Working method and system of quantum security firewall
By assigning differentiated IP addresses and generating server identification tags to business servers through a quantum-secure firewall system, and combining this with quantum key distribution technology, the system solves the problems of traditional firewalls against DDoS attacks and quantum-based cracking, achieving highly efficient network security protection.
Patent Information
- Application Number
- CN202511875086.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-12
- Publication Date
- 2026-02-10
AI Technical Summary
Traditional firewalls are difficult to effectively identify and block distributed denial-of-service attacks, and are at risk of being cracked by quantum computing, affecting network security and business continuity.
A quantum-safe firewall system is adopted, which assigns differentiated IP addresses and generates server identification tags to different business servers, and uses quantum key distribution technology for dual filtering and authentication to ensure the legitimacy of access requests.
It achieves effective defense against DDoS attacks, reduces the risk of unauthorized requests penetrating firewalls, and resists the cryptographic cracking threat brought by quantum computing, providing long-term network security protection.
Smart Images
Figure CN121508840A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of communication technology, and in particular to a method and system for operating a quantum-safe firewall. Background Technology
[0002] Firewalls, as the first line of defense in network security, play a crucial role in enterprise, institutional, and personal network environments. Traditional firewall systems monitor and control network traffic, filtering data packets according to preset security rules, thereby establishing a security barrier between the internal network and the external internet, preventing unauthorized access and malicious attacks, and improving network security and stability.
[0003] However, with the continuous evolution of cyberattack methods, especially the frequent occurrence of Distributed Denial of Service (DDoS) attacks, traditional firewalls face severe challenges in dealing with complex and distributed cyberattacks. DDoS attacks control multiple attack nodes distributed across different geographical locations, simultaneously launching a large number of access requests to the target network or server, leading to resource exhaustion and service interruption of the target system. Due to the distributed and camouflaged nature of the attack sources, traditional firewalls based on rule filtering and blacklist / whitelist mechanisms struggle to effectively identify and block such attacks, easily resulting in the mistaken interception of legitimate business requests or malicious traffic penetrating defenses, impacting business continuity and data security.
[0004] Furthermore, traditional firewalls rely heavily on classical cryptography for key management and data encryption, which is vulnerable to being cracked by quantum computing. With the development of quantum computing technology, existing encryption mechanisms face potential security threats, necessitating a new firewall solution that incorporates quantum-safe technologies such as quantum key distribution to address the increasingly severe cyberattack situation and ensure the security of data transmission and access control. Summary of the Invention
[0005] Purpose of the invention: This application provides a quantum-safe firewall and its working method to solve the problems mentioned in the background art.
[0006] Technical Solution: This invention provides a method for operating a quantum-safe firewall. The participants in this method include a quantum-safe firewall, a service terminal, a local service server, other service servers, and a quantum key service device. The method includes the following steps:
[0007] Step 1: The quantum-safe firewall obtains various service types from the service terminal and distinguishes the servers on the Internet into servers for this service and other service servers according to different service types; at the same time, the quantum-safe firewall sends a request to the quantum key service device to configure the symmetric key file file0, so that the quantum-safe firewall and the service server can obtain the symmetric key file.
[0008] Step 2: Configure the IP address information of the quantum-safe firewall and perform an IP notification operation to servers on the Internet so that any server on the Internet has the IP address information of this quantum-safe firewall;
[0009] Step 3: The quantum-safe firewall receives the first access request from the server on the Internet and filters it to obtain a legitimate second access request, which is then sent to the business terminal for business processing.
[0010] As an improvement to the present invention, the specific process of step 1 is as follows:
[0011] Step 1-1: The application deployment unit of the quantum security firewall interacts with the business terminal to obtain the various business types involved from the business terminal. Based on the business types involved in the business terminal, it identifies at least one business server on the Internet that needs to perform interactive operations as this business server, and identifies other business servers from access sources that need to be filtered as other business servers.
[0012] Step 1-2: The quantum security processing unit of the quantum security firewall requests the quantum key service device to allocate the symmetric key file file0 to the quantum security firewall and the service server determined in step 1-1.
