A secure communication method, apparatus, device, medium and program product

Abstract

The application provides a secure communication method, device, equipment, medium and program product, relates to the technical field of communication, and is used for improving the security, delicacy and transmission efficiency of encrypted communication and reducing the deployment complexity. The specific technical scheme is as follows: obtaining first key context information corresponding to a target service and a first target segment routing path; determining a first secure communication strategy based on the first key context information, a first path identifier of the first target segment routing path, and a service flow identifier of the target service; sending a first key issuing instruction to a quantum key layer, which is used for instructing the quantum key layer to issue a first quantum key corresponding to the first key context information to a first network forwarding node corresponding to the first target segment routing path; and issuing the first secure communication strategy to the first network forwarding node, which is used for instructing the first network forwarding node to perform encryption processing on data by using the first quantum key. The application is applied to a high-security-level bearer network private line communication scene.

Description

Technical Field

[0001] This application relates to the field of data communication technology, and in particular to a secure communication method, apparatus, device, medium, and program product. Background Technology

[0002] With the large-scale deployment of SRv6 (Segment Routing over IPv6) in high-security scenarios, traditional encryption algorithms face the risk of being cracked by quantum computing, and the transport network suffers from security vulnerabilities such as data eavesdropping and traffic hijacking. Currently, the industry widely adopts quantum key distribution technology to build transmission tunnels resistant to quantum attacks.

[0003] In some existing solutions, the controller uniformly acquires and relays the quantum key, the external gateway completes the encryption and decryption process, and the SRv6 forwarding device only performs regular forwarding.

[0004] Under this architecture, the key is cached through the controller, which poses a risk of leakage; the key is not strongly bound to the path and the business, and the sharing of keys by multiple businesses leads to a rough protection; the external gateway increases latency and cost, and the policy coordination is complicated, which restricts the carrying of high-security services and large-scale deployment. Summary of the Invention

[0005] This application provides a secure communication method, apparatus, device, medium, and program product to improve the security, precision, and transmission efficiency of encrypted communication, reduce deployment complexity, and ensure high-quality carrying and large-scale deployment of high-security services.

[0006] In a first aspect, embodiments of this application provide a secure communication method, the method comprising:

[0007] Obtain the first key context information and the first target segment routing path corresponding to the target service;

[0008] Based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service, a first secure communication strategy is determined.

[0009] A first key distribution instruction is sent to the quantum key layer, which instructs the quantum key layer to distribute the first quantum key corresponding to the first key context information to the first network forwarding node corresponding to the first target segment routing path.

[0010] The first secure communication policy is sent to the first network forwarding node, and the first secure communication policy is used to instruct the first network forwarding node to encrypt the data of the target service using the first quantum key.

[0011] The technical solution provided in this application brings at least the following beneficial effects:

[0012] The security policy of the secure communication method in this embodiment is generated by a unique binding relationship among three dimensions: key, path, and service. Therefore, when a forwarding node receives the policy, only data packets that simultaneously match the service flow and the path can invoke the corresponding quantum key for encryption and decryption. This eliminates the possibility of key reuse across services and paths from the protocol layer, achieving fine-grained security isolation for single service, single path, and single key. Secondly, the key issuance instruction directly points to the quantum key layer, requiring it to push the key body directly to the forwarding node, while the policy is issued by the control layer. This "key and policy split transmission" architecture makes the original quantum key unaffected. By requiring relay or caching at the control layer, the risk of keys being stolen or leaked at the centralized control node in traditional solutions is avoided. Furthermore, after receiving and locally caching the key and policy, the forwarding node can independently complete real-time encryption and decryption at line speed during message forwarding without the need for an external encryption gateway. This eliminates the latency loss of intermediate devices and achieves an integrated and intrinsic fusion of transmission and security. Ultimately, it works synergistically from three levels: "refined security isolation", "secure key transmission", and "improved forwarding performance", enhancing the intrinsic security capabilities of the SRv6 network in high-security scenarios such as resisting quantum computing attacks, preventing traffic hijacking and data tampering.

[0013] One possible implementation involves obtaining the first key context information corresponding to the target service, including:

[0014] Generate a key context retrieval instruction, wherein the key context retrieval instruction carries the security level information of the target service;

[0015] Send the key context retrieval instruction to the quantum key layer, the key context retrieval instruction being used to instruct the quantum key layer to retrieve the key context information corresponding to the security level information;

[0016] Receive the first key context information sent by the quantum key layer.

[0017] Another possible implementation, wherein obtaining the first target segment routing path corresponding to the target service includes:

[0018] Based on the transmission requirement information of the target service and the network status parameters of the forwarding layer, the routing path of the first target segment is determined.

[0019] Another possible implementation, wherein determining the first secure communication policy based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service includes:

[0020] Establish a binding mapping relationship between the first key context information, the first path identifier, and the service flow identifier;

[0021] The first secure communication policy is generated based on the binding mapping relationship.

[0022] Another possible implementation, wherein generating the first secure communication policy based on the binding mapping relationship includes:

[0023] A forwarding matching rule is generated based on the binding mapping relationship. The forwarding matching rule is used to instruct the first network forwarding node to match the corresponding key identifier based on the service flow identifier and the first path identifier.

[0024] A path protection policy is generated based on the binding mapping relationship. The path protection policy is used to instruct the first network forwarding node to prohibit processing the data packet when it matches a data packet that is not the same as the service flow identifier and the first path identifier.

[0025] An encryption / decryption processing rule is generated based on the key identifier, and the encryption / decryption processing rule is used to instruct the first network forwarding node to call the first quantum key corresponding to the key identifier;

[0026] The first secure communication policy is generated based on the forwarding matching rules, the path protection strategy, and the encryption / decryption processing rules.

[0027] Another possible implementation is that, after the first secure communication policy is sent to the first network forwarding node, the secure communication method further includes:

[0028] If the switching triggering conditions are met, obtain the second key context information and the second target segment routing path corresponding to the target service;

[0029] Based on the second key context information, the second path identifier of the second target segment routing path, and the service flow identifier, a second secure communication strategy is determined.

[0030] Send a second key distribution instruction to the quantum key layer. The second key distribution instruction is used to instruct the quantum key layer to distribute the second quantum key corresponding to the second key context information to the second network forwarding node corresponding to the second target segment routing path.

[0031] The second secure communication policy is sent to the second network forwarding node;

[0032] Send a switching instruction, which is used to indicate that the execution policy is switched from the first secure communication policy to the second secure communication policy, and the bearer path is switched from the first target segment routing path to the second target segment routing path.

[0033] Secondly, embodiments of this application provide a secure communication device, including:

[0034] The acquisition module is used to acquire the first key context information and the first target segment routing path corresponding to the target service;

[0035] The determining module is used to determine a first secure communication strategy based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service;

[0036] The sending module is used to send a first key distribution instruction to the quantum key layer. The first key distribution instruction is used to instruct the quantum key layer to distribute the first quantum key corresponding to the first key context information to the first network forwarding node corresponding to the first target segment routing path.

[0037] The sending module is further configured to send the first secure communication policy to the first network forwarding node, wherein the first secure communication policy is configured to instruct the first network forwarding node to encrypt the data of the target service using the first quantum key.

[0038] One possible implementation is that the acquisition module is specifically used for:

[0039] Generate a key context retrieval instruction, wherein the key context retrieval instruction carries the security level information of the target service;

[0040] Send the key context retrieval instruction to the quantum key layer, the key context retrieval instruction being used to instruct the quantum key layer to retrieve the key context information corresponding to the security level information;

[0041] Receive the first key context information sent by the quantum key layer.

[0042] Another possible implementation, the acquisition module is specifically used for:

[0043] Based on the transmission requirement information of the target service and the network status parameters of the forwarding layer, the routing path of the first target segment is determined.

[0044] Another possible implementation is that the determining module is specifically used for:

[0045] Establish a binding mapping relationship between the first key context information, the first path identifier, and the service flow identifier;

[0046] The first secure communication policy is generated based on the binding mapping relationship.

[0047] Another possible implementation is that the determining module is specifically used for:

[0048] A forwarding matching rule is generated based on the binding mapping relationship. The forwarding matching rule is used to instruct the first network forwarding node to match the corresponding key identifier based on the service flow identifier and the first path identifier.

[0049] A path protection policy is generated based on the binding mapping relationship. The path protection policy is used to instruct the first network forwarding node to prohibit processing the data packet when it matches a data packet that is not the same as the service flow identifier and the first path identifier.

[0050] An encryption / decryption processing rule is generated based on the key identifier, and the encryption / decryption processing rule is used to instruct the first network forwarding node to call the first quantum key corresponding to the key identifier;

[0051] The first secure communication policy is generated based on the forwarding matching rules, the path protection strategy, and the encryption / decryption processing rules.

