second current IP address is denoted as the second current virtual interface. The xth external network device then re-transmits the generated communication data packet MES to the second current virtual interface.

[0030] As an improvement of the present invention, the data transmission method further includes:

[0031] Step 4: The second current virtual interface in the quantum-safe firewall transmits the communication data packet MES to the inside of the quantum-safe firewall for processing, and then sends it to the internal network device in the internal network device cluster as the receiving party.

[0032] As an improvement to the present invention, step 4 specifically includes the following process:

[0033] Step 4-1: The quantum-safe firewall performs authentication on the xth external network device:

[0034] The second current virtual interface of the quantum-safe firewall parses the communication data packet MES to obtain the ciphertext enc(mes)', key index idx-k1', identity identifier IDx', identity identifier idy', hash value H1', ​​and hash parameters str1' and s1'; and generates a hash function h based on the string str1' and the input random number s1'. p1’,s1’ Input the identity identifier IDx' into the hash function h p1’,s1’ Calculate the second hash value H2=h p1’,s1’ (IDx'); Compare the hash value H1' obtained from parsing with the calculated second hash value H2: if they match, proceed to the next step; otherwise, stop the data flow process;

[0035] Step 4-2: In response to the successful authentication, the quantum-secure firewall performs the decryption operation.

[0036] The quantum-safe firewall addresses the x-th key file filex locally based on the identity IDx', obtains the first decryption key k1' in the x-th key file filex based on the key index idx-k1', and uses the first decryption key k1' to perform a decryption operation on the ciphertext enc(mes)' of the communication information to obtain the communication information mes.

[0037] Step 4-3: The quantum-safe firewall sends the decrypted communication information mes through the internal network to the y-th internal network device for data processing based on the identity identifier idy'.

[0038] As an improvement to the present invention, N is a positive integer greater than or equal to 2.

[0039] Beneficial effects:

[0040] 1. By creating multiple virtual network interfaces and assigning corresponding virtual IP addresses to each virtual interface, the real IP address of the firewall's physical network port can be concealed during external communication. External attackers cannot directly detect or launch targeted attacks (such as DDoS) against the real IP, thereby greatly reducing the risk of the firewall being targeted by IP exposure and ensuring its continuous and stable operation as a core network security device.

[0041] 2. By setting reasonable traffic thresholds, the system can effectively detect malicious attack traffic. By switching virtual interfaces in a timely manner, the system can stop the use of the maliciously attacked virtual interface, cut off the malicious attack, and transmit data normally through the switched virtual interface. This ensures security while protecting the normal data transmission function of the firewall. Attacks on virtual interfaces do not affect the transmission performance of the real physical interface, thus maintaining high transmission efficiency and reliability in complex network environments.

[0042] 3. By using quantum key distribution equipment to assign globally unique and tamper-proof identity identifiers to each communication node and generating highly secure key files based on quantum key distribution technology, quantum-level identity authentication and key management guarantees are provided for communication participants. This not only fundamentally improves the credibility of communication entities, but also provides forward-looking protection capabilities for data transmission through quantum security mechanisms.

[0043] 4. Introducing hash calculations into the encryption, decryption, and authentication processes of data transmission can ensure data integrity and authenticity through hash verification. Furthermore, thanks to the high efficiency of hash algorithms, it strengthens the security mechanism while avoiding excessive computational overhead, achieving a good balance between security strength and processing performance. This is especially suitable for high-concurrency, low-latency network communication scenarios. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the system structure of this application;

[0046] Figure 2 This is a flowchart illustrating the method described in this application;

[0047] Figure 3 This is a schematic diagram illustrating the mapping relationship between virtual interfaces and IP addresses in one embodiment of this application;

[0048] Figure 4 This is a schematic diagram of the symmetric key file between the quantum-safe firewall and the external network device cluster of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] like Figure 1As shown, this invention provides a data transmission system for a quantum-secure firewall. The system includes an intranet device cluster, a quantum-secure firewall, a quantum key service device, and an extranet device cluster. The intranet device cluster is connected to the quantum-secure firewall via intranet communication, and the extranet device cluster is connected to the quantum-secure firewall via the Internet. The quantum key service device is connected to both the quantum-secure firewall and the extranet device cluster. The intranet device cluster includes multiple intranet devices, denoted as first intranet device, second intranet device, ..., y-th intranet device, ..., n-th intranet device. The extranet device cluster includes multiple extranet devices, denoted as first extranet device, second extranet device, ..., x-th extranet device, ..., m-th extranet device. Here, n and m can be equal positive integers or unequal positive integers. The extranet device cluster is used for data transmission, the quantum-secure firewall is used for data authentication and filtering, the quantum key service device is used to provide symmetric key files for the extranet device cluster and the quantum-secure firewall, and the intranet device cluster is used to receive and process data authenticated and filtered by the quantum-secure firewall.