[0013] As an improvement to the present invention, the specific process of step 2 is as follows:
[0014] Step 2-1: The network interface unit of the quantum-safe firewall generates N virtual network interfaces and configures a different IP address for each virtual network interface. The IP address configured for the first virtual network interface corresponding to the physical network interface is denoted as the first IP address; the other virtual network interfaces are denoted as the second virtual network interface with the second IP address, the third virtual network interface with the third IP address, ..., the Nth virtual network interface with the Nth IP address.
[0015] Step 2-2: The quantum security processing unit of the quantum security firewall generates a server identifier tag for this service server, calculates the first hash value H1 based on the server identifier tag, and records the first hash value parameters;
[0016] Steps 2-3: The quantum-safe processing unit performs quantum-safe tagging based on the first hash value parameter, server identifier tag, and first IP address to obtain ciphertext data packets, which are then distributed to the service server. The service server decrypts the data packets, calculates the second hash value H2, and performs persistent storage locally.
[0017] Steps 2-4: The network port unit notifies other service servers of the second to Nth IP addresses, and the other service servers arbitrarily select one of the IP addresses for storage.
[0018] As an improvement of the present invention, in step 2-2, the calculation process of the first hash value H1 specifically includes:
[0019] The quantum-safe processing unit locally generates an irreducible polynomial p1(x) and obtains an input random number s1 from the local symmetric key file file0. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate a hash function h. p1,s1 Input the server identifier tag into the hash function h p1,s1 The first hash value H1=h is obtained. p1,s1 (tag); Record the first hash value parameters: string str1, input random number s1.
[0020] As an improvement to the present invention, the specific process of steps 2-3 is as follows:
[0021] Step 2-3-1: The quantum-secure processing unit obtains the first IP address from the network port unit, concatenates the first hash value parameter string str1, the input random number s1, the server identifier tag, and the first IP address to obtain the data packet to be transmitted, mes=(str1, s1, tag, first IP address); obtains the first encryption key k1 from the local symmetric key file file0, and records the key index idx-k1 of the first encryption key k1 in the symmetric key file file0; performs an encryption operation on the data packet to be transmitted, mes, using the first encryption key k1 to obtain the ciphertext data packet MES=mes⊕k1, and sends the ciphertext data packet MES and the key index idx-k1 to the network port unit. The network port unit sends the ciphertext data packet MES and the key index idx-k1 to the service server through the first virtual network port.
[0022] Step 2-3-2: This service server decrypts the encrypted data packet MES to obtain the hash value parameter string str1', the input random number s1', the server identifier tag', and the first IP address; this service server calculates the second hash value H2 of the server identifier tag': a hash function h is generated based on the string str1' and the input random number s1'. p1’,s1’ Input the server identifier tag' into the hash function h p1’,s1’ Calculate the second hash value H2=h p1’,s1’ (tag');
[0023] Step 2-3-3: The server performs a persistent storage operation on the calculated second hash value H2 and the decrypted first IP address locally.
[0024] As an improvement of the present invention, the service server includes at least four sub-service servers, including the first sub-service server. The calculation of the second hash value H2 of the server identifier tag' by the service server in step 2-3-2 means that the at least four sub-service servers calculate the second hash value H2 of the server identifier tag' locally.
[0025] Before step 2-3-3, a verification operation based on the second hash value H2 is also included:
[0026] The first sub-service server requests a comparison of its locally calculated second hash value H2 with at least three other sub-service servers. If it matches at least two of them, the verification operation passes, and the second hash value H2 and the first IP address are allowed to be persistently stored locally. Otherwise, the verification operation fails, and the first sub-service server proactively initiates a request to the quantum security firewall to re-acquire the tagging processing result.
[0027] As an improvement to the present invention, the specific process of step 3 is as follows:
[0028] Step 3-1: The network port unit of the quantum-safe firewall receives and filters all first access requests sent by servers on the Internet, wherein the first access request carries a second hash value H2 calculated locally by the business server and the IP address information of the quantum-safe firewall stored locally.
