A USB4 multi-tunnel secure transmission system and method based on a national secret algorithm

Abstract

The application discloses a USB4 multi-tunnel secure transmission system and method based on a national secret algorithm, time offset and propagation delay are calculated by exchanging time stamps when tunnels are established, and the length of the blocking time is determined; the time stamp of the data packet is maintained at the receiving end, and the replay packet is discarded or decrypted based on the monotonicity; the key is destroyed and the identifier is added to the blocking queue when the sending end closes the tunnel; the receiving end periodically checks the timeout, and the key is destroyed and the identifier is released after the timeout; the identifier is reused after the expiration of the blocking period of the sending end. The application discloses a USB4 multi-tunnel secure transmission system and method based on a national secret algorithm, time offset and propagation delay are calculated by exchanging time stamps when tunnels are established, and the length of the blocking time is determined; the time stamp of the data packet is maintained at the receiving end, and the replay packet is discarded or decrypted based on the monotonicity; the key is destroyed and the identifier is added to the blocking queue when the sending end closes the tunnel; the receiving end periodically checks the timeout, and the key is destroyed and the identifier is released after the timeout; the identifier is reused after the expiration of the blocking period of the sending end.

Description

Technical Field

[0001] This invention belongs to the field of USB4 multi-tunnel secure transmission technology, specifically relating to a USB4 multi-tunnel secure transmission system and method based on Chinese cryptographic algorithms. Background Technology

[0002] In a USB4 multi-tunnel secure transmission system based on Chinese national cryptographic algorithms, the national cryptographic session key and tunnel identifier must be destroyed and released simultaneously when a tunnel is closed. This identifier can be reused by a new tunnel. However, the USB4 physical link is susceptible to packet loss, which prevents the tunnel closure process from being achieved atomically.

[0003] The underlying principle is as follows: If the close notification packet sent by the initiating closer is lost, the closer destroys the key and reuses the identifier to establish a new tunnel. The receiver still uses the old key to process the encrypted data packets of the new tunnel, causing decryption failure and triggering a link error. If the acknowledgment packet is lost, the closer retains the key, but the receiver has already destroyed the key, making subsequent data unprocessable. This problem is essentially a classic challenge of distributed state changes on unreliable channels.

[0004] Existing technologies address these issues by employing explicit notification combined with a timeout retransmission mechanism. The party initiating the close repeatedly sends close notification packets until acknowledgment is received or a timeout occurs. The receiver then destroys the key and identifier upon replying with acknowledgment. The TCP protocol's TIME_WAIT mechanism also faces the problem of delayed duplicate segments, preventing old data from interfering with new connections by waiting for twice the maximum segment lifetime. Furthermore, existing technologies largely rely on sequence numbers or additional counters to defend against replay attacks and identify duplicate or abnormal data packets.

[0005] Furthermore, the current USB4 security scheme based on the national cryptographic algorithm also follows a similar approach, relying on retransmission to reduce the probability of packet loss. However, this method reduces transmission efficiency and cannot theoretically eliminate the state inconsistency window, nor can it achieve secure temporal isolation between key destruction and identifier reuse.

[0006] Therefore, existing technologies still lack a tunnel closing method that does not rely on explicit notification exchanges and can guarantee secure timing. Summary of the Invention

[0007] Purpose of the invention: In order to solve the problems of low tunnel closing efficiency and inability to guarantee security timing in existing national cryptographic algorithms, this invention provides a USB4 multi-tunnel secure transmission system and method based on national cryptographic algorithms.

[0008] Technical Solution: A secure USB4 multi-tunnel transmission method based on Chinese national cryptographic algorithms, applied to USB4 multi-tunnel transmission, wherein each tunnel has an independent Chinese national cryptographic session key and tunnel identifier, including the following steps: Tunnel establishment steps: The sending end and the receiving end exchange local timestamps, and calculate the maximum one-way propagation delay and time offset of the link based on the local timestamps; the sending end calculates the blocking time length based on the maximum one-way propagation delay and time offset of the link, and transmits the blocking time length to the receiving end; Tunnel transmission steps: The sending end sends a data packet containing a sending timestamp, the receiving end receives the data packet, extracts the sending timestamp, calculates the local equivalent time corresponding to the sending timestamp, maintains the sending timestamp and the local equivalent time, and decrypts and processes the legitimate data packet using the national cryptographic algorithm; Tunnel closure steps: When the sending end needs to close the tunnel, it destroys the tunnel's national cryptographic session key, records the current local closure time, and adds the tunnel's identifier to the blocking queue. The duration of the blocking queue is the blocking time length. The receiving end periodically determines whether the tunnel needs to be closed. If the local time exceeds the sum of the local equivalent time and the blocking time length, it destroys the tunnel's national cryptographic session key and releases the tunnel's identifier. After the blocking time length expires, the sending end assigns the tunnel identifier to a new tunnel.

