System and method for realizing multi-destination synchronous encryption and decryption strategy on physical layer

Abstract

The invention discloses a system and a method for realizing a multi-destination synchronous encryption and decryption strategy on a physical layer. The method belongs to the fields of information security, network communication and physical layer encryption and decryption. The system is composed of a plurality of encryption terminals which are interconnected through a network, and each terminal is integrated with a network interface, a multi-destination white list filter, a multi-destination key area set, a time service synchronization module and a synchronous switching controller. According to the method, based on physical layer destination analysis, a multi-thread scheduler is utilized to realize data stream parallel processing and key state isolation; and in combination with time service synchronization and a dynamic key area rotation mechanism, negotiation-free synchronous switching is executed at the whole-second boundary of the time service signal. According to the method, smooth switching is assisted by implanting a switching mark in a data frame, and the data length is ensured to be unchanged by adopting XOR encryption; the method has the advantages of nanosecond-level low delay, high throughput, transparent and non-perceptual service switching and the like, and is suitable for a distributed high-concurrency private network environment.

Description

Technical Field

[0001] This invention relates to the fields of information security, network communication, and physical layer encryption and decryption, and in particular to a system and method for implementing multi-destination synchronous encryption and decryption strategies at the physical layer. Background Technology

[0002] With the rapid development of big data, industrial internet, and dedicated network communication technologies for critical infrastructure, the demand for resource sharing and information exchange in network environments is showing a trend of high concurrency and multiple nodes. In these application scenarios, data often needs to be sent synchronously from a single source to multiple destinations, which places extremely high demands on the security and real-time performance of communication.

[0003] Traditional encryption and decryption schemes are typically implemented at the application or network layer of the OSI model. However, when handling multi-destination, ultra-high-speed data transmission, traditional schemes reveal significant limitations: First, high-level encryption requires complex protocol handshakes and key negotiation processes. In large-scale node networks, handshake overhead consumes substantial bandwidth resources and makes it difficult to guarantee the decryption synchronization of all receiving nodes in the time dimension. Second, when facing multiple destination traffic flows with different directions and security levels, traditional single-threaded or serial processing mechanisms are prone to processing bottlenecks, leading to severe network latency and failing to meet the nanosecond-level latency requirements of deterministic networks. Finally, existing physical layer security technologies are not yet perfect in handling multi-destination isolation, making it difficult to achieve independent and synchronous dynamic key switching for different destinations while sharing physical channels.

[0004] Therefore, how to provide an encryption / decryption strategy that can achieve efficient parallel processing of multiple destinations at the physical layer and achieve high-precision synchronous switching across the entire network without cumbersome negotiation has become a pressing technical challenge in the fields of information security and private network communication. Summary of the Invention

[0005] To address the aforementioned issues, this invention provides a system and method for implementing multi-destination synchronous encryption and decryption strategies at the physical layer. It employs a destination resolution mechanism based on the physical layer identifier of the data frame, combined with a multi-threaded parallel processing architecture and a time-driven dynamic key area rotation strategy. This enables independent key state isolation and high-precision synchronous switching across the entire network for each destination's service flow without handshake negotiation. This significantly improves system throughput and data transmission security in high-speed private network environments, while ensuring zero service interruption and nanosecond-level low latency during key switching.

[0006] The above objectives can be achieved through the following approach:

[0007] A system for implementing multi-destination synchronous encryption / decryption at the physical layer, comprising several encrypted terminals interconnected via network devices, each terminal including:

[0008] An integrated network interface is used to send and receive physical layer data frames;

[0009] A multi-destination whitelist filter is used to read the destination address field in the data frame and match it with preset encryption rules;

[0010] A multi-destination key set stores several independent key clusters that correspond one-to-one with different destination identifiers. Each key cluster contains multiple sets of dynamic keys.

[0011] The time synchronization module is used to receive external high-precision time signals and provide a unified time reference for the entire network;

[0012] A synchronous switching controller is used to control the synchronous version switching of key clusters at all destinations based on the whole second of the timing signal.

[0013] Optionally, the terminal further includes a multi-threaded scheduler for distributing the parsed different destination service flows to independent parallel processing threads; wherein each processing thread is bound to several destination identifiers to achieve isolation and lock-free access to different destination key states.

[0014] Optionally, during the deployment phase, the system pre-configures all encrypted terminals via offline channels, the pre-configuration including:

[0015] Multiple dynamic key clusters for different destinations;

[0016] The key area preset switching cycle is based on the unified time synchronization system;

[0017] The initial key pointer value and the frame sequence number seed linked to the key pointer.