[0052] In another possible implementation, after the first secure communication policy is sent to the first network forwarding node, the acquisition module is further configured to:

[0053] If the switching triggering conditions are met, obtain the second key context information and the second target segment routing path corresponding to the target service;

[0054] The determining module is further configured to:

[0055] Based on the second key context information, the second path identifier of the second target segment routing path, and the service flow identifier, a second secure communication strategy is determined.

[0056] The sending module is further configured to:

[0057] Send a second key distribution instruction to the quantum key layer. The second key distribution instruction is used to instruct the quantum key layer to distribute the second quantum key corresponding to the second key context information to the second network forwarding node corresponding to the second target segment routing path.

[0058] The second secure communication policy is sent to the second network forwarding node;

[0059] Send a switching instruction, which is used to indicate that the execution policy is switched from the first secure communication policy to the second secure communication policy, and the bearer path is switched from the first target segment routing path to the second target segment routing path.

[0060] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory stores a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect described above.

[0061] Fourthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect described above.

[0062] Fifthly, this application provides a computer program product stored in a storage medium, which, when executed by a computer, implements the method described in the first aspect.

[0063] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect.

[0064] The beneficial effects of the second to sixth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0065] Figure 1 This application provides a network architecture for a secure communication method.

[0066] Figure 2 This is a flowchart illustrating a secure communication method provided in an embodiment of this application.

[0067] Figure 3 This is a flowchart illustrating a method for obtaining key context information provided in an embodiment of this application.

[0068] Figure 4 This is a flowchart illustrating a method for determining a secure communication strategy provided in an embodiment of this application.

[0069] Figure 5 This is a flowchart illustrating a first secure communication strategy generation method provided in an embodiment of this application.

[0070] Figure 6 This is a flowchart illustrating a dynamic switching method provided in an embodiment of this application.

[0071] Figure 7This application provides a network architecture diagram for a QKD-SRv6 fusion control system.

[0072] Figure 8 This is a schematic diagram of a secure communication device provided in an embodiment of this application.

[0073] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0074] The secure communication methods, apparatus, devices, media, and program products provided in this application will now be described in detail with reference to the accompanying drawings.

[0075] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0076] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0077] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0078] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0079] The secure communication method, apparatus, device, medium, and program product provided in this application embodiment can be applied to high-security-level bearer network leased line communication scenarios.

[0080] In existing segment routing network and quantum key fusion schemes, an external architecture with serially connected encryption devices is commonly used. The forwarding and encryption devices are decoupled, leading to redundancy at the transmission link level and increased encryption forwarding latency. Furthermore, key scheduling, path calculation, and security policies are independent, lacking a binding relationship between quantum keys, forwarding paths, and service flows. This results in global key reuse and coarse-grained security protection. Simultaneously, existing schemes often use a controller to centrally distribute all keys and policies, concentrating the core key transmission path and creating security vulnerabilities such as key leakage and centralized attacks. The technical reasons for these problems are: the key data transmission path and policy control path are not separated; keys must be centrally stored and forwarded by the controller; forwarding nodes lack native key caching and encryption / decryption capabilities, relying on external encryption devices for secure computation; and there is a lack of a mechanism to associate and bind keys, paths, and services at the service flow level.

[0081] To address the aforementioned technical problems, this application provides a secure communication method, apparatus, device, medium, and program product. The security policy of this secure communication method is generated by a unique binding relationship between three dimensions: key, path, and service. Therefore, when a forwarding node receives the policy, only data packets that simultaneously match the service flow and the path can invoke the corresponding quantum key for encryption and decryption. This eliminates the possibility of key reuse across services and paths from the protocol layer, achieving fine-grained security isolation for single service, single path, and single key. Secondly, the key issuance instruction directly targets the quantum key layer, requiring it to directly push the key body to the forwarding node, while the policy is issued by the control layer. This "key and..." The "policy-based split transmission" architecture eliminates the need for the original quantum key to be relayed or cached at the control layer, avoiding the risk of key theft or leakage at the centralized control node in traditional schemes. Furthermore, after the forwarding node receives and caches the key and policy locally, it can independently complete real-time encryption and decryption at the message forwarding line speed without the need for an external encryption gateway. This eliminates the latency loss of intermediate devices and achieves an integrated endogenous fusion of transmission and security. Ultimately, it works synergistically from three levels: "refined security isolation", "key transmission security" and "forwarding performance improvement", enhancing the inherent security guarantee capability of the SRv6 network in high-security scenarios such as resisting quantum computing attacks, preventing traffic hijacking and data tampering.

[0082] The secure communication methods, apparatus, devices, media, and program products provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0083] Figure 1 This illustration shows a network architecture for a secure communication method application provided in an embodiment of this application. For example... Figure 1As shown, the network architecture includes: an SRv6 fusion controller 101, a quantum key layer device 102, an SRv6 forwarding node 103, and a service terminal device 104. The SRv6 fusion controller 101 establishes communication connections with both the quantum key layer device 102 and the SRv6 forwarding node 103. The service terminal device 104 accesses the SRv6 bearer network constructed by the SRv6 forwarding node 103.

[0084] In some embodiments, the SRv6 fusion controller 101 may be a standalone server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, middleware services, and big data and artificial intelligence platforms. This application embodiment does not specifically limit this. Figure 1 The example shown is an SRv6 converged controller 101 as a single server.

[0085] In some embodiments, the quantum key layer device 102 can be a key management server, quantum key pool device, or quantum key service platform in a quantum key distribution (QKD) network, used to generate, store, and manage quantum key resources and their key context information, and to provide quantum key distribution services to authorized devices. This application embodiment does not limit the specific device form of the quantum key layer device 102. The SRv6 forwarding node 103 can be a router or switch or other network forwarding device supporting the SRv6 segment routing protocol. Multiple SRv6 forwarding nodes 103 constitute an SRv6 bearer network, responsible for routing, forwarding, and processing data packets. The service terminal device 104 can be a server, personal computer, industrial control host, or communication gateway, or other device with data transmission and reception capabilities. This application embodiment does not limit the specific device form of the service terminal device 104.

[0086] In some embodiments, the SRv6 fusion controller 101 obtains the first key context information and the first target segment routing path corresponding to the target service, which is initiated by the service terminal device 104; the SRv6 fusion controller 101 determines the first secure communication strategy based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service; the SRv6 fusion controller 101 sends a first key distribution instruction to the quantum key layer device 102 to instruct the quantum key layer device 102 to distribute the first quantum key corresponding to the first key context information to the SRv6 forwarding node 103 corresponding to the first target segment routing path; the SRv6 fusion controller 101 distributes the first secure communication strategy to the SRv6 forwarding node 103 to instruct the SRv6 forwarding node 103 to use the first quantum key to encrypt the data of the target service sent by the service terminal device 104, and forward the encrypted data along the first target segment routing path.

[0087] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0088] See Figure 2 This is a flowchart illustrating a secure communication method provided in an embodiment of this application. Figure 2 As shown, the secure communication method provided in this application embodiment can be implemented by the above-mentioned fusion controller, specifically including the following steps 201 to 204.

[0089] Step 201: The fusion controller obtains the first key context information and the first target segment routing path corresponding to the target service.

[0090] Step 202: The fusion controller determines the first secure communication policy based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service.

[0091] Step 203: The fusion controller sends a first key distribution instruction to the quantum key layer. The first key distribution instruction is used to instruct the quantum key layer to distribute the first quantum key corresponding to the first key context information to the first network forwarding node corresponding to the first target segment routing path.

[0092] Step 204: The fusion controller sends the first secure communication policy to the first network forwarding node. The first secure communication policy is used to instruct the first network forwarding node to encrypt the data of the target service using the first quantum key.

[0093] First, obtain the first key context information and the first target segment routing path corresponding to the target service.

[0094] In this embodiment, the target service refers to a service that requires secure communication transmission. For example, the target service may be a government dedicated line service, a financial data transmission service, a power dispatch communication service, or other services with high security requirements, or other services that require encrypted transmission. This embodiment does not limit the scope of the target service.

[0095] The first key context information refers to the contextual description information related to the quantum key, used to characterize the attributes and state of the quantum key. The first key context information may include one or more of the following: key identifier, key security level, key lifespan, and key state identifier. The key identifier is used to uniquely identify a quantum key, and may be in the form of a numerical number or a string; the key security level characterizes the security protection level of the quantum key, and may be divided into different levels such as confidential, secret, and ordinary; the key lifespan characterizes the effective time range of the quantum key, including the key generation time and expiration time; the key state identifier characterizes the current usable state of the quantum key, including states such as valid, about to expire, and invalid. It should be noted that the specific content of the above key context information is only illustrative. In other embodiments of this application, the key context information may also include other attribute information related to the quantum key, which does not affect the implementation of the embodiments of this application.