[0029] Step 3-2: The network interface unit distributes the received first access request to the virtual network interface with the corresponding IP address according to the IP address information carried in the first access request; copies the first access request in the first virtual network interface to the physical network interface; and directly discards the first access requests in other virtual network interfaces.
[0030] Step 3-3: The quantum-safe processing unit filters based on the second hash value H2 carried in the first access request: compare whether the second hash value H2 and the locally stored first hash value H1 are consistent: if they are consistent, the first access request is sent to the operating system deployment unit of the quantum-safe firewall for processing; if they are inconsistent, the first access request is discarded.
[0031] Steps 3-4: After processing the first access request filtered by the quantum security processing unit, the operating system deployment unit obtains the second access request and sends it to the application deployment unit. The application deployment unit sends the second access request to the business terminal for business processing according to the instructions of the second access request.
[0032] As an improvement of the present invention, a quantum-safe firewall system is also provided for performing the working method of the quantum-safe firewall as described above. The quantum-safe firewall includes a network port unit, a quantum-safe processing unit, an operating system deployment unit, and an application deployment unit, wherein the quantum-safe processing unit is communicatively connected to the network port unit, the operating system deployment unit, and the application deployment unit, respectively, and the operating system deployment unit is also communicatively connected to the application deployment unit.
[0033] The network port unit is configured to generate multiple virtual network ports, configure a corresponding IP address for each virtual network port, notify all servers on the Internet of each IP address, and receive all access requests from all servers on the Internet.
[0034] The quantum-safe processing unit is configured to request a symmetric key file from the quantum key service device, generate a server identifier tag for the service server, calculate a first hash value based on the server identifier, perform quantum-safe tagging processing based on the first hash value parameter, encrypt and transmit the data to be transmitted via the network port unit, and filter the first access request received from the network port unit.
[0035] The operating system deployment unit is configured to receive and process the first access request filtered by the quantum-safe processing unit to obtain a second access request.
[0036] The application deployment unit is configured to receive a second access request from the operating system deployment unit, send the second access request to the business terminal for business processing, and obtain various business types involved from the business terminal, and distinguish the servers in the Internet as this business server and other business servers.
[0037] Beneficial effects:
[0038] 1. By virtualizing and assigning differentiated IP addresses to different business servers (such as assigning the first IP address to the business server with interactive needs), preliminary differentiation and screening are performed when data packets arrive, laying the foundation for subsequent filtering. This enables the firewall of this invention to more accurately identify and process different types of network traffic, reducing the computational load of the subsequent system.
[0039] 2. This invention performs secondary filtering and authentication based on server identifier tags generated locally by the firewall. This mechanism ensures that only access requests from legitimate business servers with the correct identity tags can pass the verification. Through two authentications (initial IP address differentiation and secondary authentication using server identifier tags), a robust defense system is formed, which effectively ensures that all access requests that ultimately enter the business terminal have a high degree of legitimacy and significantly reduces the risk of illegal or malicious requests penetrating the firewall.
[0040] 3. If a third-party user impersonates another illegal business server, its IP address will be filtered out by the quantum security firewall at the network port unit. If it impersonates this business server, since it does not have a key file, it cannot decrypt the encrypted MES. Therefore, it can only impersonate the identity information of this business server that is publicly available on the Internet, and cannot obtain the tag identity information verified by the firewall. Such access requests will also be filtered out by the quantum security processing unit. The problem of DDoS attack mentioned in the background technology is solved through a dual filtering mechanism.