[0018] Based on the same inventive concept, this invention also provides a method for implementing a multi-destination synchronous encryption / decryption strategy at the physical layer, the method comprising:

[0019] Step 1: The encrypted terminal reads the physical layer destination identifier from the data frame to be processed and performs task distribution through a multi-threaded scheduler;

[0020] Step 2: Each thread queries the whitelist rules, triggers the encryption process for destination business flows that match successfully, otherwise passes through directly;

[0021] Step 3: Bind the corresponding key cluster according to the destination identifier and obtain the stream key of the current key area;

[0022] Step 4: Each thread performs frame-level encryption processing in parallel and updates the corresponding destination frame sequence number;

[0023] Step 5: Determine the exact second switching time based on the timing signal, and all terminals synchronously update the key pointers corresponding to each destination.

[0024] Optionally, the method further includes:

[0025] In a preset number of data frames before the version switch is performed in the key area, a switching marker is implanted in the reserved space within the frame by the synchronous switching controller.

[0026] The receiving end identifies the key switching status of the sending end based on the switching marker, thereby enabling seamless decryption between the sending and receiving ends at whole-second boundaries.

[0027] Optionally, the encryption process in step four uses an XOR method to process the data frame payload. The encryption process does not add extra bytes, thus achieving lossless bandwidth transmission.

[0028] Optionally, the key pointer advancement mechanism in step five is autonomous and negotiation-free. Each encrypted terminal independently determines the switching timing based on the local timing signal, without the need for handshake negotiation between terminals.

[0029] Compared with the prior art, the present invention has the following advantages:

[0030] Achieving parallel encryption across multiple destinations at the physical layer enhances processing capabilities: By introducing a multi-threaded scheduler at the physical layer, data streams from different destinations are parsed and distributed to independent parallel processing threads, enabling efficient encryption of data streams from multiple destinations simultaneously, thereby improving the overall throughput and processing performance of the system.

[0031] A perfect combination of multi-flow independent encryption and global synchronization: Each destination service flow has its own independent key cluster and processing thread, achieving physical isolation of key states and preventing interference. At the same time, all destinations share a unified time synchronization switching rhythm, ensuring a high degree of coordination in encryption and decryption operations across the entire network.

[0032] Nanosecond-level low latency meets the stringent requirements of private network environments: The multi-threaded architecture and pipelined parallel processing mechanism implemented at the physical layer greatly compress data processing time. Combined with direct encryption and decryption technology at the physical layer, it can provide nanosecond-level processing latency, making it particularly suitable for high-bandwidth private networks with extremely high deterministic requirements.

[0033] Negotiation-free synchronous handover ensures seamless service operation: Based on high-precision timing signals, the handover is synchronized to the second, eliminating the need for complex handshakes or parameter negotiations between terminals. The key switching process is completely transparent to upper-layer services, achieving uninterrupted communication, zero packet loss, and no frame retransmission, thus guaranteeing service continuity.

[0034] The dynamic key update and isolation mechanism provides extremely high security: the system supports rapid dynamic key updates at the second or even sub-second level, and combined with multi-destination key isolation and multi-threaded security isolation mechanisms, it effectively prevents the spread of the impact after a single point of attack and improves the system's ability to resist malicious attacks.

[0035] Precise encryption with no redundant bytes and excellent protocol compatibility: The system triggers encryption only for traffic flows within the whitelist, using a stream key XOR method to process the data without introducing extra fields or padding bytes, ensuring that the length of the encrypted data frame remains unchanged. This not only avoids bandwidth waste but also ensures perfect compatibility between the system and existing network protocols.

[0036] Supports large-scale, efficient deployment of distributed multi-node systems: Based on a unified timing signal benchmark, all nodes in the network and their multiple processing threads can achieve synchronized operation. This autonomous synchronization mechanism eliminates the negotiation burden caused by the increase in scale between nodes, making it suitable for large-scale distributed high-concurrency scenarios.

[0037] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description and claims. Detailed Implementation

[0038] To facilitate a clearer understanding of this technical solution by those skilled in the art, the technical solution of the present invention will be described in detail below:

[0039] The system in this embodiment includes a plurality of encrypted terminals interconnected via network devices, each terminal comprising:

[0040] An integrated network interface is used to send and receive physical layer data frames;

[0041] A multi-destination whitelist filter is used to read the destination address field in the data frame and match it with preset encryption rules;

[0042] A multi-destination key set stores several independent key clusters that correspond one-to-one with different destination identifiers. Each key cluster contains multiple sets of dynamic keys.

[0043] The time synchronization module is used to receive external high-precision time signals and provide a unified time reference for the entire network;

[0044] A synchronous switching controller is used to control the synchronous version switching of key clusters at all destinations based on the whole second of the timing signal.

