Information protection method, communication method, network device, communication system, and storage medium

Abstract

The present application discloses an SRv6 technology-based information protection method, a communication method, a network device, a communication system, and a computer-readable storage medium. The information protection method comprises: acquiring a quantum key; and encrypting segment identification information in a segment routing header on the basis of the quantum key to obtain quantum segment identification information, so as to protect the segment identification information. In this way, a network device encrypts segment identification information in a segment routing header by means of a quantum key to obtain quantum segment identification information, and the quantum key has extremely strong confidentiality, so that attackers cannot steal data without being detected. Thus, the obtained quantum segment identification information has good confidentiality, and information required for segment routing can be securely and efficiently stored and transmitted.

Description

Information protection methods, communication methods, network devices, communication systems, and storage media

[0001] This application claims priority to Chinese Patent Application No. 202411191576.0, filed on August 28, 2024, entitled "Information Protection Method, Communication Method, Network Device, Communication System and Storage Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of network security, and more specifically, to an information protection method, communication method, network device, communication system, and computer-readable storage medium based on SRv6 technology. Background Technology

[0003] The segment routing header used in the Internet Protocol version of IPv6 can precisely control the forwarding path of data. However, because the segment routing header does not adequately protect the segment list in the segment route, attackers can manipulate the forwarding path of data packets by tampering with the segment identifier information in the segment list, so that the packets reach the network devices controlled or monitored by the attackers according to the attackers' wishes, thereby achieving the purpose of packet hijacking. Summary of the Invention

[0004] This application provides an information protection method, communication method, network device, communication system, and computer-readable storage medium based on SRv6 technology.

[0005] In a first aspect, embodiments of this application provide an information protection method based on SRv6 technology, the information protection method being used in a network device, the method comprising:

[0006] Obtaining quantum keys;

[0007] The segment identification information in the segment routing message header is encrypted using the quantum key to obtain quantum segment identification information, which is then used to protect the segment identification information.

[0008] Thus, by encrypting the segment identifier information in the segment routing header using quantum keys, quantum segment identifier information is obtained. Quantum keys possess extremely strong confidentiality, preventing attackers from stealing data undetected. Consequently, the resulting quantum segment identifier information offers excellent confidentiality, enabling secure and efficient storage and transmission of the information required for segment routing.

[0009] In some embodiments, the network device is communicatively connected to both the controller and the quantum key management system, and the acquisition of the quantum key includes:

[0010] The controller initiates a quantum key request to the quantum key management system.

[0011] Receive the first key information distributed by the quantum key management system according to the quantum key application;

[0012] The first key information is decrypted to obtain the quantum key and the quantum key identifier corresponding to the quantum key.

[0013] Thus, the controller initiates a quantum key request to the quantum key management system. Then, it receives the first key information distributed by the quantum key management system based on the request. Finally, the first key information is decrypted to obtain the quantum key and its corresponding quantum key identifier. The quantum key possesses extremely high confidentiality; attackers cannot steal data without detection. The quantum key identifier facilitates the management and use of the quantum key. The resulting quantum key and quantum key identifier can then be used in subsequent communication processes to enhance the confidentiality of the communication process.

[0014] In some implementations, initiating a quantum key request to the quantum key management system via the controller includes:

[0015] At preset intervals, the controller initiates a quantum key request to the quantum key management system.

[0016] In this way, network devices are configured with a preset period, and then every preset period, they initiate a quantum key request to the quantum key management system through the controller. By periodically initiating quantum key requests, regular key updates can be ensured. Even if a quantum key is illegally obtained at some point, regular updates will render the illegally obtained key invalid in the near future, reducing the risk of key leakage.

[0017] In some implementations, the quantum key application includes a security device identifier of the network device, the first key information is obtained by the quantum key management system by encrypting the second key information according to the quantum master key, the second key information is randomly generated by the quantum key management system, and the quantum master key is pre-filled in the network device and determined according to the security device identifier.