[0041] 4. The key file and encrypted communication mechanism involved in this invention are combined with quantum security technologies such as quantum key distribution, which enables the entire filtering and authentication process to resist the cryptographic cracking threat brought by future quantum computing, thereby providing future-oriented and long-term effective network security protection. Attached Figure Description
[0042] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0043] Figure 1 This is a schematic diagram illustrating the communication connection between the quantum-safe firewall of this application and the service terminal and the server in the Internet;
[0044] Figure 2 This is a schematic diagram of the quantum-safe firewall structure of this application;
[0045] Figure 3 This is a flowchart illustrating the working method of the quantum-safe firewall in this application;
[0046] Figure 4 This is a schematic diagram illustrating the correspondence between the virtual network ports and physical network ports in this application. Detailed Implementation
[0047] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0048] Once the firewall's IP address is known from the external internet, it can construct useless access routes to generate a DDoS attack. If the firewall lacks adequate protection measures, it will allow these useless access routes, causing resource consumption by business terminals on the internal network. For ease of description, this application distinguishes the numerous communication networks on the internet into server business networks that are allowed access by the quantum-safe firewall and other business networks that are not allowed access. The internal network includes multiple business terminals, the server business network includes multiple legitimate servers for this business, and the other business networks that are not allowed access include multiple illegitimate other business servers.
[0049] To address the problems mentioned in the background art, the present invention provides a quantum-safe firewall system, such as... Figure 1 As shown, the quantum key service device communicates with the service server, other service servers, and the quantum security firewall via the Internet. The quantum security firewall communicates with the service terminal, the service server, and other service servers.
[0050] like Figure 1 As shown, the quantum-secure firewall sits between the terminal service network and the Internet. It filters all service servers from the Internet, allowing legitimate servers that pass the filter to access the service terminal, while disallowing unauthorized servers that fail the filter from accessing the service terminal. Figure 1 It is evident that the Internet does not directly communicate with the business terminal to prevent unauthorized access by other business servers on the Internet, which could compromise the information security of the business terminal.
[0051] like Figure 2As shown, the quantum-secure firewall provided by this invention includes a network port unit, a quantum-secure processing unit, an operating system deployment unit, and an application deployment unit, used to filter access requests from illegal business networks on the Internet. The quantum-secure processing unit is communicatively connected to the network port unit, the operating system deployment unit, and the application deployment unit, respectively. The operating system deployment unit is also communicatively connected to the application deployment unit. The network port unit is configured to generate multiple virtual network ports, configure a corresponding IP address for each virtual network port, notify all servers on the Internet of each IP address, and receive all access requests from all servers on the Internet. The quantum-secure processing unit is configured to request a symmetric key file from a quantum key service device, generate a server identifier tag for the business server, calculate a first hash value based on the server identifier, perform quantum-secure tagging processing based on the first hash value parameter, encrypt and transmit data to be transmitted via the network port unit, and filter the first access request received from the network port unit. The operating system deployment unit is configured to receive and process the first access request filtered by the quantum-secure processing unit to obtain a second access request. The application deployment unit is configured to receive a second access request from the operating system deployment unit, send the second access request to the business terminal for business processing, and obtain various business types involved from the business terminal, and distinguish the servers in the Internet as the business server and other business servers.
[0052] Based on the aforementioned quantum-safe firewall system, this invention also proposes a method for operating a quantum-safe firewall, wherein the participants in the method include the quantum-safe firewall, a service terminal, this service server, other service servers, and a quantum key service device. Figure 3 As shown, the working method provided by the present invention includes the following steps:
[0053] Step 1: The quantum-safe firewall obtains various service types from the service terminal and distinguishes the servers on the Internet into servers for this service and other service servers according to different service types; at the same time, the quantum-safe firewall initiates a request to the quantum key service device to configure the symmetric key file file0, so that the quantum-safe firewall and the service server can obtain the symmetric key file.
[0054] Specifically, step 1 includes:
[0055] Step 1-1: Determining the Service Server and Other Service Servers: The application deployment unit of the quantum-safe firewall interacts with the service terminals to obtain information on various service types involved. Based on the service types involved in these terminals, at least one service server on the Internet that requires interactive operations is determined as the service server; alternatively, these at least one service server can be logically centrally deployed to... Figure 1The application deployment form identifies other service servers that need to be filtered as "other service servers" to ensure that all legitimate service servers are integrated into this service server.