[0096] The first target segment routing path refers to the transmission path determined for the target service based on segment routing technology. Segment routing is a source routing technology that specifies the forwarding path of a packet by carrying an ordered list of segment identifiers (SIDs) in the packet header. For example, in an SRv6 network, a segment routing path can be represented by an ordered sequence of SRv6 SIDs, with each SID corresponding to a forwarding node or forwarding action on the path. In the embodiments of this application, the first target segment routing path is one or more segment routing paths determined for the target service, used to carry the data transmission of the target service.

[0097] In this embodiment, the entity responsible for obtaining the first key context information and the first target segment routing path is a network fusion controller, such as an SRv6 fusion controller or other device with network-wide management capabilities. The fusion controller can obtain the first key context information from the quantum key layer and calculate or determine the first target segment routing path based on network topology and service requirements. The operations of obtaining the first key context information and obtaining the first target segment routing path can be performed simultaneously or sequentially; the execution order does not affect the implementation of this embodiment.

[0098] Subsequently, based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service, the first secure communication policy is determined.

[0099] In this embodiment, the first path identifier refers to the identification information used to uniquely identify the routing path of the first target segment. For example, the first path identifier can be the SID sequence identifier corresponding to a segment routing path, or it can be a unique path number assigned to the path by the fusion controller, or it can be other identification forms that can uniquely distinguish different segment routing paths. This embodiment of the application does not limit this.

[0100] A flow identifier is an identification information used to uniquely identify the flow corresponding to a target service. A flow is a collection of data flows in a network that share the same attributes, such as source address, destination address, protocol type, and port number (a five-tuple of information). A flow identifier can be, for example, a flow ID, a flow tag, or other identifier used to distinguish different flow flows. Through the flow identifier, network forwarding nodes can identify which flow a data packet belongs to and thus take appropriate processing strategies.

[0101] The first secure communication strategy refers to the policy rules used to guide network forwarding nodes in securely communicating data for target services. The first secure communication strategy is determined based on three elements: the first key context information, the first path identifier, and the service flow identifier, reflecting the association and binding relationship between the key, the path, and the service. In other words, the first secure communication strategy is not an isolated encryption strategy, but a comprehensive security strategy generated by associating the quantum key resources represented by the key context, the transmission channel represented by the segment routing path, and the service identity represented by the service flow. Through this association and binding, specific service flows are encrypted using specific quantum keys when transmitted on specific paths, thereby achieving refined security protection through the three-dimensional binding of key, path, and service.

[0102] Subsequently, a first key distribution instruction is sent to the quantum key layer. The first key distribution instruction is used to instruct the quantum key layer to distribute the first quantum key corresponding to the first key context information to the first network forwarding node corresponding to the first target segment routing path.

[0103] In this embodiment, the quantum key layer refers to the functional layer that provides quantum key services, responsible for the generation, storage, management, and distribution of quantum keys. The quantum key layer may include functional entities such as a quantum key distribution (QKD) device, a key pool management module, and a key lifecycle management module. Based on the principles of quantum mechanics, the quantum key layer can achieve information-theoretically secure key negotiation, and the generated quantum keys possess the security characteristics of being theoretically unbreakable and detectable upon eavesdropping.

[0104] The first quantum key refers to the quantum key body data corresponding to the first key context information. The first key issuance instruction is used to instruct the quantum key layer to directly issue the first quantum key to the first network forwarding node, rather than relaying it through the fusion controller. In other words, the transmission path of the quantum key and the transmission path of the secure communication strategy are independent of each other—the key data is directly issued point-to-point from the quantum key layer to the forwarding node, while the strategy data is independently issued to the forwarding node by the fusion controller. This split-path issuance mechanism ensures that the core key data does not need to be stored and forwarded through the fusion controller, thus avoiding the risks of theft, cache leakage, and centralized attack caused by centralized key relay through the controller at the transmission link level.

[0105] The first network forwarding node refers to a node device on the routing path of the first target segment that performs service data forwarding and network functions. The first network forwarding node can be, for example, an SRv6 router, a switch, or other network forwarding device. In this embodiment, the first network forwarding node has the ability to locally cache quantum keys and perform encryption / decryption operations, enabling it to complete native encryption processing of service data without relying on external encryption devices.

[0106] Finally, the first secure communication strategy is sent to the first network forwarding node, which is used to instruct the first network forwarding node to encrypt the data of the target service using the first quantum key.

[0107] In this step, the fusion controller distributes the first secure communication strategy determined in the previous steps to the first network forwarding node. The first secure communication strategy instructs the first network forwarding node to encrypt the data received from the target service using the first quantum key. Since the first secure communication strategy is determined based on the binding relationship between the key context, path identifier, and service flow identifier, the first network forwarding node, when performing encryption, can match the corresponding quantum key according to the service flow identifier and path identifier carried in the data packet, achieving precise encryption protection.

[0108] In this embodiment, the first quantum key is directly distributed from the quantum key layer to the first network forwarding node, while the first secure communication strategy is independently distributed from the fusion controller to the first network forwarding node. The two are transmitted separately and paired locally at the forwarding node. After receiving the data for the target service, the first network forwarding node, based on the locally cached first quantum key and first secure communication strategy, synchronously performs data encryption during message forwarding without the need for external encryption devices, achieving integrated parallel forwarding and encryption.

[0109] In this embodiment, by obtaining the key context information and segment routing path of the target service, a secure communication strategy is determined based on the key context information, path identifier, and service flow identifier. The quantum key layer directly distributes the quantum key to the forwarding node, and the fusion controller independently distributes the secure communication strategy. This allows key data and strategy data to be transmitted separately and paired locally at the forwarding node. The forwarding node uses the locally cached quantum key for native encryption. Compared to the existing technology that uses external encryption devices for networking and a controller to centrally relay keys, this embodiment achieves isolation between the key transmission path and the strategy control path. The quantum key does not pass through the fusion controller, eliminating the security risks of centralized key leakage and centralized attack, and improving the security of key transmission. On the other hand, by generating a secure communication strategy through the three-dimensional binding of key, path, and service, each service flow uses a dedicated quantum key for encryption on a dedicated path, achieving fine-grained security isolation and protection for a single service, a single path, and a single key. Furthermore, the forwarding node has native encryption and decryption capabilities, and can complete encryption synchronously during forwarding without external encryption devices, simplifying the transmission link layers and reducing encryption forwarding latency.

[0110] In an optional embodiment, this application further describes the specific implementation method for obtaining the first key context information. See also... Figure 3 This is a flowchart illustrating a method for obtaining key context information according to an embodiment of this application. In this embodiment, to achieve accurate matching between key resources and business security requirements, obtaining the first key context information corresponding to the target business may include the following steps 301 to 303.

[0111] Step 301: The fusion controller generates a key context retrieval instruction, which carries the security level information of the target service.

[0112] Step 302: The fusion controller sends a key context retrieval instruction to the quantum key layer. The key context retrieval instruction is used to instruct the quantum key layer to retrieve the key context information corresponding to the security level information.

[0113] Step 303: The fusion controller receives the first key context information sent by the quantum key layer.

[0114] First, a key context retrieval instruction is generated, which carries the security level information of the target service.

[0115] In this embodiment, security level information is used to characterize the security protection requirement level of the target business. Different businesses can correspond to different security levels. For example, core government data transmission businesses can correspond to a higher security level, while ordinary office data transmission businesses can correspond to a lower security level. There are various ways to classify security level information, such as using numerical levels (e.g., level 1, level 2, level 3), textual levels (e.g., confidential, secret, internal), or other custom classification methods. This embodiment does not limit this.

[0116] In this embodiment, after receiving a communication request from a target service, the fusion controller determines the security level information corresponding to the service based on information such as the type and requirements of the target service, and generates a key context retrieval instruction carrying the security level information. The security level information can be determined, for example, by looking up a mapping table between service types and security levels, or by the service requester directly including the security level parameter when reporting service requirements, or by the fusion controller automatically evaluating it according to preset rules. This embodiment does not limit the specific method used.

[0117] Then, a key context retrieval instruction is sent to the quantum key layer, which instructs the quantum key layer to retrieve the key context information corresponding to the security level information.

[0118] In this embodiment, the fusion controller sends a key context retrieval command carrying security level information to the quantum key layer. Upon receiving the command, the quantum key layer retrieves key context information matching the security level from its maintained key pool, based on the security level information carried in the command. For example, the quantum key layer can maintain key resource pools corresponding to different security levels. When it receives a retrieval command with a security level of "confidential," it selects available key context information from the confidential key resource pool. It should be noted that the specific matching rules for the quantum key layer to retrieve key context information can be implemented in various ways. For example, it can be a one-to-one matching, or it can match keys with a security level no lower than the required security level according to the "higher is better" principle. This embodiment does not limit this approach.