[0051] Based on the data transmission system of the quantum-safe firewall described above, the present invention also provides a data transmission method for the quantum-safe firewall.

[0052] In embodiments of the present invention, such as Figure 2 As shown, the method includes the following steps:

[0053] Step 1: The quantum-safe firewall creates N virtual interfaces corresponding to the local physical network interface and assigns a corresponding IP address to each virtual interface.

[0054] Specifically, step 1 includes:

[0055] The quantum-safe firewall creates N virtual interfaces corresponding to the local physical network interface and assigns IP addresses to these N virtual interfaces, for example, such as... Figure 3 As shown, the first virtual interface is assigned a first IP address, the second virtual interface is assigned a second IP address, and so on, until the Nth virtual interface is assigned an Nth IP address.

[0056] In some cases, a quantum-secure firewall can broadcast these N IP addresses to each external network device in the external network device cluster. Here, N is a positive integer greater than or equal to 2. After this step, all legitimate external network devices in the external network device cluster, from the first to the m-th external network device, obtain the IP address set {first IP address, ..., N-th IP address}, as shown in Table 1 below. Each address is associated with the virtual interface identifier of the corresponding virtual interface within the firewall; for example, the second IP address is associated with the second virtual interface identifier.

[0057] Table 1

[0058] IP address first IP address second IP address …… Nth IP address virtual interface identifier first virtual interface identifier second virtual interface identifier …… Nth virtual interface identifier

[0059] In this embodiment, an illegal external network device is considered to be another external network device outside the external network device cluster.

[0060] Step 2: The quantum key service device distributes symmetric key files to each external network device in the quantum-secure firewall and external network device cluster.

[0061] In embodiments of the present invention, each intranet device in the intranet device cluster has its own unique identifier id1 to idn. Specifically, the first intranet device has identifier id1, the second intranet device has identifier id2, ..., and the m-th intranet device has identifier idn. Similarly, each extranet device in the extranet device cluster has its own unique identifier ID1 to IDm. Specifically, the first extranet device has identifier ID1, the second extranet device has identifier ID2, ..., and the m-th extranet device has identifier IDm. The identifiers of the aforementioned intranet and extranet devices can be device serial numbers that are inherent at the factory, or unique identifiers issued by an identity server (e.g., a quantum CA center or other identity server). Since the intranet devices communicate with the quantum security firewall through the intranet, the quantum security firewall can directly obtain and locally store the identifiers id1 to idn of each intranet device in the intranet device cluster through the intranet. Since external network devices can send communication information to internal network devices via the Internet after filtering through a quantum-safe firewall, the external network devices also store the identity identifiers id1 to idn of the internal network devices that are the recipients of the communication information locally, so as to identify the internal network devices that are the recipients of the data sent by the external network devices.

[0062] Specifically, step 2 includes:

[0063] The quantum key distribution service device distributes symmetric key files to both the quantum security firewall and each external network device in the external network device cluster based on the identity identifiers ID1 to IDm of each external network device. The quantum security firewall possesses a key file that corresponds one-to-one with each external network device. Specifically, for example... Figure 4As shown, the quantum key service device distributes a symmetric first key file (file1) to the quantum secure firewall and the first external network device in the external network device cluster, a symmetric second key file (file2) to the quantum secure firewall and the second external network device, and so on, until a symmetric m-th key file (filem) is distributed to the quantum secure firewall and the m-th external network device. These key files are used for encryption and decryption operations in subsequent communication. The quantum key service device establishes a one-to-one correspondence between the identity of each external network device and the distributed key file. For example, the quantum key service device establishes an association (ID1—file1) between the identity ID1 of the first external network device and the first key file (file1), and sends this association (ID1—file1) to the quantum secure firewall. The quantum secure firewall receives all the associations (e.g., ID1—file1 to IDm—filem), and thus, based on all the associations, it can match the received first key files (file1) to the m-th key files (filem) with each external network device and store all the correspondences locally.

[0064] Step 3: The xth external network device uses its local key file to generate a communication data packet MES to be sent to the yth internal network device. The communication data packet MES is then sent to the first current virtual interface of the quantum security firewall. The quantum security firewall determines whether it needs to switch IP addresses to switch to the second current virtual interface for the transmission of the communication data packet MES.