[0018] Thus, the quantum key request sent by the network device includes the network device's security device identifier. This identifier is used to determine the quantum master key to be used when the quantum key management system encrypts the second key information using the quantum master key. The first key information received by the network device is obtained by the quantum key management system encrypting the second key information using the quantum master key. This ensures that the second key message is sent to the network device under the protection of the quantum master key. Specifically, the second key information is randomly generated by the quantum key management system, and the quantum master key is pre-loaded into the network device and determined based on the security device identifier. The network device pre-loads the quantum master key for its own use.

[0019] In some embodiments, the quantum key application further includes a quantum key quantity, and the second key information further includes an initial quantum key quantity corresponding to the quantum key quantity; and / or

[0020] The quantum key application also includes a quantum key length, and the second key information also includes an initial quantum key corresponding to the quantum key length.

[0021] Thus, the quantum key application also includes the number of quantum keys, and the second key information includes an initial number of quantum keys corresponding to the number of quantum keys. The number of quantum keys is determined according to the actual needs of the network equipment, ensuring the rational allocation and use of quantum resources; and / or

[0022] The quantum key application also includes the quantum key length, and the second key information also includes an initial quantum key corresponding to the quantum key length. The quantum key length is determined according to the actual needs of the network device to ensure that it is consistent with the key length required by the network device.

[0023] In some embodiments, the information protection method further includes:

[0024] A registration request is initiated to the controller, the registration request including the security device identifier of the network device, in order to perform security authentication with the quantum key management system through the controller.

[0025] Thus, the network device sends a registration request to the controller, which includes the network device's security device identifier, to perform security authentication with the quantum key management system via the controller. This method, using the network device's security device identifier and leveraging the controller as an intermediary for security authentication with the quantum key management system, ensures that the network device that successfully completes the authentication process can obtain the quantum key.

[0026] In some embodiments, the information protection method further includes:

[0027] The quantum key identifier and the quantum segment identifier information are stored in a preset field in the segment routing message header.

[0028] In this way, network devices store quantum key identifiers and quantum segment identifiers in preset fields within the segment routing message header. The quantum key identifier can be used to verify the integrity of data packets, while the quantum segment identifier indicates the specific network segment the data packet needs to traverse. By storing quantum key identifiers and quantum segment identifiers in the segment routing message header, network devices can securely and precisely control the forwarding path of data packets.

[0029] In some implementations, the step of encrypting the segment identification information in the segment routing packet header using the quantum key to obtain quantum segment identification information, in order to protect the segment identification information, includes:

[0030] The segment identification information is encrypted using the quantum key and a preset encryption algorithm to obtain quantum segment identification information, thereby protecting the segment identification information.

[0031] In this way, network devices encrypt the segment identification information using a quantum key and a preset encryption algorithm to obtain quantum segment identification information, thereby protecting the segment identification information. By using a quantum key and encryption algorithm to encrypt the segment identification information, even if the data is intercepted, the encrypted segment identification information cannot be easily decrypted and understood, ensuring the security of the segment identification information during transmission.

[0032] Secondly, embodiments of this application provide a communication method for the network device, the communication method comprising:

[0033] Receive data information sent by the preceding network device in the communication link where the network device is located, the data information including the segment routing header obtained by the information protection method based on SRv6 technology described above;

[0034] The data information is parsed to obtain the quantum key identifier;

[0035] The data information is securely verified based on the quantum key identifier;

[0036] If the security verification is successful, the data information is sent to the next network device in the communication link where the network device is located.

[0037] Thus, within the communication link where a network device resides, the network device parses the data sent by the preceding network device using a quantum key identifier to obtain the quantum key identifier. The network device then uses the obtained quantum key identifier to perform security verification on the data. Only after successful security verification is the network device forwarding the data to the next network device in the communication link. This ensures the security of the communication link while improving the efficiency of data forwarding.

[0038] In some implementations, the step of securely verifying the data information based on the quantum key identifier includes:

[0039] The network device is queried according to the quantum key identifier to find the quantum key corresponding to the quantum key identifier;

[0040] If a quantum key corresponding to the quantum key identifier is found in the network device, the security of the data information is confirmed through the quantum key.