[0119] Finally, the first key context information sent by the quantum key layer is received.

[0120] After retrieving the key context information, the quantum key layer returns the retrieved first key context information to the fusion controller. The fusion controller receives this first key context information and uses it to determine the secure communication strategy.

[0121] In this embodiment, a precise match between key resources and business security requirements is achieved through a key context retrieval instruction carrying security level information. Services with different security levels obtain different levels of quantum key context information, enabling high-security-level services to obtain higher-level quantum key protection, while low-security-level services use keys of the corresponding level, avoiding waste of key resources. Simultaneously, this security-level-based matching mechanism provides a security dimension foundation for subsequent three-dimensional binding of keys, paths, and services—security level information, as one of the attributes of key context information, participates in the construction of the binding relationship, allowing secure communication strategies to reflect the differentiated security needs of the services.

[0122] In an optional embodiment, this application further describes the specific implementation of obtaining the routing path of the first target segment. In this embodiment, to achieve intelligent matching between the transmission path and service transmission requirements, obtaining the routing path of the first target segment corresponding to the target service may include:

[0123] The convergence controller determines the routing path for the first target segment based on the transmission requirements of the target service and the network status parameters of the forwarding layer.

[0124] In this embodiment, transmission requirement information refers to the various performance indicators required by the target service for data transmission. This may include one or more of the following: bandwidth requirements, latency requirements, jitter requirements, packet loss rate requirements, reliability requirements, and security priority. Different services may have different transmission requirements. For example, financial transaction services have high latency requirements, video surveillance services have high bandwidth requirements, and core government services have high security and reliability requirements.

[0125] Network status parameters refer to real-time operational status information of the forwarding layer network. These parameters may include one or more of the following: network topology, load status of each link, link transmission delay, link jitter parameters, link packet loss rate, link fault status, and node resource utilization. Network status parameters can be collected in real-time by the converged controller through network telemetry protocols, link status announcements, and other methods.

[0126] In this embodiment, the fusion controller combines the transmission requirement information of the target service with the network state parameters of the forwarding layer, and determines the first target segment routing path that meets the service transmission requirements through path calculation. For example, the fusion controller can use a constraint-based shortest path first algorithm, taking transmission requirements such as bandwidth and latency as constraints, and combining the current network link status to avoid congested and faulty links, calculate the optimal end-to-end forwarding path, and generate the corresponding segment identifier path sequence. It should be noted that there can be various specific algorithms used for path calculation, such as shortest path algorithms, multi-constraint optimal path algorithms, heuristic path optimization algorithms, etc., and this embodiment does not limit the specific algorithm.

[0127] In this embodiment, segment routing paths are determined by combining service transmission demand information and real-time network status parameters, ensuring that the determined paths simultaneously meet the service's transmission quality requirements and the current network availability conditions. This path determination method, based on joint demand and status calculation, provides a path-dimensional foundation for subsequent three-dimensional binding of keys, paths, and services—the path determination considers the security priority requirements of the services, enabling services with higher security requirements to obtain more reliable transmission paths, thereby forming a tighter binding relationship with key context information and service flow identifiers.

[0128] In an optional embodiment, this application further describes the specific implementation of determining the first secure communication strategy. See also... Figure 4 This is a flowchart illustrating a secure communication strategy determination method provided in an embodiment of this application. In this embodiment, to achieve a strong binding between the key, path, and service, determining the first secure communication strategy based on the first key context information, the first path identifier, and the service flow identifier may include the following steps 401 to 402.

[0129] Step 401: The fusion controller establishes a binding mapping relationship between the first key context information, the first path identifier, and the service flow identifier.

[0130] Step 402: The fusion controller generates a first secure communication policy based on the binding mapping relationship.

[0131] First, establish a binding mapping relationship between the first key context information, the first path identifier, and the business flow identifier.

[0132] In this embodiment, the binding mapping relationship refers to the association and correspondence between the first key context information, the first path identifier, and the service flow identifier. By establishing the binding mapping relationship, the quantum key resources (represented by the key context information), the transmission path (represented by the path identifier), and the service identity (represented by the service flow identifier) ​​are mapped one-to-one, forming a three-dimensional binding mapping entry of key-path-service.

[0133] For example, the binding mapping relationship can be represented as a triplet mapping entry: <service flow identifier, path identifier, key identifier>, where the key identifier is the key identifier contained in the first key context information. When a network forwarding node receives a data packet, it can find the corresponding key identifier by querying this mapping entry based on the service flow identifier and path identifier carried in the data packet, and thus obtain the corresponding quantum key. It should be noted that the specific representation of the binding mapping relationship can be in various forms, such as hash tables, lookup tables, database records, etc., and this application embodiment does not limit this.

[0134] Then, a first secure communication policy is generated based on the binding mapping relationship.

[0135] In this embodiment, the fusion controller generates a first secure communication policy based on the established binding mapping relationship. The first secure communication policy is a set of security processing rules that can be executed by network forwarding nodes, which transforms the binding mapping relationship into a set of security processing rules. In other words, the binding mapping relationship defines the correspondence between the key, path, and service, while the first secure communication policy defines the specific execution rules of how the forwarding nodes should perform their tasks.

[0136] In this embodiment, a three-dimensional strong binding of keys, paths, and services is achieved by establishing a binding mapping relationship between key context information, path identifiers, and service flow identifiers, and generating a secure communication policy based on this binding mapping relationship. This three-dimensional binding mechanism ensures that each service flow is encrypted using a specific quantum key when transmitted on a specific path, and that keys are isolated and paths are independent between different service flows, effectively avoiding the problems of global key reuse and coarse-grained security protection in existing technologies. Simultaneously, the binding mapping relationship serves as the basis for generating the secure communication policy, providing a logical basis for the subsequent specification of policy rules.

[0137] In an optional embodiment, this application further describes the specific implementation of generating a first secure communication strategy based on a binding mapping relationship. See also... Figure 5 This is a flowchart illustrating a method for generating a first secure communication policy according to an embodiment of this application. In this embodiment, to enable the secure communication policy to possess multi-dimensional security control capabilities such as forwarding matching, path protection, and encryption / decryption processing, generating the first secure communication policy based on the binding mapping relationship may include the following steps 501 to 504.

[0138] Step 501: The convergence controller generates forwarding matching rules based on the binding mapping relationship. The forwarding matching rules are used to instruct the first network forwarding node to match the corresponding key identifier based on the service flow identifier and the first path identifier.

[0139] Step 502: The convergence controller generates a path protection policy based on the binding mapping relationship. The path protection policy is used to instruct the first network forwarding node to prohibit the processing of data packets when it matches a data packet that is not a service flow identifier and a first path identifier.

[0140] Step 503: The fusion controller generates encryption and decryption processing rules based on the key identifier. The encryption and decryption processing rules are used to instruct the first network forwarding node to call the first quantum key corresponding to the key identifier.

[0141] Step 504: The fusion controller generates a first secure communication policy based on forwarding matching rules, path protection policies, and encryption / decryption processing rules.

[0142] A forwarding matching rule is generated based on the binding mapping relationship. The forwarding matching rule is used to instruct the first network forwarding node to match the corresponding key identifier based on the service flow identifier and the first path identifier.

[0143] In this embodiment, the forwarding matching rule is a component of the first secure communication strategy. It guides the first network forwarding node on how to match the corresponding key identifier based on the service flow identifier and path identifier carried in the data packet when it receives the data packet. The forwarding matching rule is essentially the execution of the binding mapping relationship on the forwarding node side—the forwarding node queries the binding mapping relationship based on the service flow identifier and path identifier in the data packet to find the corresponding key identifier, thereby determining which quantum key should be used for encryption and decryption.

[0144] For example, forwarding matching rules can be represented as a set of matching conditions and corresponding actions: when the service flow identifier of a data packet is Flow_A and the path identifier is Path_1, the matching key identifier is the quantum key of Key_001. Through forwarding matching rules, forwarding nodes can quickly and accurately identify the quantum key that should be used for each data packet, achieving a precise correspondence between the key and the service flow.

[0145] A path protection policy is generated based on the binding mapping relationship. The path protection policy is used to instruct the first network forwarding node to prohibit the processing of data packets when they are matched with a service flow identifier that is not matched with the first path identifier.

[0146] In this embodiment, the path protection policy is another component of the first secure communication policy, used to prevent service data from being transmitted on unauthorized paths or on bound paths. The path protection policy instructs forwarding nodes to only process (including forwarding and encryption / decryption) data packets whose service flow identifier and path identifier both match the bound mapping relationship, and to prohibit processing of data packets that do not match.