[0065] Let any external network device in the external network device cluster be denoted as the xth external network device, where 1≤x≤m; the xth external network device needs to send communication information mes to the yth internal network device, where 1≤y≤n; after step 2, the xth external network device and the quantum security firewall have already stored a symmetric xth key file filex, and the communication information mes needs to undergo security authentication and filtering operations of the quantum security firewall.

[0066] Taking the example of the first external network device (x=1) sending communication information mes to the first internal network device (y=1), this step is explained as follows:

[0067] The process of generating the communication data packet MES includes:

[0068] Step 3-1: The first external network device obtains the first encryption key k1 from the local first key file file1 and records the key index idx-k1. It uses the first encryption key k1 to encrypt the communication information mes to be sent to the y-th internal network device, and obtains the ciphertext of the communication information enc(mes)=mes⊕k1;

[0069] Step 3-2: The first external network device calculates and obtains the first hash value H1 and the first hash parameter based on its own identity ID1:

[0070] The first external network device generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from the local first key file file1. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate a first hash function h. p1,s1 Input the identity identifier ID1 into the first hash function h p1,s1 The first hash value H1=h is obtained. p1,s1 (ID1); Record the first hash value parameters: string str1, input random number s1.

[0071] Step 3-3: The first external network device merges the encrypted communication information enc(mes), key index idx-k1, its own identity ID1, the identity ID1 of the first internal network device, the first hash value H1, and the first hash parameter to generate a communication data packet MES=[enc(mes), idx-k1, ID1, idy, H1, str1, s1].

[0072] The specific process of sending the communication data packet MES to the first current virtual interface of the quantum-safe firewall includes:

[0073] Steps 3-4: The first external network device queries the quantum security firewall for currently available virtual interfaces. The quantum security firewall responds to the query by sending back the set of IP addresses of currently idle virtual interfaces (e.g., the set of IP addresses from the second virtual interface to the Nth virtual interface) to the first external network device.

[0074] Steps 3-5: The first external network device selects a first current IP address (e.g., the second IP address) from the received set of idle virtual interface IP addresses, and records the virtual interface corresponding to the first current IP address as the first current virtual interface;

[0075] Steps 3-6: The first external network device sends the generated communication data packet MES to the first current IP address. Correspondingly, the first current virtual interface in the quantum security firewall corresponding to the first current IP address receives the communication data packet MES.

[0076] Generally, the traffic of a single message communication data packet in the MES should be much lower than the traffic threshold. However, to prevent network congestion, it is still necessary to determine and confirm whether the traffic exceeds the traffic threshold.

[0077] The specific process by which the quantum-safe firewall determines whether it needs to switch IP addresses to switch to the second current virtual interface for transmitting the communication data packets (MES) includes:

[0078] Steps 3-7: Determine the traffic threshold M-thre for the first current virtual interface switch;

[0079] Specifically, the quantum-safe firewall obtains the maximum traffic M of the local physical network interface and sets the traffic threshold M-thre for attacks on the physical network interface; where the traffic threshold M-thre ≤ the maximum traffic M; for example, the traffic threshold can be 50% of the maximum traffic, i.e., M-thre = 0.5M.

[0080] In some practical applications, this step can also set a frequency threshold for attacks on the physical network interface. For example, the frequency threshold could be receiving more than Q requests per unit time. This is a common method for judging DDoS attacks, which will not be elaborated upon here; the method will only be explained from the perspective of traffic thresholds.

[0081] Steps 3-8: The quantum-safe firewall determines whether the data traffic in the first current virtual interface has reached the traffic threshold M-thre. If it has not reached the traffic threshold M-thre, no IP address switching is performed. If it has, it is determined that the current IP address has been used by malicious users for attacks. For example, an illegal external network device may have impersonated the xth external network device to launch a DDoS attack on the first current virtual interface, causing a surge in traffic to the current virtual interface and reaching the traffic threshold. In this case, it is determined that the current virtual interface cannot continue to perform data transmission and an IP address switching is required. The specific switching process is as follows:

[0082] In response to the information that the traffic threshold M-thre has been reached, the quantum security firewall notifies the first external network device that the data transmission has failed. The first external network device then re-executes steps 3-4 and 3-5 to select a new IP address (e.g., the fourth IP address) as the second current IP address. The virtual interface corresponding to the second current IP address is denoted as the second current virtual interface. The first external network device then re-transmits the generated communication data packet MES to the second current virtual interface corresponding to the new second current IP address.