[0056] Step 1-2: Obtaining the symmetric key file file0: The quantum-safe processing unit of the quantum-safe firewall requests the quantum key service device to allocate the symmetric key file file0 to the quantum-safe firewall and at least one of the service servers identified in Step 1-1, to ensure legitimate communication between the quantum-safe firewall and the service servers. This symmetric key file file0 is stored in the quantum-safe processing unit and also in all the service servers. Therefore, it is evident that the other service servers have not obtained the allocated symmetric key file file0.
[0057] Step 2: Configure the IP address information of the quantum-safe firewall and perform an IP notification operation to servers on the Internet so that any server on the Internet has the IP address information of this quantum-safe firewall.
[0058] Specifically, step 2 is as follows:
[0059] Step 2-1: As Figure 4 As shown, the network interface unit of the quantum-safe firewall generates N virtual network interfaces, and configures a different IP address for each virtual network interface. The IP address configured for the first virtual network interface corresponding to the physical network interface is denoted as the first IP address. It should be noted that this physical network interface is the one that actually performs data communication. The other virtual network interfaces can be sequentially denoted as the second virtual network interface with the second IP address, the third virtual network interface with the third IP address, ..., the Nth virtual network interface with the Nth IP address.
[0060] Step 2-2: The quantum security processing unit of the quantum security firewall generates a server identifier tag for the service server determined in step 1-1 locally, calculates the first hash value H1 based on the server identifier tag, and records the first hash value parameter.
[0061] Specifically, the calculation process for the first hash value H1 is as follows:
[0062] The quantum-safe processing unit locally generates an irreducible polynomial p1(x) and obtains an input random number s1 from the local symmetric key file file0. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate a hash function h. p1,s1 Input the server identifier tag into the hash function h p1,s1 The first hash value H1=h is obtained. p1,s1(tag); Record the first hash value parameters: string str1, input random number s1.
[0063] Step 2-3: The quantum-safe processing unit performs quantum-safe tagging processing based on the first hash value parameter obtained in step 2-2, the server identifier tag, and the first IP address obtained in step 2-1, and distributes the encrypted data packet to the service server; the service server decrypts and calculates the second hash value H2, and performs persistent storage operation locally;
[0064] The tagging process is as follows:
[0065] Step 2-3-1: The quantum-safe processing unit communicates with the network port unit, obtains the first IP address from the network port unit, concatenates the first hash value parameter (string str1 and input random number s1), the server identifier tag, and the first IP address to obtain the data packet to be transmitted, mes=(str1, s1, tag, first IP address); subsequently, the quantum-safe processing unit obtains the first encryption key k1 from the local symmetric key file file0. The length of the first encryption key k1 can be the same as the length of the data packet to be transmitted, mes; records the key index idx-k1 of the first encryption key k1 in the symmetric key file file0 so that the server can obtain the decryption key for decryption operation later; uses the first encryption key k1 to perform an encryption operation on the data packet to be transmitted, mes, to obtain the ciphertext data packet MES=mes⊕k1, and sends the ciphertext data packet MES and the key index idx-k1 to the network port unit. The network port unit sends the ciphertext data packet MES and the key index idx-k1 to the service server through the first virtual network port. At this point, the tagging process performed by the quantum-safe processing unit is complete, and the legitimate business server on the Internet obtains the encrypted data packet MES and the key index idx-k1.
[0066] The calculation process for the second hash value H2 is as follows:
[0067] Step 2-3-2: This service server obtains the encrypted data packet MES and the key index idx-k1. Based on the key index idx-k1, this service server can obtain the first decryption key k1' from the local symmetric key file file0. Using the first decryption key k1', the encrypted data packet MES is decrypted to obtain the hash value parameters: string str1', input random number s1', server identifier tag', and the first IP address. This service server calculates the second hash value H2 of the server identifier tag' locally.
[0068] This service server generates a hash function h based on the string str1' and the input random number s1'. p1’,s1’Input the server identifier tag' into the hash function h p1’,s1’ Calculate the second hash value H2=h p1’,s1’ (tag').