[0009] Furthermore, in the tunnel establishment step, the calculation methods for the maximum one-way propagation delay, time offset, and blocking time length of the link include: The sending end sends a first data packet to the receiving end, the first data packet containing the sending end's local first timestamp t1; After receiving the first data packet, the receiving end records the receiving time as the local second timestamp t2 and returns a second data packet to the sending end, the second data packet containing the local second timestamp t2; After receiving the second data packet, the sending end records the reception time as the local third timestamp t3, and calculates the maximum one-way propagation delay d and time offset δ of the link based on the local first timestamp t1, the local second timestamp t2, and the local third timestamp t3. d=(t3-t1) / 2, δ = t2 - t1 - d; Calculate the blocking time length L: L = max(0, δ).

[0010] Furthermore, in the tunnel transmission step, the method by which the receiving end maintains the sending timestamp and the corresponding local equivalent time includes: The receiving end allocates a first variable and a second variable for the tunnel. The first variable is used to store the sending timestamp, and the second variable is used to store the local equivalent time corresponding to the sending timestamp. The local equivalent time is equal to the sum of the sending timestamp and the time offset. For each valid data packet received, the receiving end extracts the sending timestamp of the data packet and stores it in the first variable; it then calculates the local equivalent time based on the sending timestamp and stores it in the second variable.

[0011] Furthermore, in the tunnel transmission step, the method by which the receiving end determines whether the data packet is valid includes: The receiving end receives a new data packet, extracts the sending timestamp, calculates the local equivalent time corresponding to the sending timestamp, and determines whether it is a valid data packet based on the newly calculated local equivalent time and the local equivalent time stored in the second variable. If the newly calculated local equivalent time is greater than the local equivalent time stored in the second variable, the data packet is considered a valid data packet, the new sending timestamp is stored in the first variable, and the new local equivalent time is stored in the second variable; otherwise, it is an invalid data packet and is discarded.

[0012] Furthermore, in the tunnel closing step, The receiving end periodically reads the current local time at fixed time intervals; For each open tunnel, the receiving end obtains the currently stored local equivalent time of the tunnel. The receiving end determines whether the current local time is greater than the sum of the local equivalent time and the blocking time length; When the current local time is greater than the sum of the local equivalent time and the blocking time length, the receiving end destroys the national cryptographic session key of the tunnel and marks the tunnel's identifier as reusable.

[0013] Furthermore, in the tunnel closing step, the start time of the blocking queue is the current local closing time; the sending end is prohibited from assigning the tunnel identifier to any new tunnel before the blocking time length expires.

[0014] Furthermore, in the tunnel closing step, After adding the tunnel identifier to the blocking queue, the sending end starts a timer; The timing duration of the timer is equal to the blocking time length; When the timer expires, the sending end removes the tunnel identifier from the blocking queue; When a new tunnel needs to be established, the sending end selects an available tunnel identifier from outside the blocking queue and allocates it.

[0015] A USB4 multi-tunnel secure transmission system based on Chinese cryptographic algorithms, applied to the aforementioned USB4 multi-tunnel secure transmission method based on Chinese cryptographic algorithms, includes a time synchronization unit, a transmitting end management unit, a receiving end processing unit, a receiving end timeout unit, and an identifier reuse unit. The time synchronization unit is used to calculate the time offset, the maximum one-way propagation delay of the link, and the blocking time length when the tunnel is established. The sending end management unit is used to destroy the session key and add the tunnel identifier to the blocking queue when the tunnel is closed; The receiving end processing unit is used to maintain the data packet sending timestamp and local equivalent time, and to determine whether the data packet is a valid data packet based on the current local time and the local equivalent time. The receiver timeout unit is used to determine the timeout based on the local equivalent time and the length of the blocking time and to destroy the key release tunnel identifier. The identifier reuse unit is used to redistribute tunnel identifiers after the blocking time period has expired.