[0045] Optionally, the terminal further includes a multi-threaded scheduler for distributing the parsed different destination service flows to independent parallel processing threads; wherein each processing thread is bound to several destination identifiers to achieve isolation and lock-free access to different destination key states.

[0046] Optionally, during the deployment phase, the system pre-configures all encrypted terminals via offline channels, the pre-configuration including:

[0047] Multiple dynamic key clusters for different destinations;

[0048] The key area preset switching cycle is based on the unified time synchronization system;

[0049] The initial key pointer value and the frame sequence number seed linked to the key pointer.

[0050] Specifically, each encrypted terminal is interconnected through network devices to form a secure communication network. The integrated network interface directly captures and forwards raw data frames at the physical layer, ensuring that the processing flow does not involve a complex protocol stack, thereby reducing transmission latency. A multi-destination whitelist filter extracts the target address information from the data frame in real time and compares it with pre-configured legal rules. Only data streams that match the rules trigger the encryption process; the remaining data is transmitted directly without modification. The multi-destination key set is divided into multiple independent storage areas within the hardware storage space. Each area specifically stores the dynamic key cluster corresponding to a specific receiver. This one-to-one mapping relationship achieves physical isolation between different destination service flows. The time synchronization module continuously acquires high-precision time information provided externally, establishing a completely consistent timeline for terminals distributed in different locations, ensuring a unified operating rhythm for all network nodes. The synchronization switching controller, as the core command unit, closely monitors changes in the time base. When the time signal precisely reaches the whole second, the controller triggers a global command, driving all destination-specific key areas to synchronously jump to the next version. The entire process does not require information exchange or handshake negotiation between terminals, ensuring the continuity and stability of multiple services during key replacement. A multi-threaded scheduler is responsible for allocating the parsed destination traffic to specific parallel processing threads. Each thread is strongly bound to one or more destination identifiers. This architecture achieves complete isolation of key states and lock-free access to data, significantly improving data throughput. During the deployment phase before the system goes live, key parameters are written to the terminals via a secure offline channel. These parameters include dynamic key clusters for different receivers, preset key area switching cycles, key pointers at the starting position, and sequence number seeds linked to the pointers. All terminals start with the same initial state, eliminating the need for complex algorithms or parameter negotiation during runtime, thus achieving autonomous synchronous encryption and decryption based on time pointers.

[0051] Based on the same inventive concept, this invention also provides a method for implementing a multi-destination synchronous encryption / decryption strategy at the physical layer, the method comprising:

[0052] Step 1: The encrypted terminal reads the physical layer destination identifier from the data frame to be processed and performs task distribution through a multi-threaded scheduler;

[0053] Step 2: Each thread queries the whitelist rules, triggers the encryption process for destination business flows that match successfully, otherwise passes through directly;

[0054] Step 3: Bind the corresponding key cluster according to the destination identifier and obtain the stream key of the current key area;

[0055] Step 4: Each thread performs frame-level encryption processing in parallel and updates the corresponding destination frame sequence number;

[0056] Step 5: Determine the exact second switching time based on the timing signal, and all terminals synchronously update the key pointers corresponding to each destination.

[0057] Optionally, the method further includes:

[0058] In a preset number of data frames before the version switch is performed in the key area, a switching marker is implanted in the reserved space within the frame by the synchronous switching controller.

[0059] The receiving end identifies the key switching status of the sending end based on the switching marker, thereby enabling seamless decryption between the sending and receiving ends at whole-second boundaries.

[0060] Optionally, the encryption process in step four uses an XOR method to process the data frame payload. The encryption process does not add extra bytes, thus achieving lossless bandwidth transmission.

[0061] Optionally, the key pointer advancement mechanism in step five is autonomous and negotiation-free. Each encrypted terminal independently determines the switching timing based on the local timing signal, without the need for handshake negotiation between terminals.