[0069] Step 2-3-3: After the calculation is completed, the business server will persistently store the calculated second hash value H2 and the decrypted first IP address locally.
[0070] In embodiments of the present invention, the service server includes at least four sub-service servers, including a first sub-service server. The calculation of the second hash value H2 of the server identifier tag' by the service server in step 2-3-2 means that each of the at least four sub-service servers calculates the second hash value H2 of the server identifier tag' locally. In some embodiments, to ensure the correctness of transmission, after the calculation of the second hash value H2 is completed and before the persistent storage in step 2-3-3, the service server may also perform a verification operation based on the locally calculated second hash value H2.
[0071] The first sub-service server requests a comparison of its locally calculated second hash value H2 with at least three other sub-service servers. If it matches at least two of them, the verification operation passes, indicating that the locally calculated second hash value H2 is correct, and the local persistent storage of the second hash value H2 and the decrypted first IP address is allowed. Otherwise, the verification operation fails, and the first sub-service server needs to proactively initiate a request to the quantum security firewall to re-acquire the tagging processing result, i.e., the ciphertext data packet and the key index.
[0072] Steps 2-4: The network interface unit notifies other service servers of the second to Nth IP addresses. Other service servers can choose to store any one of these IP addresses. This completes the process of the quantum-safe firewall notifying all servers on the internet of their IP addresses, ensuring that every server on the internet possesses the IP address information of this quantum-safe firewall.
[0073] Step 3: The quantum-safe firewall receives the first access request from the server on the Internet and filters it to obtain a legitimate second access request, which is then sent to the business terminal for business processing.
[0074] Specifically, step 3 includes:
[0075] Step 3-1: The network port unit of the quantum-safe firewall receives and filters all first access requests sent by servers on the Internet. The first access request carries a second hash value H2 calculated locally by the business server (if it is another business server, the second hash value H2 is empty) and the IP address information of the quantum-safe firewall stored locally. The IP address information comes from the first IP address to the Nth IP address sent by the quantum-safe firewall to each server in the previous steps.
[0076] Step 3-2: The network interface unit distributes the received first access request to the virtual network interface with the corresponding IP address according to the IP address information carried in the first access request, and copies the first access request in the first virtual network interface corresponding to the first IP address to the physical network interface; the first access requests in other virtual network interfaces are directly discarded.
[0077] This step is the first round of filtering mechanism performed by the network interface unit on all access requests to the Internet;
[0078] Step 3-3: The first access request sent from this service server also carries a second hash value H2. The quantum security processing unit filters based on the second hash value H2: it compares whether the second hash value H2 is consistent with the locally stored first hash value H1. If they are consistent, it means that the second hash value H2 was calculated by a legitimate service server on the Internet, and the source of the second hash value H2 is a legitimate service server. The first access request is then sent to the operating system deployment unit of the quantum security firewall for processing. If they are inconsistent, it means that the second hash value H2 was not calculated by a legitimate service server on the Internet, and the source of the second hash value H2 is not a legitimate service server. The first access request is then discarded.
[0079] This step is the second round of filtering mechanism by the quantum-safe processing unit for the first access request from a legitimate business server.
[0080] Steps 3-4: After processing the first access request filtered by the quantum security processing unit, the operating system deployment unit obtains the second access request and sends it to the application deployment unit. The application deployment unit, according to the instructions of the second access request, sends the second access request to the business terminal for business processing.
[0081] This invention uses multiple virtual IP addresses, assigning them based on whether the business server needs to interact with the quantum-secure firewall. The business server with interaction needs is assigned a first IP address, while other business servers are assigned different IP addresses for initial differentiation. Subsequently, a secondary filtering and authentication process is performed using a server identifier tag generated locally by the quantum-secure firewall to ensure that received access requests originate from a legitimate business server. This dual authentication and filtering ensures that all access requests sent to business terminals on the internal network are legitimate. If a third-party user impersonates an illegal business server on the internet, their IP address will be filtered out by the quantum-secure firewall at the network interface unit. If they impersonate the business server on the internet, since they lack the key file, they cannot decrypt the encrypted data packet MES. Therefore, they can only impersonate the server's publicly available identity information on the internet and cannot obtain the identity information containing the server identifier tag verified by the firewall. Such access requests will be filtered out by the quantum-secure processing unit. This dual filtering mechanism solves the DDoS attack problem mentioned in the background technology.