[0016] Furthermore, the receiving end processing unit is used to determine whether a data packet is a valid data packet based on the current local equivalent time and the stored local equivalent time. If the current local equivalent time is greater than the stored local equivalent time, the data packet is valid; otherwise, it is an invalid data packet.

[0017] Furthermore, the transmitting end management unit uses a timer for timing, specifically including: After the sending end management unit adds the tunnel identifier to the blocking queue, it starts a timer; The timing duration of the timer is equal to the blocking time length; When the timer expires, the sending end removes the tunnel identifier from the blocking queue.

[0018] Compared with existing technologies, the USB4 multi-tunnel secure transmission system and method based on national cryptographic algorithms provided by this invention have the following beneficial effects: 1. Compared with the traditional technical solution that uses explicit closure notification plus timeout retransmission mechanism, this invention completely eliminates the exchange of notification packets when closing the tunnel, and eliminates the inconsistency problem caused by one party destroying the key while the other party retains the key due to the loss of notification packets or acknowledgment packets; although the existing technology reduces the probability of packet loss through retransmission, it cannot theoretically guarantee the atomicity of tunnel closure; this invention uses the maximum one-way propagation delay of the link and time offset to accurately calculate the blocking time length, so that the time of identifier reuse at the sending end is strictly later than the time of key destruction at the receiving end, which guarantees the secure isolation of key destruction and identifier reuse in terms of timing, avoids link failure caused by new tunnel data being incorrectly decrypted by the old key, does not rely on explicit notification and retransmission mechanism, and improves tunnel closure efficiency; 2. Compared with existing technologies that rely on sequence numbers or additional counters to defend against replay attacks, this invention requires no additional protocol fields or storage overhead. It directly utilizes the USB4 link layer hardware to force a monotonically increasing timestamp field, constructing packet decision logic based on the timestamp monotonicity at the receiving end. Existing technologies cannot defend against ghost packets remaining in the link after tunnel closure interfering with new tunnels. However, this invention, by comparing the monotonicity of the local equivalent time of the packet with the latest stored value, can accurately identify and discard any abnormal packets with timestamp rollback or duplication, achieving zero-overhead anti-replay capability while simultaneously ensuring forward security that historical ciphertext cannot be decrypted after tunnel closure. Attached Figure Description

[0019] Figure 1 This is a flowchart of the USB4 multi-tunnel secure transmission method based on national cryptographic algorithms of the present invention; Figure 2 This is a flowchart of the sending end method of the USB4 multi-tunnel secure transmission method based on national cryptographic algorithms of the present invention; Figure 3 This is a flowchart of the receiving end method of the USB4 multi-tunnel secure transmission method based on the national cryptographic algorithm of the present invention. Detailed Implementation

[0020] The present invention will be further explained and described below with reference to the accompanying drawings and specific embodiments.

[0021] A secure USB4 multi-tunnel transmission method based on Chinese national cryptographic algorithms is proposed, applied to USB4 multi-tunnel transmission. Each tunnel has an independent Chinese national cryptographic session key and tunnel identifier, such as... Figure 1 As shown, it includes the following steps: Tunnel establishment steps: The sending end and the receiving end exchange local timestamps, and calculate the maximum one-way propagation delay and time offset of the link based on the local timestamps; the sending end calculates the blocking time length based on the maximum one-way propagation delay and time offset of the link, and transmits the blocking time length to the receiving end. The steps described here are all relevant to the content of this method. Other necessary operations may also be required, but will not be elaborated upon here.

[0022] The methods for calculating the maximum one-way propagation delay, time offset, and blocking time of the link include: The sending end sends a first data packet to the receiving end, the first data packet containing the sending end's local first timestamp t1; After receiving the first data packet, the receiving end records the receiving time as the local second timestamp t2 and returns a second data packet to the sending end, the second data packet containing the local second timestamp t2; After receiving the second data packet, the sending end records the reception time as the local third timestamp t3, and calculates the maximum one-way propagation delay d and time offset δ of the link based on the local first timestamp t1, the local second timestamp t2, and the local third timestamp t3. d=(t3-t1) / 2, δ = t2 - t1 - d; Calculate the blocking time length L: L = max(0, δ).