[0147] For example, assuming the binding mapping relationship stipulates that business flow Flow_A can only be transmitted using key Key_001 on path Path_1, then when a forwarding node receives a data packet with business flow identifier Flow_A but path identifier Path_2, it indicates that the data packet deviates from the bound authorized path. The path protection policy instructs the forwarding node to prohibit forwarding and encryption / decryption processing of this data packet. Similarly, when a forwarding node receives a data packet with path identifier Path_1 but business flow identifier Flow_B (unbound business flow), it is also prohibited from processing it. The purpose of the path protection policy is to prevent attacks such as path spoofing, traffic hijacking, and data tampering—even if an attacker obtains partial key or path information, they cannot use the bound quantum key to communicate on unauthorized paths or unauthorized business flows, thereby enhancing the overall security protection capability of the communication system.

[0148] Encryption and decryption rules are generated based on the key identifier. These rules are used to instruct the first network forwarding node to call the first quantum key corresponding to the key identifier.

[0149] In this embodiment, the encryption / decryption processing rules are another component of the first secure communication strategy, used to guide the first network forwarding node on how to use the quantum key to complete encryption / decryption operations. Based on the key identifier, the encryption / decryption processing rules instruct the forwarding node to use the first quantum key corresponding to that key identifier in its local cache to perform encryption or decryption operations on the matched service data.

[0150] For example, encryption and decryption processing rules can specify parameters such as encryption algorithm type (e.g., AES-256, SM4, etc., symmetric encryption algorithms), encryption and decryption mode (e.g., CBC mode, CTR mode, etc.), and key retrieval method. It should be noted that the above encryption algorithms and modes are merely illustrative examples. In other embodiments of this application, other applicable encryption algorithms and modes can be used, and the specific parameter configuration of the encryption and decryption processing rules can be adjusted according to the business security level and the security level in the key context information. This application does not limit this aspect.

[0151] The first secure communication strategy is generated based on forwarding matching rules, path protection strategies, and encryption / decryption processing rules.

[0152] In this embodiment, forwarding matching rules, path protection strategies, and encryption / decryption processing rules are combined to generate a complete first secure communication strategy. The first secure communication strategy is a comprehensive set of security processing rules. The forwarding matching rules address which key to use, the path protection strategy addresses whether processing is allowed, and the encryption / decryption processing rules address how to encrypt and decrypt. These three rules work together to achieve secure communication protection for the target business data.

[0153] In this embodiment, the first secure communication strategy consists of three components: forwarding matching rules, path protection strategies, and encryption / decryption processing rules. These form a complete secure processing chain from key matching and path protection to encryption / decryption execution. The forwarding matching rules ensure the precise correspondence between business data and quantum keys; the path protection strategies block data processing from unauthorized paths and unauthorized business flows; and the encryption / decryption processing rules guide forwarding nodes to perform native encryption / decryption operations. These three components are generated based on the same binding mapping relationship, are logically consistent, and cooperate with each other. This enables the secure communication strategy to possess not only refined key matching capabilities and path-level security protection capabilities, but also native encryption / decryption execution capabilities at the forwarding plane, effectively resisting various security threats such as link eavesdropping, traffic hijacking, packet tampering, and path spoofing.

[0154] In an optional embodiment, this application further describes the dynamic switching process of the secure communication method. See also... Figure 6 This is a flowchart illustrating a dynamic switching method provided in an embodiment of this application. In this embodiment, after the first secure communication strategy is sent to the first network forwarding node, when the network environment or key status changes, the secure communication method may further include steps 601 to 605.

[0155] Step 601: When the switching triggering conditions are met, the convergence controller obtains the second key context information and the second target segment routing path corresponding to the target service.

[0156] Step 602: The fusion controller determines the second secure communication strategy based on the second key context information, the second path identifier of the second target segment routing path, and the service flow identifier.

[0157] Step 603: The fusion controller sends a second key distribution instruction to the quantum key layer. The second key distribution instruction is used to instruct the quantum key layer to distribute the second quantum key corresponding to the second key context information to the second network forwarding node corresponding to the second target segment routing path.

[0158] Step 604: The fusion controller sends the second secure communication policy to the second network forwarding node.

[0159] Step 605: The fusion controller sends a switching instruction, which is used to indicate that the execution policy is switched from the first secure communication policy to the second secure communication policy, and the bearer path is switched from the first target segment routing path to the second target segment routing path.

[0160] First, if the switching triggering conditions are met, obtain the second key context information and the second target segment routing path corresponding to the target service.

[0161] In this embodiment, the switching trigger condition refers to the preset conditions that trigger key updates and path switching. The switching trigger condition may include one or more of the following: the quantum key is nearing expiration (e.g., the remaining key validity period is less than a preset threshold), link congestion occurs (e.g., link utilization exceeds a preset threshold), link failure occurs (e.g., link connectivity is interrupted), network topology changes, service transmission quality deteriorates (e.g., latency or packet loss rate exceeds preset indicators), or there is a need for path optimization. In other embodiments of this application, the switching trigger condition may also include other triggering situations, such as periodic updates triggered by a periodic rotation strategy, etc., which are not limited in this embodiment.

[0162] When the switching trigger condition is met, the fusion controller reacquires the second key context information and the second target segment routing path corresponding to the target service. The acquisition method for the second key context information can be similar to the acquisition method for the first key context information in the above embodiments, i.e., by generating a key context retrieval instruction carrying security level information to request the sub-key layer; the determination method for the second target segment routing path can be similar to the determination method for the first target segment routing path in the above embodiments, i.e., by recalculating and determining it based on the transmission requirement information of the target service and the latest network state parameters of the forwarding layer. It should be noted that the second key context information and the second target segment routing path are new resources different from the first key context information and the first target segment routing path, used to replace the original resources to continue carrying the secure communication of the target service.

[0163] Subsequently, based on the second key context information, the second path identifier of the second target segment routing path, and the service flow identifier, the second secure communication strategy is determined.

[0164] In this embodiment, the second path identifier refers to the identification information used to uniquely identify the routing path of the second target segment. Its meaning is similar to that of the first path identifier, except that it corresponds to a new segment routing path. The method for determining the second secure communication strategy is similar to the method for determining the first secure communication strategy in the above embodiments, that is, it is determined based on the second key context information, the second path identifier, and the service flow identifier. In a further specific implementation, the method for determining the second secure communication strategy can establish a binding mapping relationship between the second key context information, the second path identifier, and the service flow identifier, and generate forwarding matching rules, path protection strategies, and encryption / decryption processing rules based on this binding mapping relationship, which are then combined to form the second secure communication strategy.

[0165] Then, a second key distribution instruction is sent to the quantum key layer. The second key distribution instruction is used to instruct the quantum key layer to distribute the second quantum key corresponding to the second key context information to the second network forwarding node corresponding to the second target segment routing path.

[0166] In this embodiment, the second quantum key refers to new quantum key ontology data corresponding to the second key context information. The second network forwarding node refers to the node device that performs service data forwarding on the routing path of the second target segment. The second key issuance instruction is used to instruct the quantum key layer to directly issue the second quantum key to the second network forwarding node. The issuance method is similar to the issuance method of the first quantum key in the above embodiment, adopting a direct point-to-point issuance method by the quantum key layer without the relay of the fusion controller.

[0167] Then, the second secure communication policy is sent to the second network forwarding node.

[0168] In this embodiment, the fusion controller distributes the second secure communication strategy to the second network forwarding node. It should be noted that in this embodiment, the distribution of the second quantum key and the second secure communication strategy adopts a decentralized independent distribution mechanism. After receiving the second quantum key and the second secure communication strategy, the second network forwarding node caches them simultaneously with its existing first quantum key and first secure communication strategy, forming a state where two sets of resources coexist—the old resources (first quantum key and first secure communication strategy) continue to carry the current service transmission, while the new resources (second quantum key and second secure communication strategy) remain silent and ready for subsequent seamless switching.

[0169] Finally, a switching instruction is sent to indicate that the execution policy is switched from the first secure communication policy to the second secure communication policy, and the bearer path is switched from the first target segment routing path to the second target segment routing path.

[0170] In this embodiment, after the second quantum key and the second secure communication strategy are both cached and in place at the second network forwarding node, the fusion controller sends a switching instruction, instructing the forwarding node to switch the currently executed strategy from the first secure communication strategy to the second secure communication strategy, and to switch the service data carrying path from the first target segment routing path to the second target segment routing path.

[0171] The switching command can be sent, for example, after confirming that all relevant forwarding nodes have completed caching of the new resources, to ensure that resources are in place at each node during the switch and to avoid service interruptions caused by resource loss during the switch. Upon receiving the switching command, the forwarding node immediately completes a seamless switch of policies and resources—business traffic is smoothly migrated to the second target segment routing path, and the locally cached second quantum key is used to complete real-time encryption and decryption transmission. Because the new resources are pre-cached and in place, the switch process does not require link breakage and renegotiation, enabling a seamless switch with no packet loss and no latency jitter.