Claims
1. A method for operating a quantum-safe firewall, characterized in that, The participants in the method include a quantum-secure firewall, a service terminal, this service server, other service servers, and a quantum key service device; the working method includes the following steps: Step 1: The quantum-safe firewall obtains various service types from the service terminal and distinguishes the servers on the Internet into servers for this service and other service servers according to different service types; at the same time, the quantum-safe firewall sends a request to the quantum key service device to configure the symmetric key file file0, so that the quantum-safe firewall and the service server can obtain the symmetric key file. Step 2: Configure the IP address information of the quantum-safe firewall and perform an IP notification operation to servers on the Internet so that any server on the Internet has the IP address information of this quantum-safe firewall; Step 3: The quantum-safe firewall receives the first access request from the server on the Internet and filters it to obtain a legitimate second access request, which is then sent to the business terminal for business processing.
2. The method for operating a quantum-safe firewall according to claim 1, characterized in that, The specific process of step 1 is as follows: Step 1-1: The application deployment unit of the quantum security firewall interacts with the business terminal to obtain the various business types involved from the business terminal. Based on the business types involved in the business terminal, it identifies at least one business server on the Internet that needs to perform interactive operations as this business server, and identifies other business servers from access sources that need to be filtered as other business servers. Step 1-2: The quantum security processing unit of the quantum security firewall requests the quantum key service device to allocate the symmetric key file file0 to the quantum security firewall and the service server determined in step 1-1.
3. The method for operating a quantum-safe firewall according to claim 1 or 2, characterized in that, The specific process of step 2 is as follows: Step 2-1: The network interface unit of the quantum-safe firewall generates N virtual network interfaces and configures a different IP address for each virtual network interface. The IP address configured for the first virtual network interface corresponding to the physical network interface is denoted as the first IP address; the other virtual network interfaces are denoted as the second virtual network interface with the second IP address, the third virtual network interface with the third IP address, ..., the Nth virtual network interface with the Nth IP address. Step 2-2: The quantum security processing unit of the quantum security firewall generates a server identifier tag for this service server, calculates the first hash value H1 based on the server identifier tag, and records the first hash value parameters; Steps 2-3: The quantum-safe processing unit performs quantum-safe tagging based on the first hash value parameter, server identifier tag, and first IP address to obtain ciphertext data packets, which are then distributed to the service server. The service server decrypts the data packets, calculates the second hash value H2, and performs persistent storage locally. Steps 2-4: The network port unit notifies other service servers of the second to Nth IP addresses, and the other service servers arbitrarily select one of the IP addresses for storage.
4. The method for operating a quantum-safe firewall according to claim 3, characterized in that, In step 2-2, the calculation process of the first hash value H1 specifically includes: The quantum-safe processing unit locally generates an irreducible polynomial p1(x) and obtains an input random number s1 from the local symmetric key file file0. It denotes the string consisting of the coefficients of each term in the irreducible polynomial p1(x) except for the highest term as str1. It then uses the irreducible polynomial p1(x) and the input random number s1 to generate a hash function h. p1,s1 Input the server identifier tag into the hash function h p1,s1 The first hash value H1=h is obtained. p1,s1 (tag); Record the first hash value parameters: string str1, input random number s1.