[0023] Tunnel transmission steps: The sending end sends a data packet containing a sending timestamp, the receiving end receives the data packet, maintains the sending timestamp and the corresponding local equivalent time, and uses the national cryptographic algorithm to decrypt and process the legitimate data packet.

[0024] Among them, such as Figure 3 As shown, the method for the receiving end to maintain the sending timestamp and the corresponding local equivalent time includes: the receiving end allocates a first variable and a second variable for the tunnel, the first variable is used to store the sending timestamp, and the second variable is used to store the local equivalent time corresponding to the sending timestamp, wherein the local equivalent time is equal to the sum of the sending timestamp and the time offset; for each valid data packet received, the receiving end extracts the sending timestamp of the data packet and stores it in the first variable; and calculates the local equivalent time based on the sending timestamp and stores it in the second variable.

[0025] like Figure 3 As shown, the methods used by the receiving end to determine whether a data packet is valid include: The receiving end receives a new data packet, extracts the sending timestamp, calculates the local equivalent time corresponding to the sending timestamp, and determines whether it is a valid data packet based on the newly calculated local equivalent time and the local equivalent time stored in the second variable. If the newly calculated local equivalent time is greater than the local equivalent time stored in the second variable, the data packet is considered a valid data packet, the new sending timestamp is stored in the first variable, and the new local equivalent time is stored in the second variable; otherwise, it is an invalid data packet and is discarded.

[0026] The aforementioned logical judgment is based on the hardware-forced monotonically increasing characteristic of the USB4 link layer timestamp. In the USB4 specification, the timestamp carried by each data packet at the sending end is automatically filled by a local hardware counter, which strictly increments after each data packet is sent and never rolls back. Therefore, legitimate data packets sent sequentially within the same tunnel will necessarily have strictly increasing timestamps, thus allowing the determination of the data packet's legitimacy.

[0027] The receiving end maintains the sending timestamp of the most recent valid data packet and its local equivalent time. When a new data packet is received, the receiving end calculates its local equivalent time and compares it with the stored value.

[0028] When a situation occurs where the timestamp of the new data packet is significantly greater than the timestamp of the previous valid data packet, it indicates that the data packet is newly generated by the sender and conforms to the time increment rule, thus being judged as a valid data packet. The receiver accepts the packet, updates the stored variables, and decrypts it using the national cryptographic algorithm.

[0029] When a situation occurs where the data packet's timestamp is less than or equal to a previous valid timestamp, it indicates that the timestamp of the new data packet has rolled back. This violates the monotonically increasing law of hardware, suggesting that an attacker may be replaying an old data packet recorded by another attacker. If the timestamps are equal, it means that the timestamps are the same. Under normal circumstances, hardware will not generate two different data packets with the same timestamp, which is also an anomaly, possibly indicating a replay or a system error.

[0030] Neither of these scenarios conforms to the expected characteristics of a legitimate data stream, and therefore they are judged as invalid or attack packets, discarded directly, without updating their state or triggering decryption processing.

[0031] Tunnel closure steps: as follows Figure 2 As shown, when the sending end needs to close the tunnel, it destroys the tunnel's national cryptographic session key, records the current local closing time, and adds the tunnel's identifier to the blocking queue. The duration of the blocking queue is the blocking time length. The receiving end periodically determines whether the tunnel needs to be closed throughout the entire process (because the receiving end does not know when to close, so it needs to periodically determine throughout the entire process). If the local time exceeds the sum of the local equivalent time and the blocking time length, it destroys the tunnel's national cryptographic session key and releases the tunnel's identifier. After the blocking time length expires, the sending end allocates the tunnel identifier to a new tunnel. Preferably, the tunnel identifier is removed from the blocking queue immediately after the blocking time length expires, which can maximize the utilization rate of the tunnel identifier. Alternatively, the tunnel identifier can be removed from the blocking queue some time after the blocking time length expires.

[0032] During the tunnel closure step, for the sending end, the start time of the blocking queue is the current local closure time; the sending end is prohibited from assigning the tunnel identifier to any new tunnel before the blocking time expires. This can be done using a timer, specifically including: After adding the tunnel identifier to the blocking queue, the sending end starts a timer; The timing duration of the timer is equal to the blocking time length; When the timer expires, the sending end removes the tunnel identifier from the blocking queue; When a new tunnel needs to be established, the sending end selects an available tunnel identifier from outside the blocking queue and allocates it.