[0041] Thus, the network device queries the network device for the quantum key corresponding to the quantum key identifier. If the network device finds the quantum key corresponding to the quantum key identifier, it verifies the security of the data information using the quantum key. After finding the quantum key corresponding to the quantum key identifier, the network device verifies the security of the data information by checking whether the header of the routing segment verified by the found quantum key has been tampered with.

[0042] In some embodiments, the step of securely verifying the data information based on the quantum key identifier includes:

[0043] If no quantum key corresponding to the quantum key identifier is found in the network device, the quantum key corresponding to the quantum key identifier is retrieved from the quantum key management system based on the quantum key identifier.

[0044] If a quantum key corresponding to the quantum key identifier is found in the quantum key management system, the security of the data information is confirmed through the quantum key.

[0045] If no quantum key corresponding to the quantum key identifier is found in the quantum key management system, the data information is confirmed to be insecure.

[0046] Therefore, if the network device cannot find the quantum key corresponding to the quantum key identifier, it searches for the corresponding quantum key in the quantum key management system. If the quantum key is found in the quantum key management system, the network device confirms the data security. If the quantum key is not found, the data security is confirmed to be abnormal. Thus, by searching for the quantum key in the quantum key management system and checking whether the header of the quantum key verification segment routing message has been tampered with, the security of the data is confirmed. If the quantum key is not found in the quantum key management system, the data security is confirmed to be abnormal.

[0047] Thirdly, embodiments of this application provide a network device, which includes a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the above-mentioned information protection method and communication method are implemented.

[0048] Fourthly, embodiments of this application provide a communication system, the communication system including the network device, controller and quantum key management system as described above, the network device being communicatively connected to the controller and quantum key management system respectively.

[0049] Fifthly, embodiments of this application provide a computing processing device, comprising: a memory storing computer-readable code; and one or more processors, wherein when the computer-readable code is executed by the one or more processors, the computing processing device performs the methods described in the first and second aspects above.

[0050] In a sixth aspect, embodiments of this application provide a computer program including computer-readable code, which, when executed on a computing processing device, causes the computing processing device to perform the methods described in the first and second aspects above.

[0051] In a seventh aspect, embodiments of this application provide a computer-readable storage medium, wherein the computer-readable storage medium stores the computer program described in the sixth aspect above.

[0052] Additional aspects and advantages of embodiments of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of embodiments of this application. Attached Figure Description

[0053] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, wherein:

[0054] Figure 1 is a schematic flowchart of an information protection method proposed in an embodiment of this application;

[0055] Figure 2 is a schematic diagram of the architecture of an example of an information protection method proposed in an embodiment of this application;

[0056] Figure 3 is a schematic diagram of data transmission based on SRv6 according to an embodiment of this application;

[0057] Figure 4 is a second schematic flowchart of an information protection method proposed in an embodiment of this application;

[0058] Figure 5 is a flowchart of an information protection method proposed in an embodiment of this application (third one).

[0059] Figure 6 is a fourth flowchart illustrating an information protection method proposed in an embodiment of this application;

[0060] Figure 7 is a fifth flowchart illustrating an information protection method proposed in an embodiment of this application;

[0061] Figure 8 is a schematic diagram of HMAC TLV field information proposed in an embodiment of this application;

[0062] Figure 9 is a schematic diagram of an SRH structure proposed in an embodiment of this application;

[0063] Figure 10 is a schematic flowchart of an information protection method proposed in an embodiment of this application (the sixth one).

[0064] Figure 11 is a flowchart illustrating one of the communication methods proposed in this application.