5. The method for operating a quantum-safe firewall according to claim 4, characterized in that, The specific process of steps 2-3 is as follows: Step 2-3-1: The quantum-safe processing unit obtains the first IP address from the network port unit, concatenates the first hash value parameter string str1, the input random number s1, the server identifier tag, and the first IP address to obtain the data packet to be transmitted, mes=(str1,s1, tag, first IP address); it obtains the first encryption key k1 from the local symmetric key file file0, and records the key index idx-k1 of the first encryption key k1 in the symmetric key file file0; The first encryption key k1 is used to encrypt the data packet mes to be transmitted, and the ciphertext data packet MES=mes⊕k1 is obtained. The ciphertext data packet MES and the key index idx-k1 are sent to the network port unit. The network port unit sends the ciphertext data packet MES and the key index idx-k1 to the service server through the first virtual network port. Step 2-3-2: This service server decrypts the encrypted data packet MES to obtain the hash value parameter string str1', the input random number s1', the server identifier tag', and the first IP address; this service server calculates the second hash value H2 of the server identifier tag': a hash function h is generated based on the string str1' and the input random number s1'. p1’,s1’ Input the server identifier tag' into the hash function h p1’,s1’ Calculate the second hash value H2=h p1’,s1’ (t Step 2-3-3: The server performs a persistent storage operation on the calculated second hash value H2 and the decrypted first IP address locally.
6. The method for operating a quantum-safe firewall according to claim 5, characterized in that, The service server includes at least four sub-service servers, including the first sub-service server. The calculation of the second hash value H2 of the server identifier tag' by the service server in step 2-3-2 means that the at least four sub-service servers calculate the second hash value H2 of the server identifier tag' locally. Before step 2-3-3, a verification operation based on the second hash value H2 is also included: The first sub-service server requests a comparison of its locally calculated second hash value H2 with at least three other sub-service servers. If it matches at least two of them, the verification operation passes, and the second hash value H2 and the first IP address are allowed to be persistently stored locally. Otherwise, the verification operation fails, and the first sub-service server proactively initiates a request to the quantum security firewall to re-acquire the tagging processing result.
7. The method for operating a quantum-safe firewall according to claim 3, characterized in that, The specific process of step 3 is as follows: Step 3-1: The network port unit of the quantum-safe firewall receives and filters all first access requests sent by servers on the Internet, wherein the first access request carries a second hash value H2 calculated locally by the business server and the IP address information of the quantum-safe firewall stored locally. Step 3-2: The network interface unit distributes the received first access request to the virtual network interface with the corresponding IP address according to the IP address information carried in the first access request; copies the first access request in the first virtual network interface to the physical network interface; and directly discards the first access requests in other virtual network interfaces. Step 3-3: The quantum-safe processing unit filters based on the second hash value H2 carried in the first access request: compare whether the second hash value H2 and the locally stored first hash value H1 are consistent: if they are consistent, the first access request is sent to the operating system deployment unit of the quantum-safe firewall for processing; if they are inconsistent, the first access request is discarded. Steps 3-4: After processing the first access request filtered by the quantum security processing unit, the operating system deployment unit obtains the second access request and sends it to the application deployment unit. The application deployment unit sends the second access request to the business terminal for business processing according to the instructions of the second access request.
8. A quantum-safe firewall system for performing the operation method of a quantum-safe firewall as described in any one of claims 1 to 7, characterized in that, The quantum-secure firewall includes a network port unit, a quantum-secure processing unit, an operating system deployment unit, and an application deployment unit. The quantum-secure processing unit is communicatively connected to the network port unit, the operating system deployment unit, and the application deployment unit, respectively. The operating system deployment unit is also communicatively connected to the application deployment unit. The network port unit is configured to generate multiple virtual network ports, configure a corresponding IP address for each virtual network port, notify all servers on the Internet of each IP address, and receive all access requests from all servers on the Internet. The quantum-safe processing unit is configured to request a symmetric key file from the quantum key service device, generate a server identifier tag for the service server, calculate a first hash value based on the server identifier, perform quantum-safe tagging processing based on the first hash value parameter, encrypt and transmit the data to be transmitted via the network port unit, and filter the first access request received from the network port unit. The operating system deployment unit is configured to receive and process the first access request filtered by the quantum-safe processing unit to obtain a second access request. The application deployment unit is configured to receive a second access request from the operating system deployment unit, send the second access request to the business terminal for business processing, and obtain various business types involved from the business terminal, and distinguish the servers in the Internet as this business server and other business servers.