[0033] During the tunnel closure process, such as Figure 3 As shown, for the receiving end, specifically it includes: the receiving end periodically reads the current local time at fixed time intervals; For each open tunnel, the receiving end obtains the currently stored local equivalent time of the tunnel. The receiving end determines whether the current local time is greater than the sum of the local equivalent time and the blocking time length; If the current local time is greater than the sum of the local equivalent time and the blocking time length, the receiving end destroys the national cryptographic session key of the tunnel and marks the tunnel's identifier as reusable.

[0034] A USB4 multi-tunnel secure transmission system based on Chinese cryptographic algorithms, applied to the aforementioned USB4 multi-tunnel secure transmission method based on Chinese cryptographic algorithms, includes a time synchronization unit, a transmitting end management unit, a receiving end processing unit, a receiving end timeout unit, and an identifier reuse unit. The time synchronization unit is used to calculate the time offset, the maximum one-way propagation delay of the link, and the blocking time length when the tunnel is established. The sending end management unit is used to destroy the session key and add the tunnel identifier to the blocking queue when the tunnel is closed; The receiving end processing unit is used to maintain the data packet sending timestamp and local equivalent time, and to determine whether the data packet is a valid data packet based on the monotonicity of the timestamp. The receiver timeout unit is used to determine the timeout based on the local equivalent time and the length of the blocking time and to destroy the key release tunnel identifier. The identifier reuse unit is used to redistribute tunnel identifiers after the blocking time period has expired.

[0035] To illustrate the above scheme more vividly, consider the following example. A secure tunnel using Chinese cryptographic algorithms is established between a host and a solid-state drive (SSD) connected by a USB 4.0 active cable. The host acts as the sender, and the SSD as the receiver. When the tunnel is established, the sender sends a first data packet to the receiver. This data packet carries the current value of the sender's local hardware timestamp counter, assuming the first local timestamp t1 is 1000 nanoseconds. After receiving the first data packet, the receiver records the second local timestamp t2 as 1007 nanoseconds. The receiver encapsulates t2 in a second data packet and returns it to the sender. After receiving the second data packet, the sender records the third local timestamp t3 as 1010 nanoseconds.

[0036] The sender calculates the time offset δ and the maximum one-way propagation delay d based on three timestamps. First, it calculates the round-trip time, with the maximum one-way propagation delay d = (t3 - t1) / 2, which is (1010 - 1000) / 2 = 5 nanoseconds. Then, it calculates the time offset δ = t2 - t1 - d, which is 1007 - 1000 - 5 = 2 nanoseconds. The sender determines the blocking time length based on the sum of the propagation delay and the positive portion of the time offset. The positive portion of the time offset is max(0, 2), which is 2 nanoseconds. The blocking time length L = d + δ, which is 5 plus 2 equals 7 nanoseconds. The sender encapsulates L (7 nanoseconds) in a third data packet and sends it to the receiver, where the receiver stores this value.

[0037] The tunnel enters the normal data transmission phase. The sending end continuously sends data packets to the receiving end, each data packet carrying a hardware-monotonically increasing transmission timestamp. The transmission timestamp t_first of the first valid data packet is 2000 nanoseconds. After receiving this packet, the receiving end calculates its local equivalent time t_eq_first, which equals t_first + δ, i.e., 2000 + 2 = 2002 nanoseconds. The receiving end allocates a first variable P to store the transmission timestamp of 2000 nanoseconds and a second variable Q to store the local equivalent time of 2002 nanoseconds.

[0038] The second data packet was sent with a timestamp of 2001 nanoseconds. The receiver calculated the current local equivalent time to be 2001 + 2 = 2003 nanoseconds. Comparing 2003 and Q (2002), P was updated to 2001 nanoseconds and Q to 2003 nanoseconds, and the data packet was decrypted using the SM4 algorithm. If the third data packet is replayed by an attacker, its timestamp will be 2000 nanoseconds. The calculated local equivalent time is 2000 + 2 = 2002 nanoseconds, which is not greater than the current Q value of 2003 nanoseconds. The receiver will then consider it an abnormal packet and discard it, without updating P and Q.