[0065] Figure 12 is a schematic diagram of the architecture of an example of a communication method proposed in an embodiment of this application;

[0066] Figure 13 is a second schematic flowchart of a communication method proposed in an embodiment of this application;

[0067] Figure 14 is a third schematic flowchart of a communication method proposed in an embodiment of this application;

[0068] Figure 15 is a schematic diagram of the structure of a computing processing device according to an embodiment of this application;

[0069] Figure 16 is a schematic diagram of the structure of a computer program proposed in an embodiment of this application. Detailed Implementation

[0070] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0071] With the rapid development of the internet, internet protocols are constantly being updated and iterated. The most widely used version of the internet protocol now is IPv6, which not only solves the problem of limited IPv4 address space but also provides a more secure, efficient, and flexible communication protocol for the future development of the internet. With the widespread deployment of IPv6, it will play a crucial role in promoting the advancement of internet technology and the expansion of its applications.

[0072] One proposed approach to IPv6 is Segment Routing over IPv6 (SRv6), a network routing technology that combines Segment Routing (SR) with the IPv6 protocol. This involves encapsulating a segment list (SID list) within the SR header (SRH) of IPv6 packets to control packet forwarding paths. This provides a flexible and efficient routing solution. Segment Routing (SR) is a source routing protocol, also known as a segment routing protocol. The source node specifies the forwarding path and converts it into an ordered list of segments (SIDs) encapsulated in the packet header. SRv6 converts the path into an ordered list of segments (SIDs) encapsulated in the packet header by inserting an ordered segment list into the packet header. This guides the processing and forwarding of received packets, enabling traffic scheduling and orchestration, and achieving fine-grained SLA service guarantees.

[0073] While SRv6 network routing technology offers flexible and efficient routing solutions, data packets sent using SRv6 may be intercepted by attackers within the network. Attackers can tamper with the SID list in the SR header of IPv6 packets, causing data packets to be sent to network devices designated by the attacker. This can lead to the hijacking of the data carried by the packets or the attack on the targeted network devices, resulting in poor security for data packets transmitted through the network communication link and undermining the foundation of trust in the network.

[0074] Based on the above problems, please refer to Figure 1. This application provides an information protection method based on SRv6 technology. The information protection method is used in network devices and includes the following steps:

[0075] 011: Obtaining the quantum key;

[0076] 012: The segment identification information in the segment routing message header is encrypted using quantum key to obtain quantum segment identification information, which is then used to protect the segment identification information.

[0077] This application also provides a network device, including a memory and a processor. The information protection method of this application can be implemented by the network device of this application. Specifically, the memory stores a computer program, and the processor is used to acquire a quantum key and encrypt the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information, so as to protect the segment identification information.

[0078] This application also provides an information protection device. The information protection method of this application can be implemented by the information protection device of this application. Specifically, the information protection device includes an acquisition module and an encryption module. The acquisition module is used to acquire a quantum key. The encryption module is used to encrypt the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information, so as to protect the segment identification information.

[0079] This application provides a communication system, which includes the network device described in the above embodiments, as well as a controller and a quantum key management system, wherein the network device is communicatively connected to the controller and the quantum key management system respectively.

[0080] Specifically, a network device is a device that provides information protection, offering data encapsulation and segment routing message header encryption / decryption functions to ensure the confidentiality and integrity of segment routing message header information. The controller provides registration management for network devices and acts as a proxy for quantum key application. The controller also has configuration and distribution control functions for quantum keys, encryption algorithms, and authentication algorithms. The quantum key management system applies for and distributes quantum keys to network devices through the controller, and also connects directly to network devices to recharge quantum master keys. The quantum key management system can provide national cryptographic algorithm capabilities based on quantum keys, provide a unified cryptographic access standard for the controller or network devices, and realize multi-level cryptographic security application capabilities.

[0081] In some embodiments, referring to Figure 2, the network device in the above communication system is a quantum-safe SRv6 device. The quantum-safe SRv6 device and the quantum key management system communicate through a controller, such as for key application and key distribution. When the quantum-safe SRv6 device sends a quantum key application, the controller receives the application, performs a series of processes, and then sends the processed application to the quantum key management service. When the application is approved, the controller obtains the quantum key distributed by the quantum key management system and then distributes it to the quantum-safe SRv6 device. Furthermore, the security medium in the quantum-safe SRv6 device is directly connected to the quantum key management service and pre-charges the quantum key from it. The security medium is a certificate issued by a relevant organization that conforms to relevant standards and possesses security protection capabilities. In this embodiment, the security medium is a security chip such as a secure SIM card or a secure TF card.