[0172] In this embodiment, by pre-acquiring new key context information and segment routing paths when the switching trigger conditions are met, pre-issuing new keys and policies to the forwarding node cache, and then completing the seamless switching through switching commands, seamless rebinding and smooth switching are achieved in scenarios such as periodic quantum key updates, link failure switching, and dynamic network topology optimization. The mechanism of caching both old and new resources in advance and pre-issuing and pre-positioning ensures that there is no need for service disconnection and renegotiation during the entire switching process, achieving the effect of zero service interruption, zero data packet loss, and zero transmission awareness. After the switching is completed, the system can automatically invalidate the old key and old path binding relationship, reclaim invalid key resources, and update the key status and policy mapping table of the entire network, ensuring the continuous, secure, and stable operation of services in complex network scenarios.

[0173] In one optional embodiment, this application provides a QKD-SRv6-based fusion control system. See also Figure 7 This is a network architecture diagram of a QKD-SRv6 fusion control system provided in an embodiment of this application. Figure 7 As shown, the system is logically divided into three layers: the upper layer is the QKD-SRv6 fusion control system, and the lower layer is the SRv6 forwarding layer.

[0174] In the upper layer, the QKD-SRv6 fusion control system is further divided into two sub-layers: the quantum key layer and the SRv6 fusion control layer. The quantum key layer includes functional units such as the quantum layer and quantum key service module, responsible for the generation, storage, and management of quantum keys. The SRv6 fusion control layer includes functional units such as key and path binding, SRv6 path calculation, and state monitoring, responsible for network-wide policy orchestration and path scheduling. A bidirectional information exchange channel exists between the quantum key layer and the SRv6 fusion control layer for transmitting key context information and control commands.

[0175] In the SRv6 forwarding layer, multiple SRv6 routing clusters are deployed, and these clusters are interconnected via a backbone network to form an end-to-end SRv6 bearer network. User-side terminals (such as user A and user B) access this SRv6 bearer network through an integrated gateway, and then establish communication connections with enterprise-side nodes (such as enterprise B). Figure 7 The dashed line in the middle represents the transmission path of an encrypted business flow between user B and enterprise B.

[0176] In this embodiment of the application, the secure communication execution process of the above architecture includes:

[0177] Service Initiation Phase: When User B initiates a high-security-level service request to Enterprise B, the service request enters the SRv6 bearer network via the integrated gateway and is reported to the SRv6 converged control layer. This request carries parameters such as the service's bandwidth requirements, latency requirements, security level, and a unique service flow identifier.

[0178] Key Acquisition Phase: The path calculation module of the SRv6 fusion control layer parses the security level requirements in the service request, generates the corresponding key context retrieval instruction, and sends it to the quantum key layer. The quantum key service module of the quantum key layer retrieves the matching first key context information (including key ID, security level, lifespan, validity status, etc.) from its maintained key pool according to the security level, and returns the first key context information to the SRv6 fusion control layer.

[0179] Path calculation phase: Simultaneously or sequentially, the SRv6 path calculation function unit of the SRv6 converged control layer collects network status parameters such as the current network topology, link load, and transmission latency. Combined with the transmission requirements of the service (such as low latency and high reliability requirements), it calculates the optimal first target segment routing path from end to end through the path optimization algorithm and generates a unique SRv6SID forwarding sequence.

[0180] In the three-dimensional binding phase, the key and path binding function unit of the SRv6 converged control layer establishes a one-to-one mapping relationship between the acquired first key context information, the calculated first path identifier of the first target segment routing path, and the service flow identifier of the target service, forming a <service flow identifier, path identifier, key identifier> triplet binding mapping entry. Based on this binding mapping relationship, the converged controller generates a first secure communication policy that includes forwarding matching rules, path protection strategies, and encryption / decryption processing rules.

[0181] In the split-path distribution phase: the quantum key layer, according to the matching instructions issued by the controller, directly distributes the bound original first quantum key point-to-point to all SRv6 forwarding nodes along the routing path of the first target segment (i.e., Figure 7 Each SRv6 forwarding node along the path passes through an SRv6 routing cluster and locally securely caches the first quantum key. Simultaneously, the SRv6 fusion control layer independently distributes the first secure communication policy (including key index, binding mapping rules, path routing information, and encryption / decryption verification policies) to each SRv6 forwarding node. At this point, each SRv6 forwarding node has completed the pairing and storage of the key body and control policy locally.

[0182] Encryption and forwarding phase: After user B's service data traffic enters the first-hop node of the SRv6 forwarding layer, this node quickly retrieves the corresponding first secure communication policy and first quantum key locally based on the service flow identifier and SRv6 segment identifier carried in the data packet. Within the synchronous timing of SRv6 packet encapsulation and forwarding, real-time encryption processing is performed on the service payload, and the encrypted packet is forwarded hop-by-hop along the first target segment routing path to the destination side. Finally, it is decrypted by the integrated gateway on the enterprise B side and delivered to enterprise B. The entire process does not require the participation of an external encryption gateway, realizing integrated parallel processing of forwarding and encryption.

[0183] Continuous monitoring phase: The status monitoring function unit of the SRv6 converged control layer monitors the key lifecycle, link operation status, and service transmission status in real time. Within the key validity period, provided there are no changes to the network topology and no link anomalies, the system continues to use the aforementioned fixed three-dimensional binding relationship for encrypted transmission.

[0184] In this embodiment, the three-layer collaborative architecture—the quantum key layer dedicated to key resource management, the SRv6 fusion control layer dedicated to policy orchestration and path calculation, and the SRv6 forwarding layer dedicated to line-speed encrypted forwarding—achieves decoupled transmission of keys and policies and native encryption on the forwarding plane, effectively ensuring the secure and stable transmission of high-security-level services in the SRv6 network.

[0185] The secure communication method provided in this application will be described in detail below with reference to specific embodiments.

[0186] In this embodiment, taking government fixed leased line services as an example, the specific application of the above-mentioned secure communication method in a conventional and stable service scenario is described. This embodiment targets high-security fixed leased line service scenarios with stable network topologies and long-term online operation, such as those in government, power, and finance sectors.

[0187] In this embodiment, taking the provision of encrypted dedicated line services from a government data center to its subordinate government office terminals as an example, the complete execution process is as follows:

[0188] Encrypted communication requests for government and enterprise fixed leased line services are initiated by government office terminals and reported to the SRv6 converged control layer via the integrated gateway. The request carries the following parameters: service bandwidth requirement of 100Mbps, latency requirement of no more than 10ms, security level of confidential, and a unique service flow identifier Flow_Gov_001 assigned to the leased line.

[0189] After receiving the aforementioned service request, the SRv6 fusion control layer parses the transmission and security requirements and requests a complete key context resource matching the "confidential" security level from the quantum key layer. The quantum key service module of the quantum key layer retrieves available first key context information from the confidential key pool—including key ID Key_Gov_001, security level confidential, lifespan of 72 hours, and current status valid—and returns this first key context information to the SRv6 fusion control layer. Simultaneously, the fusion controller sends a key distribution preparation command to the quantum key layer, instructing it to prepare the corresponding original quantum key for subsequent distribution to nodes along the path.

[0190] The path calculation function unit of the SRv6 converged control layer collects network status parameters in real time, including the entire network topology, the load utilization of each link, hop-by-hop transmission latency, and link health status. Considering the high reliability and low latency transmission requirements of this government dedicated line service, it calculates and generates the optimal end-to-end SRv6 forwarding path from the government office terminal to the government data center using a constraint-based shortest path first algorithm. This path serves as the first target segment routing path, generating a dedicated SRv6 SID forwarding sequence (e.g., SID_A::1 → SID_B::3 → SID_C::2 → SID_D::5), and constructs a dedicated transmission tunnel for this government dedicated line service.

[0191] The key and path binding function unit of the SRv6 fusion control layer performs a three-dimensional binding operation—mapping and binding the acquired first key context information (Key_Gov_001), the first path identifier (Path_Gov_001) of the calculated first target segment routing path, and the unique service flow identifier (Flow_Gov_001) one by one to form a triple.<Flow_Gov_001, Path_Gov_001, Key_Gov_001> Binding mapping relationship. Based on this binding mapping relationship, the controller further generates a set of security policies specific to this government dedicated line service, including: forwarding matching rules (instructing forwarding nodes to match Key_Gov_001 according to Flow_Gov_001 and Path_Gov_001), encryption and decryption processing rules (instructing the use of the quantum key corresponding to Key_Gov_001 to perform SM4 / AES encryption operations), and path security protection policies (instructing that non-matching data packets are prohibited from being processed on this path).