[0039] After completing data transmission, the sender decides to close the tunnel. Let the current local closing time T_close_tx be 3000 nanoseconds. The sender immediately destroys the national cryptographic session key for this tunnel, adds the tunnel identifier ID equal to 5 to the blocking queue, and starts a timer with a duration of L, i.e., 7 nanoseconds. The sender prohibits assigning ID equal to 5 to any new tunnel within these 7 nanoseconds.

[0040] The receiving end continuously performs periodic background checks at 1-nanosecond intervals. At a certain check time, the receiving end reads its current local time T_now_rx. Due to a time offset δ=2 nanoseconds between the two ends, the receiving end time equals the sending end time plus 2 nanoseconds. That is, when the sending end's tunnel closure time is 2009 nanoseconds, the corresponding local time at the receiving end is approximately 2011 nanoseconds. The receiving end obtains the currently stored local equivalent time Q of the tunnel. Assuming the timestamp of the last normal data packet in the tunnel is 2001 nanoseconds, the corresponding Q is equal to 2003 nanoseconds. The receiving end checks whether T_now_rx is greater than Q+L. At this time, T_now_rx = 2011 nanoseconds, Q+L = 2003+7 = 2010 nanoseconds. 2011 is greater than 2010, so a timeout is triggered. The receiving end destroys the national cryptographic session key of the tunnel and marks the tunnel identifier ID equal to 5 as reusable.

[0041] The sender's timer expires after 7 nanoseconds, specifically at 2016 nanoseconds, and removes ID 5 from the blocking queue. When a new tunnel needs to be established, the sender can assign ID 5 to the new tunnel. Since the receiver destroyed the old key at 2011 nanoseconds, much earlier than the sender's reuse at 2016 nanoseconds, the data packets of the new tunnel will not be incorrectly decrypted by the old key, thus ensuring secure isolation. All data calculations are reasonable: a propagation delay of 5 nanoseconds corresponds to approximately 1 meter of cable, a time offset of 2 nanoseconds is within the clock drift range, and a blocking time of 7 nanoseconds ensures timing isolation.

[0042] This method does not rely on explicit notification, requires no retransmission, does not reduce transmission efficiency, and can theoretically eliminate the state inconsistency window. It precisely binds the timeout window to the physical link propagation delay and uses data packet timestamps to achieve secure timing isolation between key destruction and identifier reuse. This ensures that the identifier reuse time at the sending end is strictly later than the key destruction time at the receiving end, thereby guaranteeing secure isolation between key destruction and identifier reuse in terms of timing and avoiding link failures caused by new tunnel data being incorrectly decrypted by the old key.

[0043] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A USB4 multi-tunnel secure transmission method based on Chinese national cryptographic algorithms, applied to USB4 multi-tunnel transmission, wherein each tunnel has an independent Chinese national cryptographic session key and tunnel identifier, characterized in that, Includes the following steps: Tunnel establishment steps: The sending end and the receiving end exchange local timestamps, and calculate the maximum one-way propagation delay and time offset of the link based on the local timestamps; the sending end calculates the blocking time length based on the maximum one-way propagation delay and time offset of the link, and transmits the blocking time length to the receiving end; The methods for calculating the maximum one-way propagation delay, time offset, and blocking time of a link include: The sending end sends a first data packet to the receiving end, the first data packet containing the sending end's local first timestamp t1; After receiving the first data packet, the receiving end records the receiving time as the local second timestamp t2 and returns a second data packet to the sending end, the second data packet containing the local second timestamp t2; After receiving the second data packet, the sending end records the reception time as the local third timestamp t3, and calculates the maximum one-way propagation delay d and time offset δ of the link based on the local first timestamp t1, the local second timestamp t2, and the local third timestamp t3. d=(t3-t1) / 2, δ = t2 - t1 - d; Calculate the blocking time length L: L = d + max(0, δ); Tunnel transmission steps: The sending end sends a data packet containing a sending timestamp, the receiving end receives the data packet, extracts the sending timestamp, calculates the local equivalent time corresponding to the sending timestamp, the local equivalent time is equal to the sum of the sending timestamp and the time offset, and maintains the sending timestamp and the local equivalent time, and uses the national cryptographic algorithm to decrypt and process the legitimate data packet; The methods used by the receiving end to determine whether a data packet is valid include: The receiving end receives a new data packet, extracts the sending timestamp, calculates the local equivalent time corresponding to the sending timestamp, and determines whether it is a valid data packet based on the newly calculated local equivalent time and the most recently stored local equivalent time. If the newly calculated local equivalent time is greater than the most recently stored local equivalent time, the data packet is considered a valid data packet, and the sending timestamp and local equivalent time are updated; otherwise, it is an invalid data packet and is discarded. Tunnel closure steps: When the sending end needs to close the tunnel, it destroys the tunnel's national cryptographic session key, records the current local closure time, and adds the tunnel's identifier to the blocking queue. The duration of the blocking queue is the blocking time length. The receiving end periodically determines whether the tunnel needs to be closed. If the local time exceeds the sum of the local equivalent time and the blocking time length, it destroys the tunnel's national cryptographic session key and releases the tunnel's identifier. After the blocking time length expires, the sending end assigns the tunnel identifier to a new tunnel.