[0082] Specifically, in this embodiment, the segment routing message header is used to store and transmit path information, including multiple segment identification information. The segment identification information is used to guide the forwarding path of data. The network device obtains a quantum key, and then encrypts the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information, thereby protecting the segment identification information.

[0083] The following example illustrates the information protection method of this application. In the embodiments described in this application, the quantum-safe SRv6 device is a network device. SRv6 refers to Segment Routing in an IPv6 network, using IPv6 addresses as SIDs. SRv6 nodes forward packets according to segments. SRv6 encapsulates the SID list in the SR header (Segment Routing Header, SRH) of the IPv6 packet to control the packet forwarding path. The SR header is the segment routing header, hereinafter referred to as SRH. The segment list (SID list) is segment identification information, hereinafter referred to as the SID list. The SRH includes the SID list.

[0084] Please refer to Figure 3, which illustrates a data transmission diagram based on SRv6. This diagram is for reference only; different implementations may use different data transmission methods, determined according to actual needs, and are not limited here. The diagram shows four network devices: network device A, network device B, network device C, and network device D. Network device A serves as the starting point for the IPv6 packet, and network device D is the ending point. The IPv6 packet carries an SRH (Search Engine Response Header), which contains a list of SIDs. SIDs guide the forwarding path of the IPv6 packet, and SL (Search Engine Response Header) indicates the number of remaining network devices the IPv6 packet needs to traverse.

[0085] Please refer to Figure 2 again. The quantum-safe SRv6 device obtains the quantum key, and then encrypts the SID list in the SRH according to the quantum key to obtain the quantum SID list, so as to protect the SID list.

[0086] In summary, in the information protection method, communication method, network device, and communication system of this application, the network device encrypts the segment identification information in the segment routing header using a quantum key to obtain quantum segment identification information. The quantum key has extremely strong confidentiality, preventing attackers from stealing data undetected. Thus, the obtained quantum segment identification information has good confidentiality and can securely and efficiently store and transmit the information required for segment routing.

[0087] Referring to Figure 4, in some embodiments, the network device is communicatively connected to both the controller and the quantum key management system. Step 011 (obtaining the quantum key) includes the following steps:

[0088] 0111: Initiate a quantum key request through the controller to the quantum key management system;

[0089] 0112: Receive the first key information distributed by the quantum key management system based on the quantum key application;

[0090] 0113: Decrypt the first key information to obtain the quantum key and the corresponding quantum key identifier.

[0091] In some implementations, the application module is used to initiate a quantum key application to the quantum key management system via the controller. The receiving module is used to receive the first key information distributed by the quantum key management system according to the quantum key application. The decryption module is used to decrypt the first key information to obtain the quantum key and the corresponding quantum key identifier.

[0092] In some implementations, the processor is further configured to initiate a quantum key application to the quantum key management system via the controller, receive first key information distributed by the quantum key management system according to the quantum key application, and decrypt the first key information to obtain a quantum key and a quantum key identifier corresponding to the quantum key.

[0093] Specifically, the quantum key request includes a security device identifier for the network device, which comprises a security medium identifier integrated into the network device and a network device identifier. The first key information is obtained by encrypting the second key information using the quantum key management system based on the quantum master key. The second key information is randomly generated by the quantum key management system. The quantum master key is pre-loaded into the network device and determined based on the security device identifier. The network device initiates a quantum key request to the quantum key management system through its controller. Then, the network device receives the first key information distributed by the quantum key management system based on the quantum key request.

[0094] The second key information includes an initial number of quantum keys corresponding to the number of quantum keys and an initial quantum key corresponding to the quantum key length. Finally, the network device decrypts the first key information to obtain the quantum key and its corresponding quantum key identifier. The quantum key has extremely high confidentiality; attackers cannot steal data without detection. The quantum key identifier helps in the management and use of the quantum key. The resulting quantum key and quantum key identifier can then be used in subsequent communication processes to enhance the confidentiality of the communication process.