[0062] Specifically, the encrypted terminal captures data frames in real time through the physical layer interface and parses the destination address information in the frame structure. The multi-threaded scheduler accurately distributes data packets with different flow directions to preset independent processing threads based on the parsing results. Upon receiving data, each processing thread immediately queries the locally stored whitelist rule table. If the current destination is confirmed to be within the encryption list, encryption logic is initiated. If it is not within the list, the data frame is directly sent to the physical layer exit for transparent transmission, ensuring that non-business data does not incur additional processing delays. For data entering the encryption process, the processing thread retrieves the corresponding key area based on the destination identifier. For example, destination A is associated with the current valid area of ​​key cluster A, and destination B is associated with the current valid area of ​​key cluster B. This binding mechanism ensures complete isolation of key states between different business flows and enables lock-free parallel access to multi-path data. During the specific encryption execution phase, each thread extracts the stream key from the current key area and performs an XOR operation with the data frame payload. Since this method only changes the bit state without adding any padding bytes or redundant fields, it maintains the original frame length, achieving lossless bandwidth transmission. Simultaneously, the system automatically increments and records the frame sequence number corresponding to the destination. To ensure a smooth key switching process, the synchronization controller embeds specific switching markers in a pre-defined number of data frames before the current key area is exhausted or updated, thus prompting the receiving end to prepare for the switch in advance. When the timing signal acquired by the timing synchronization module reaches the integer second boundary, all encrypted terminals across the network automatically advance the key pointers corresponding to all destinations to the next version. The entire pointer advancement process relies entirely on local high-precision clock triggering, eliminating the need for complex handshake protocols or parameter negotiations between terminals. This achieves precise synchronization and seamless service switching across multiple nodes in a large-scale deployment environment.

[0063] It should be noted that the electrical connections between the various units described above do not necessarily represent direct or indirect connections. Any indirect connection method can be applied to the embodiments of the present invention as long as it achieves the purpose of the present invention. The above descriptions are merely exemplary embodiments of the present invention and should not be construed as limiting the scope of the present invention.

[0064] All equivalent changes and modifications made in accordance with the teachings of this invention are still within the scope of this invention. Those skilled in the art will readily conceive of other embodiments of this invention upon considering the specification and the disclosure of practical truth. This application is intended to cover any variations, uses, or adaptations of this invention that follow the general principles of this invention and include common knowledge or conventional techniques in the art not described herein.

Claims

1. A system for implementing multi-destination synchronous encryption / decryption strategies at the physical layer, characterized in that, The system includes several encrypted terminals interconnected via network devices, each terminal comprising: An integrated network interface is used to send and receive physical layer data frames; A multi-destination whitelist filter is used to read the destination address field in the data frame and match it with preset encryption rules; A multi-destination key set stores several independent key clusters that correspond one-to-one with different destination identifiers. Each key cluster contains multiple sets of dynamic keys. The time synchronization module is used to receive external high-precision time signals and provide a unified time reference for the entire network; A synchronous switching controller is used to control the synchronous version switching of key clusters at all destinations based on the whole second of the timing signal.

2. The system for implementing multi-destination synchronous encryption / decryption strategy at the physical layer according to claim 1, characterized in that, The terminal also includes a multi-threaded scheduler, which distributes the parsed different destination service flows to independent parallel processing threads; wherein each processing thread is bound to several destination identifiers to achieve isolation and lock-free access to different destination key states.

3. The system for implementing multi-destination synchronous encryption / decryption strategy at the physical layer according to claim 1, characterized in that, During the deployment phase, the system pre-configures all encrypted terminals through offline channels. This pre-configuration includes: Multiple dynamic key clusters for different destinations; The key area preset switching cycle is based on the unified time synchronization system; The initial key pointer value and the frame sequence number seed linked to the key pointer.

4. A method for implementing multi-destination synchronous encryption / decryption strategy at the physical layer, characterized in that, The method includes: Step 1: The encrypted terminal reads the physical layer destination identifier from the data frame to be processed and performs task distribution through a multi-threaded scheduler; Step 2: Each thread queries the whitelist rules, triggers the encryption process for destination business flows that match successfully, otherwise passes through directly; Step 3: Bind the corresponding key cluster according to the destination identifier and obtain the stream key of the current key area; Step 4: Each thread performs frame-level encryption processing in parallel and updates the corresponding destination frame sequence number; Step 5: Determine the exact second switching time based on the timing signal, and all terminals synchronously update the key pointers corresponding to each destination.

5. A method for implementing multi-destination synchronous encryption / decryption strategy at the physical layer according to claim 4, characterized in that, The method further includes: In a preset number of data frames before the version switch is performed in the key area, a switching marker is implanted in the reserved space within the frame by the synchronous switching controller. The receiving end identifies the key switching status of the sending end based on the switching marker, thereby enabling seamless decryption between the sending and receiving ends at whole-second boundaries.

6. A method for implementing multi-destination synchronous encryption / decryption strategy at the physical layer according to claim 4, characterized in that, The encryption process in step four uses an XOR method to process the data frame payload. The encryption process does not add extra bytes, thus achieving lossless bandwidth transmission.

7. A method for implementing multi-destination synchronous encryption / decryption strategy at the physical layer according to claim 4, characterized in that, The key pointer advancement mechanism in step five is autonomous and negotiation-free. Each encrypted terminal independently determines the switching timing based on the local timing signal, without the need for handshake negotiation between terminals.