2. The USB4 multi-tunnel secure transmission method based on national cryptographic algorithms according to claim 1, characterized in that, In the tunnel transmission step, the method by which the receiving end maintains the sending timestamp and the corresponding local equivalent time includes: The receiving end allocates a first variable and a second variable to the tunnel. The first variable is used to store the sending timestamp, and the second variable is used to store the local equivalent time corresponding to the sending timestamp. For each valid data packet received, the receiving end extracts the sending timestamp of the data packet and stores it in the first variable; it then calculates the local equivalent time based on the sending timestamp and stores it in the second variable.

3. The USB4 multi-tunnel secure transmission method based on national cryptographic algorithms according to claim 1 or 2, characterized in that, In the tunnel closing step The receiving end periodically reads the current local time at fixed time intervals; For each open tunnel, the receiving end obtains the currently stored local equivalent time of the tunnel. The receiving end determines whether the current local time is greater than the sum of the local equivalent time and the blocking time length; When the current local time is greater than the sum of the local equivalent time and the blocking time length, the receiving end destroys the national cryptographic session key of the tunnel and marks the tunnel's identifier as reusable.

4. The USB4 multi-tunnel secure transmission method based on national cryptographic algorithms according to claim 1 or 2, characterized in that, In the tunnel closing step, the start time of the blocking queue is the current local closing time; the sending end is prohibited from assigning the tunnel identifier to any new tunnel before the blocking time expires.

5. The USB4 multi-tunnel secure transmission method based on national cryptographic algorithms according to claim 3, characterized in that, In the tunnel closing step After adding the tunnel identifier to the blocking queue, the sending end starts a timer; The timing duration of the timer is equal to the blocking time length; When the timer expires, the sending end removes the tunnel identifier from the blocking queue; When a new tunnel needs to be established, the sending end selects an available tunnel identifier from outside the blocking queue and allocates it.

6. A USB4 multi-tunnel secure transmission system based on Chinese cryptographic algorithms, applied to the USB4 multi-tunnel secure transmission method based on Chinese cryptographic algorithms as described in any one of claims 1-5, characterized in that, It includes a time synchronization unit, a transmitter management unit, a receiver processing unit, a receiver timeout unit, and an identifier reuse unit; The time synchronization unit is used to calculate the time offset, the maximum one-way propagation delay of the link, and the blocking time length when the tunnel is established. The sending end management unit is used to destroy the session key and add the tunnel identifier to the blocking queue when the tunnel is closed; The receiving end processing unit is used to maintain the data packet sending timestamp and local equivalent time, and to determine whether the data packet is a valid data packet based on the current local equivalent time and the stored local equivalent time. The receiver timeout unit is used to determine the timeout based on the local equivalent time and the length of the blocking time and to destroy the key release tunnel identifier. The identifier reuse unit is used to redistribute tunnel identifiers after the blocking time period has expired.

7. The USB4 multi-tunnel secure transmission system based on national cryptographic algorithms according to claim 6, characterized in that, The receiving end processing unit is used to determine whether a data packet is a valid data packet based on the current local equivalent time and the stored local equivalent time. If the current local equivalent time is greater than the stored local equivalent time, the data packet is valid; otherwise, it is an invalid data packet.

8. The USB4 multi-tunnel secure transmission system based on national cryptographic algorithms according to claim 6 or 7, characterized in that, The sending end management unit uses a timer for timing, specifically including: After the sending end management unit adds the tunnel identifier to the blocking queue, it starts a timer; The timing duration of the timer is equal to the blocking time length; When the timer expires, the sending end removes the tunnel identifier from the blocking queue.

Images