[0095] Continuing with the example above, please refer to Figure 2 again. The secure medium is used to store the quantum key, typically a secure SIM card or a secure TF card, but other devices or apparatuses capable of storing quantum keys can also be used, depending on actual needs; no limitation is made here. The quantum-safe SRv6 device initiates a quantum key request to the quantum key management system through the controller. The quantum key request includes the secure medium ID integrated into the quantum-safe SRv6 device, the number of quantum keys required by the quantum-safe SRv6 device, and the required quantum key length (an integer multiple of 16 bytes). Then, the quantum-safe SRv6 device receives the first key information distributed by the quantum key management system based on the quantum key request. The first key information is obtained by the quantum key management system encrypting the second key information based on the quantum master key. The second key information is randomly generated by the quantum key management system. The quantum master key is pre-filled in the network device and determined according to the secure device identifier.

[0096] The second key information includes an initial number of quantum keys corresponding to the number of quantum keys required by the quantum-safe SRv6 device, and an initial quantum key of a length corresponding to the required quantum key length. The quantum key management system pre-fills the quantum master key using the filling software to the security medium ID integrated into the quantum-safe SRv6 device. The quantum master key is used to encrypt the second key message to obtain the first key message, thereby protecting the security of the second key message during transmission.

[0097] Finally, the quantum-safe SRv6 device decrypts the first key information to obtain a number of quantum keys and corresponding quantum key identifiers that correspond to the number of quantum keys required by the SRv6 device.

[0098] In this way, the quantum-safe SRv6 device obtains a corresponding number of quantum keys and their corresponding quantum key identifiers, matching the number of quantum keys required by the SRv6 device. The quantum keys possess extremely high confidentiality, preventing attackers from stealing data undetected. The quantum key identifiers facilitate the management and use of the quantum keys. These quantum keys and identifiers can then be used in subsequent communication processes to enhance the confidentiality of the communication process.

[0099] Please refer to Figure 5. In some embodiments, step 0111 (initiating a quantum key request via the controller to the quantum key management system) includes the following steps:

[0100] 01111: At preset intervals, the controller initiates a quantum key application to the quantum key management system.

[0101] In some implementations, the initiation module is used to initiate a quantum key application to the quantum key management system through the controller at preset intervals.

[0102] In some implementations, the processor is also used to initiate a quantum key request to the quantum key management system via the controller at preset intervals.

[0103] Specifically, network devices are configured with a preset period, and then every preset period, the controller sends a quantum key request to the quantum key management system. This periodic quantum key request ensures regular key updates. Even if a quantum key is illegally obtained at some point, regular updates will render the illegally obtained key invalid in the near future, reducing the risk of key leakage.

[0104] Continuing with the example above, please refer to Figure 2 again. The quantum-safe SRv6 device sets a preset period, and then every preset period, it initiates a quantum key application to the quantum key management system through the controller. The preset period can be any time interval such as 24 hours, 12 hours, or 8 hours, which is determined according to the actual communication needs and is not limited here.

[0105] In this way, quantum-safe SRv6 devices can ensure regular key updates by periodically initiating quantum key requests. Even if a quantum key is illegally obtained at some point, regular updates can invalidate the illegally obtained key, reducing the risk of key leakage to some extent.

[0106] Please refer to Figure 6. In some embodiments, the information protection method further includes the following steps:

[0107] 013: Initiate a registration request to the controller. The registration request includes the security device identifier of the network device for security authentication by the controller to the quantum key management system.

[0108] In some implementations, the initiating module is used to send a registration request to the controller, the registration request including the security device identifier of the network device for security authentication via the controller to the quantum key management system.

[0109] In some implementations, the processor is also configured to initiate a registration request to the controller, the registration request including the security device identifier of the network device for security authentication via the controller to the quantum key management system.