[0192] According to the matching instructions of the fusion controller, the quantum key layer directly distributes the bound original quantum key to all SRv6 forwarding nodes along the routing path of the first target segment. Each SRv6 forwarding node stores the quantum key in its local security key cache.

[0193] The SRv6 fusion control layer synchronizes the key index (Key_Gov_001) and binding mapping rules (<Flow_Gov_001,Path_Gov_001, Key_Gov_001> The triplet, SRv6 path routing information (SID sequence), and encryption / decryption verification strategy are uniformly distributed to each relevant SRv6 forwarding node. After receiving the data, each forwarding node completes the pairing and storage of the key body (from the quantum key layer) and the control strategy (from the fusion control layer).

[0194] After the traffic from the government dedicated line enters the first-hop SRv6 forwarding node, this node quickly queries and matches the corresponding binding policy and dedicated quantum key Key_Gov_001 based on the traffic flow identifier Flow_Gov_001 and SRv6 segment identifier (such as SID_A::1) carried in the data packet. Within the synchronous timing of SRv6 packet encapsulation and forwarding, the quantum key is used to perform real-time encryption processing on the traffic payload. The encrypted packet is forwarded hop-by-hop along the determined SRv6 SID path, with each forwarding node performing the same "identifier matching - key retrieval - real-time encryption and decryption" operation. Finally, it reaches the destination and is decrypted by the integrated gateway before being delivered to the government data center. The entire process requires no external encryption gateway or additional security equipment, achieving integrated parallel processing of forwarding and encryption, effectively reducing transmission latency.

[0195] The system has entered a steady-state operation phase. The status monitoring function unit of the SRv6 converged control layer continuously monitors the lifecycle status of the key Key_Gov_001, the operational status of the links, and the transmission status of government dedicated line services. As long as the key is within its 72-hour validity period, the network topology remains unchanged, and there is no abnormal congestion or failure on any link, the system continues to use the fixed key.<Flow_Gov_001, Path_Gov_001, Key_Gov_001> Encrypted transmission is achieved through a three-dimensional binding relationship. Each dedicated government line has its own exclusive quantum key and transmission tunnel, realizing refined security isolation from other services. This effectively resists attacks such as link eavesdropping, traffic hijacking, and data tampering, ensuring the long-term stable and secure operation of government and enterprise dedicated line services.

[0196] In this embodiment, the above process is also applicable to other high-security fixed leased line service scenarios with stable topology and long-term online characteristics, such as power dispatch communication and core data transmission for financial institutions. The differences between different services lie only in the service parameters (bandwidth / latency / security level) and specific routing results; the core technical processes remain consistent.

[0197] In another embodiment of this application, the following dynamic demand scenarios are addressed: backbone network routing adjustments, periodic quantum key updates, link congestion or failover, and other situations requiring key updates and path rebinding.

[0198] Continuing with the government dedicated line service described in the above embodiments (flow identifier Flow_Gov_001, original path identifier Path_Gov_001, original key identifier Key_Gov_001), it is assumed that this service has entered the steady-state encrypted transmission stage according to the process described in the above embodiments. During operation, the system status monitoring function unit detects that the quantum key Key_Gov_001 is nearing expiration (e.g., the remaining validity time is less than a preset threshold of 2 hours), triggering a dynamic switching process, the specific execution process of which is as follows.

[0199] Dynamic Triggering and Resource Reacquisition: Once the SRv6 fusion control layer's state monitoring unit detects that the switching trigger condition is met (in this example, the quantum key is nearing expiration), it immediately initiates the dynamic rebinding process. The fusion controller re-collects the transmission and security requirements information for this government dedicated line service and re-applies to the quantum key layer for a new, valid key context resource. The quantum key service module of the quantum key layer allocates new second key context information from the confidential key pool—including the new key ID Key_Gov_002, the same confidential security level, a new lifespan of 72 hours, and a valid current status—and returns this second key context information to the controller.

[0200] Resource re-awareness and backup path calculation: Simultaneously or sequentially, the path calculation function unit of the SRv6 converged control layer re-awares the latest network topology (which may differ from the initial state due to link additions, deletions, or node changes), the current load and latency status of each link. In conjunction with the high reliability and low latency requirements of government dedicated line services, it avoids abnormal links with potential risks, recalculates and generates the optimal end-to-end SRv6 forwarding path adapted to the current network environment as the second target segment routing path, and updates the corresponding SRv6 SID path sequence (e.g., the new SID sequence is SID_A::1 → SID_E::4 → SID_F::2 → SID_D::5), completing the planning of the new transmission tunnel.

[0201] Dynamic secondary three-dimensional binding: The key and path binding function unit of the SRv6 fusion control layer performs a second three-dimensional strong binding operation—establishing a new triple—based on the newly acquired second key context information (Key_Gov_002), the second path identifier of the newly calculated second target segment routing path (Path_Gov_002), and the unique identifier of the original service flow (Flow_Gov_001, which remains unchanged).<Flow_Gov_001, Path_Gov_002, Key_Gov_002> Binding mapping relationship. Based on this new binding mapping relationship, a completely new set of security policies is generated, including: new forwarding matching rules, new encryption and decryption processing rules, and new path protection policies.

[0202] The pre-deployment mechanism involves the quantum key layer directly distributing the new original quantum key (corresponding to Key_Gov_002) to all relevant SRv6 forwarding nodes (including all nodes along the new path Path_Gov_002). Each forwarding node caches the new quantum key in its local key storage area. Simultaneously, the SRv6 fusion control layer distributes the new key index (Key_Gov_002), new path information (Path_Gov_002 and its SID sequence), and new binding rules (…).<Flow_Gov_001, Path_Gov_002, Key_Gov_002> The triplet and the new encryption / decryption strategy are pre-distributed to each forwarding node. At this point, each forwarding node simultaneously caches two complete sets of resources: the old set of resources (first quantum key Key_Gov_001 + first secure communication strategy) continues to carry the currently running business traffic; the new set of resources (second quantum key Key_Gov_002 + second secure communication strategy) remains silent and awaits subsequent switching instructions.

[0203] Seamless handover and seamless encrypted transmission: After confirming that all relevant SRv6 forwarding nodes have successfully received and cached the new group of resources, the SRv6 convergence control layer sends a handover command to each forwarding node. Upon receiving the handover command, each forwarding node immediately and seamlessly switches its current strategy from the first secure communication strategy to the second secure communication strategy, and simultaneously smoothly migrates the service traffic's carrying path from the first target segment routing path to the second target segment routing path. The switched service traffic uses the locally cached new quantum key Key_Gov_002 to complete real-time encryption and decryption transmission. Since the new group of resources has been pre-cached in each forwarding node, the entire handover process does not require link breakage and renegotiation, achieving a seamless handover with no packet loss and no latency jitter, completely imperceptible to both ends of the service transmission.

[0204] Resource Iteration and Continuous Operation: After the switchover is complete, the system automatically invalidates the old key Key_Gov_001 and the old path binding relationship.<Flow_Gov_001, Path_Gov_001, Key_Gov_001> Invalid key resources are reclaimed to free up storage space, and the key status table and policy mapping table across the entire network are updated simultaneously. Subsequently, the status monitoring unit continues to monitor the lifecycle of the new key Key_Gov_002 and the link status of the new path Path_Gov_002 in real time using the same mechanism, cyclically executing the above dynamic monitoring and iterative update process to ensure the continuous, secure, and stable operation of government dedicated line services in complex scenarios with dynamically changing network environments.

[0205] It should be noted that in other embodiments of this application, the switching triggering condition is not limited to the case of "quantum key nearing expiration". For example, when the status monitoring function unit detects that the utilization rate of a link in the current path exceeds a preset congestion threshold (such as 90%), a dynamic switching for the purpose of "path optimization" can be triggered; when a link on the path is detected to be interrupted due to a fault, a fast switchover for the purpose of "fault recovery" can be triggered; when the network topology changes due to equipment expansion or adjustment, a corresponding rebinding process can also be triggered.

[0206] Furthermore, in this embodiment, the coexistence time of the old and new resources in the forwarding node can be flexibly configured according to the actual network environment and service requirements. For example, for services with extremely high security requirements, the coexistence window period of the old and new resources can be appropriately extended to ensure absolute reliability of the handover; for latency-sensitive services, the coexistence window period can be shortened to accelerate resource reclamation. This configurable coexistence mechanism does not affect the implementation of the core solution of this application.

[0207] It should be noted that for a detailed explanation of the steps performed by each module and their beneficial effects, please refer to the description in the above embodiments, which will not be repeated here.

[0208] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0209] This application embodiment can divide the secure communication device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0210] In some embodiments, this application also provides a secure communication device. This secure communication device may include one or more functional modules for implementing the secure communication method described in the above embodiments.