[0083] Alternatively, if the quantum secure firewall has already broadcast the IP addresses corresponding to all local virtual interfaces to each external network device in step 1, the quantum secure firewall can select a new virtual interface identifier (e.g., the fourth virtual interface) from the local idle virtual interfaces and send the new virtual interface identifier to the first external network device. The first external network device finds the IP address corresponding to the new virtual interface identifier from its local IP address set as the second current IP address, and the virtual interface corresponding to the second current IP address as the second current virtual interface. The first external network device then retransmits the generated communication data packet MES to the second current virtual interface.

[0084] Step 4: The second current virtual interface in the quantum-safe firewall transmits the communication data packet MES to the firewall for processing, and then sends it to the internal network device in the internal network device cluster as the receiving party.

[0085] Specifically, step 4 includes:

[0086] Step 4-1: The quantum-safe firewall performs identity authentication on the first external network device.

[0087] The specific process is as follows:

[0088] The second current virtual interface of the quantum-safe firewall parses the communication data packet MES to obtain the ciphertext enc(mes)', key index idx-k1', identity ID1', identity id1', hash value H1', ​​and hash parameters str1' and s1'; and generates a hash function h based on the string str1' and the input random number s1'. p1’,s1’ Input the identity identifier ID1' into the hash function h p1’,s1’ Calculate the second hash value H2=h p1’,s1’ (ID1'); Compare whether the hash value H1' obtained from parsing is consistent with the calculated second hash value H2: If they are consistent, it means that the identity authentication of the first external network device has passed and proceed to the next step; otherwise, it means that the communication data packet MES has been tampered with during transmission, and the quantum security firewall should block the communication data packet MES to prevent the subsequent data transmission process and stop the data flow process;

[0089] Step 4-2: In response to the successful authentication, the quantum-safe firewall performs the decryption operation;

[0090] The specific process is as follows:

[0091] The quantum-safe firewall addresses the local first key file file1 based on the identity ID1', obtains the first decryption key k1' from the first key file file1 based on the key index idx-k1', and uses the first decryption key k1' to perform a decryption operation on the ciphertext enc(mes)' of the communication information to obtain the communication information mes;

[0092] Step 4-3: The quantum-secure firewall determines the first internal network device in the internal network device cluster as the receiver based on the identity identifier id1', and sends the decrypted communication information mes through the internal network to the first internal network device for data processing.

[0093] It is understandable that step 4 describes the transmission method of the communication data packet MES of the second current virtual interface. If IP switching was not performed in step 3, then step 4 should be the transmission of the communication data packet MES of the first current virtual interface, which will not be elaborated here.

[0094] This invention combines multiple technologies, including virtual interface concealment, quantum security enhancement, dynamic path selection, timely switching of virtual communication interfaces, and efficient hash verification, to comprehensively protect the firewall's real IP address and resist targeted attacks, while significantly improving the flexibility, efficiency, and overall security level of network communication. It has outstanding practical value and broad application prospects.

Claims

1. A data transmission method for a quantum-safe firewall, wherein the participants in the method include an internal network device cluster, a quantum-safe firewall, a quantum key service device, and an external network device cluster, wherein, The intranet device cluster includes n intranet devices, including the y-th intranet device, and the extranet device cluster includes m extranet devices, including the x-th extranet device; the method is characterized by the following steps: Step 1: The quantum-safe firewall creates N virtual interfaces corresponding to the local physical network interface and assigns a corresponding IP address to each virtual interface; Step 2: The quantum key service device distributes symmetric key files to each external network device in the quantum-secure firewall and external network device cluster; Step 3: The xth external network device uses its local key file to generate a communication data packet MES to be sent to the yth internal network device. The communication data packet MES is then sent to the first current virtual interface of the quantum security firewall. The quantum security firewall determines whether it needs to switch IP addresses to switch to the second current virtual interface for the transmission of the communication data packet MES.

2. The data transmission method of a quantum-safe firewall according to claim 1, characterized in that, The specific process of step 2 includes: The quantum key service device distributes symmetric first key files file1 to m-th key files filem to each external network device in the external network device cluster based on the identity identifiers ID1 to IDm of each external network device in the quantum security firewall and the external network device cluster. The quantum key service device establishes an association between the identity and key file of each external network device, and sends the association to the quantum security firewall; The quantum-secure firewall associates the received first key file file1 to the m-th key file filem with each external network device based on the aforementioned association.