[0211] For example, Figure 8 This is a schematic diagram of a secure communication device provided in an embodiment of this application. Figure 8 As shown, the secure communication device 800 includes an acquisition module 801, a determination module 802, and a transmission module 803.

[0212] The acquisition module 801 is used to acquire the first key context information and the first target segment routing path corresponding to the target service.

[0213] The determination module 802 is used to determine the first secure communication strategy based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service.

[0214] The sending module 803 is used to send a first key distribution instruction to the quantum key layer. The first key distribution instruction is used to instruct the quantum key layer to distribute the first quantum key corresponding to the first key context information to the first network forwarding node corresponding to the first target segment routing path.

[0215] The sending module 803 is also used to send the first secure communication strategy to the first network forwarding node. The first secure communication strategy is used to instruct the first network forwarding node to encrypt the data of the target service using the first quantum key.

[0216] In some embodiments, the acquisition module 801 is specifically used for:

[0217] Generate a key context retrieval instruction, which carries the security level information of the target service;

[0218] A key context retrieval instruction is sent to the quantum key layer. The key context retrieval instruction is used to instruct the quantum key layer to retrieve the key context information corresponding to the security level information.

[0219] Receive the first key context information sent by the quantum key layer.

[0220] Another possible implementation is to obtain module 801, which is specifically used for:

[0221] Based on the transmission requirements of the target service and the network status parameters of the forwarding layer, the routing path of the first target segment is determined.

[0222] In other embodiments, a first secure communication policy is determined based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service, including:

[0223] Establish a binding mapping relationship between the first key context information, the first path identifier, and the service flow identifier;

[0224] The first secure communication policy is generated based on the binding mapping relationship.

[0225] In some other embodiments, the determining module 802 is specifically used for:

[0226] A forwarding matching rule is generated based on the binding mapping relationship. The forwarding matching rule is used to instruct the first network forwarding node to match the corresponding key identifier based on the service flow identifier and the first path identifier.

[0227] A path protection policy is generated based on the binding mapping relationship. The path protection policy is used to instruct the first network forwarding node to prohibit the processing of data packets when a data packet is matched with a service flow identifier other than the first path identifier.

[0228] An encryption and decryption rules are generated based on the key identifier. The encryption and decryption rules are used to instruct the first network forwarding node to call the first quantum key corresponding to the key identifier.

[0229] The first secure communication strategy is generated based on forwarding matching rules, path protection strategies, and encryption / decryption processing rules.

[0230] In some other embodiments, after the first secure communication policy is sent to the first network forwarding node, the acquisition module 801 is further configured to:

[0231] If the switching triggering conditions are met, obtain the second key context information and the second target segment routing path corresponding to the target service;

[0232] Module 802 is also used for:

[0233] The second secure communication strategy is determined based on the second key context information, the second path identifier of the second target segment routing path, and the service flow identifier.

[0234] The sending module 803 is also used for:

[0235] A second key distribution instruction is sent to the quantum key layer. The second key distribution instruction is used to instruct the quantum key layer to distribute the second quantum key corresponding to the second key context information to the second network forwarding node corresponding to the second target segment routing path.

[0236] The second secure communication strategy is distributed to the second network forwarding node;

[0237] Send a switching instruction, which is used to indicate that the execution policy is switched from the first secure communication policy to the second secure communication policy, and the bearer path is switched from the first target segment routing path to the second target segment routing path.

[0238] It should be noted that the secure communication device can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0239] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 9 As shown, the electronic device 900 includes: a processor 902, a communication interface 903, and a bus 904. Optionally, the electronic device 900 may also include a memory 901.

[0240] Processor 902 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0241] The communication interface 903 is used to connect to other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0242] The memory 901 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0243] As one possible implementation, the memory 901 can exist independently of the processor 902. The memory 901 can be connected to the processor 902 via a bus 904 and is used to store instructions or program code. When the processor 902 calls and executes the instructions or program code stored in the memory 901, it can implement the secure communication method provided in the embodiments of this application.

[0244] In another possible implementation, the memory 901 can also be integrated with the processor 902.

[0245] The 904 bus can be an Extended Industry Standard Architecture (EISA) bus, etc. The 904 bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0246] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the secure communication device can be divided into different functional modules to complete all or part of the functions described above.

[0247] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described secure communication method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0248] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0249] This application also provides a readable storage medium storing a program or instructions that, when executed by a computer, implement the secure communication method provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware; the readable storage medium can be any of the foregoing embodiments or memory; the readable storage medium can also be an external storage device of the secure communication device, such as a plug-in hard drive, Smart MediaCard (SMC), Secure Digital (SD) card, flash card, etc., equipped on the secure communication device. Further, the readable storage medium can include both internal storage units and external storage devices of the secure communication device. The readable storage medium is used to store the computer program and other programs and data required by the secure communication device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0250] This application also provides a computer program product, which is stored in a storage medium and implements the secure communication method provided in the above embodiments when executed by a computer.

[0251] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0252] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0253] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A secure communication method, characterized in that, include: Obtain the first key context information and the first target segment routing path corresponding to the target service; Based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service, a first secure communication strategy is determined. A first key distribution instruction is sent to the quantum key layer, which instructs the quantum key layer to distribute the first quantum key corresponding to the first key context information to the first network forwarding node corresponding to the first target segment routing path. The first secure communication policy is sent to the first network forwarding node, and the first secure communication policy is used to instruct the first network forwarding node to encrypt the data of the target service using the first quantum key.

2. The secure communication method according to claim 1, characterized in that, The step of obtaining the first key context information corresponding to the target service includes: Generate a key context retrieval instruction, wherein the key context retrieval instruction carries the security level information of the target service; Send the key context retrieval instruction to the quantum key layer, the key context retrieval instruction being used to instruct the quantum key layer to retrieve the key context information corresponding to the security level information; Receive the first key context information sent by the quantum key layer.

3. The secure communication method according to claim 1, characterized in that, The step of obtaining the first target segment routing path corresponding to the target service includes: Based on the transmission requirement information of the target service and the network status parameters of the forwarding layer, the routing path of the first target segment is determined.

4. The secure communication method according to claim 1, characterized in that, The step of determining the first secure communication policy based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service includes: Establish a binding mapping relationship between the first key context information, the first path identifier, and the service flow identifier; The first secure communication policy is generated based on the binding mapping relationship.

5. The secure communication method according to claim 4, characterized in that, The step of generating the first secure communication policy based on the binding mapping relationship includes: A forwarding matching rule is generated based on the binding mapping relationship. The forwarding matching rule is used to instruct the first network forwarding node to match the corresponding key identifier based on the service flow identifier and the first path identifier. A path protection policy is generated based on the binding mapping relationship. The path protection policy is used to instruct the first network forwarding node to prohibit processing the data packet when it matches a data packet that is not the same as the service flow identifier and the first path identifier. An encryption / decryption processing rule is generated based on the key identifier, and the encryption / decryption processing rule is used to instruct the first network forwarding node to call the first quantum key corresponding to the key identifier; The first secure communication policy is generated based on the forwarding matching rules, the path protection strategy, and the encryption / decryption processing rules.

6. The secure communication method according to claim 1, characterized in that, After the first secure communication policy is sent to the first network forwarding node, the secure communication method further includes: If the switching triggering conditions are met, obtain the second key context information and the second target segment routing path corresponding to the target service; Based on the second key context information, the second path identifier of the second target segment routing path, and the service flow identifier, a second secure communication strategy is determined. Send a second key distribution instruction to the quantum key layer. The second key distribution instruction is used to instruct the quantum key layer to distribute the second quantum key corresponding to the second key context information to the second network forwarding node corresponding to the second target segment routing path. The second secure communication policy is sent to the second network forwarding node; Send a switching instruction, which is used to indicate that the execution policy is switched from the first secure communication policy to the second secure communication policy, and the bearer path is switched from the first target segment routing path to the second target segment routing path.

7. A secure communication device, characterized in that, include: The acquisition module is used to acquire the first key context information and the first target segment routing path corresponding to the target service; The determining module is used to determine a first secure communication strategy based on the first key context information, the first path identifier of the first target segment routing path, and the service flow identifier of the target service; The sending module is used to send a first key distribution instruction to the quantum key layer. The first key distribution instruction is used to instruct the quantum key layer to distribute the first quantum key corresponding to the first key context information to the first network forwarding node corresponding to the first target segment routing path. The sending module is further configured to send the first secure communication policy to the first network forwarding node, wherein the first secure communication policy is configured to instruct the first network forwarding node to encrypt the data of the target service using the first quantum key.

8. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the secure communication method as described in any one of claims 1-6.

9. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a computer, implement the secure communication method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when the computer program product is executed by a computer, it implements the secure communication method as described in any one of claims 1-6.

Images