3. The data transmission method of a quantum-safe firewall according to claim 2, characterized in that, The process of generating the communication data packet MES includes: Step 3-1: The x-th external network device obtains the first encryption key k1 from the x-th key file filex on its local machine, and records the key index idx-k1. It uses the first encryption key k1 to encrypt the communication information mes to be sent to the y-th internal network device, and obtains the ciphertext of the communication information enc(mes)=mes⊕k1; where 1≤x≤m, 1≤y≤n; Step 3-2: The xth external network device obtains the first hash value H1 and the first hash parameter based on its own identity IDx: string str1 and input random number s1; Step 3-3: The xth external network device merges the ciphertext of the communication information enc(mes), the key index idx-k1, its own identity IDx, the identity ID idy of the yth internal network device, the first hash value H1, and the first hash parameter to generate the communication data packet MES=[enc(mes), idx-k1, IDx, idy, H1, str1, s1].

4. The data transmission method of a quantum-safe firewall according to claim 3, characterized in that, In step 3-2, the process of obtaining the first hash value H1 and the first hash parameter is as follows: The xth external network device generates an irreducible polynomial p1(x) locally and obtains an input random number s1 from the xth local key file filex. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate the first hash function h. p1,s1 Input the identity identifier IDx into the first hash function h p1,s1 The first hash value H1=h is obtained. p1,s1 (IDx); Record the first hash value parameters: string str1, input random number s1.

5. The data transmission method of a quantum-safe firewall according to claim 3, characterized in that, In step 3, the specific process of sending the communication data packet MES to the first current virtual interface of the quantum-safe firewall includes: Steps 3-4: The xth external network device queries the quantum security firewall for currently available virtual interfaces. The quantum security firewall responds to the query and sends back the set of IP addresses of currently available local virtual interfaces to the xth external network device. Steps 3-5: The xth external network device selects a first current IP address from the received set of idle virtual interface IP addresses, and records the virtual interface corresponding to the first current IP address as the first current virtual interface; Steps 3-6: The xth external network device sends the generated communication data packet MES to the first current IP address, and the first current virtual interface in the quantum security firewall corresponding to the first current IP address receives the communication data packet MES.

6. The data transmission method of a quantum-safe firewall according to claim 5, characterized in that, In step 3, the specific process by which the quantum-safe firewall determines whether it needs to switch IP addresses to switch to the second current virtual interface for transmitting the communication data packet MES includes: Steps 3-7: Determine the traffic threshold M-thre for the first current virtual interface switch; Steps 3-8: The quantum-safe firewall determines whether the data traffic in the first current virtual interface has reached the traffic threshold M-thre. If it has not reached the traffic threshold M-thre, the IP address will not be switched; if it has, the IP address will be switched.

7. The data transmission method of the quantum-secure firewall according to claim 6, characterized in that, The process of switching IP addresses in response to data traffic reaching the traffic threshold M-thre in the first current virtual interface includes: The quantum-safe firewall notifies the xth external network device of data transmission failure. The xth external network device then re-executes steps 3-4 and 3-5 to select a new IP address as the second current IP address. The virtual interface corresponding to the second current IP address is denoted as the second current virtual interface. The xth external network device then re-transmits the generated communication data packet MES to the second current virtual interface.

8. The data transmission method of a quantum-safe firewall according to claim 7, characterized in that, The data transmission method further includes: Step 4: The second current virtual interface in the quantum-safe firewall transmits the communication data packet MES to the inside of the quantum-safe firewall for processing, and then sends it to the internal network device in the internal network device cluster as the receiving party.

9. The data transmission method of a quantum-safe firewall according to claim 8, characterized in that, Step 4 includes the following specific steps: Step 4-1: The quantum-safe firewall performs authentication on the xth external network device: The second current virtual interface of the quantum-safe firewall parses the communication data packet MES to obtain the ciphertext enc(mes)', key index idx-k1', identity identifier IDx', identity identifier idy', hash value H1', ​​and hash parameters str1' and s1'; and generates a hash function h based on the string str1' and the input random number s1'. p1’,s1’ Input the identity identifier IDx' into the hash function h p1’,s1’ Calculate the second hash value H2=h p1’,s1’ (IDx'); Compare the hash value H1' obtained from parsing with the calculated second hash value H2: if they match, proceed to the next step; otherwise, stop the data flow process; Step 4-2: In response to the successful authentication, the quantum-secure firewall performs the decryption operation. The quantum-safe firewall addresses the x-th key file filex locally based on the identity IDx', obtains the first decryption key k1' in the x-th key file filex based on the key index idx-k1', and uses the first decryption key k1' to perform a decryption operation on the ciphertext enc(mes)' of the communication information to obtain the communication information mes. Step 4-3: The quantum-safe firewall sends the decrypted communication information mes through the internal network to the y-th internal network device for data processing based on the identity identifier idy'.

10. The data transmission method of a quantum-safe firewall according to claim 1, characterized in that, N is a positive integer greater than or equal to 2.

Images