[0110] Specifically, the security device identifier includes the network device identifier and the security medium identifier integrated into the network device. The network device initiates a registration request to the controller, which includes the network device's security device identifier, to perform security authentication through the controller to the quantum key management system. In this way, by using the network device's security device identifier and leveraging the controller as an intermediary for security authentication with the quantum key management system, it ensures that the network device that passes the security authentication can obtain the quantum key.

[0111] Continuing with the example above, please refer to Figure 2 again. The quantum-safe SRv6 device initiates a registration request to the controller. The registration request includes the quantum-safe SRv6 device SN and the security medium ID integrated with the quantum-safe SRv6 device, so as to perform security authentication through the controller to the quantum key management system. After receiving the registration request, the controller stores the relationship between the quantum-safe SRv6 device SN and the security medium ID integrated with the quantum-safe SRv6 device, and performs security authentication through the quantum key management system using the received information of the quantum-safe SRv6 device SN and the security medium ID integrated with the quantum-safe SRv6 device.

[0112] In this way, by using the SN of the quantum-safe SRv6 device and the security medium ID integrated in the quantum-safe SRv6 device, the controller is used as a relay station to perform security authentication with the quantum key management system, ensuring that network devices that pass the security authentication can obtain quantum keys.

[0113] Please refer to Figure 7. In some embodiments, the information protection method further includes the following steps:

[0114] 014: Store the quantum key identifier and quantum segment identifier information in a preset field in the segment routing message header.

[0115] In some implementations, the storage module is used to store quantum key identifier and quantum segment identifier information in a preset field in the segment routing header.

[0116] In some implementations, the processor is also used to store quantum key identifier and quantum segment identifier information in preset fields in the segment routing header.

[0117] Specifically, network devices store quantum key identifiers and quantum segment identifiers in preset fields within the segment routing message header. The quantum key identifier can be used to verify the integrity of data packets, while the quantum segment identifier indicates the specific network segment the data packet needs to traverse. By storing quantum key identifiers and quantum segment identifiers in the segment routing message header, network devices can securely and precisely control the forwarding path of data packets.

[0118] Continuing with the example above, the HMAC TLV field is a default field. Please refer to Figure 2 again. The quantum-safe SRv6 device stores the quantum key identifier and quantum SID list in the HMAC TLV field of the SRH.

[0119] Please refer to Figure 8. The general structure of the HMAC TLV field is shown in the figure. This diagram is for reference only, and different implementations may use different structures, which should be determined according to actual needs. No limitation is made here. Wherein, Type indicates the type of the HMAC TLV field. Length indicates the length of the HMAC TLV field, i.e., Type, Length, RESERVED, HMAC Key ID, and the total length of the HMAC message. RESERVED indicates an extended field of the HMAC TLV field. HMAC Key ID indicates the quantum key identifier. HMAC indicates the quantum SID list obtained by encrypting the SID list using a hash algorithm and a quantum key.

[0120] Please refer to Figure 9. The standard location of the HMAC TLV field in the SRH is shown in the figure. This diagram is for reference only, and different implementations may have different locations, which should be determined according to actual needs. No limitation is made here. Among them, Segment List is the Segment list, that is, the SID list; Payload represents the IPv6 payload, that is, the actual IPv6 data.

[0121] Thus, since quantum key identifiers can be used to verify the integrity of data packets, while quantum segment identifiers indicate the specific network segment the data packet needs to traverse, quantum-safe SRv6 devices can securely and precisely control the forwarding path of data packets by storing quantum key identifiers and a list of quantum SIDs in the segment routing header.

[0122] Please refer to Figure 10. In some embodiments, step 012 (encrypting the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information, so as to protect the segment identification information) includes the following steps:

[0123] 0121: The segment identification information is encrypted using the quantum key and a preset encryption algorithm to obtain quantum segment identification information, thereby protecting the segment identification information.

[0124] In some implementations, the encryption module is used to encrypt the segment identification information according to the quantum key and a preset encryption algorithm to obtain quantum segment identification information, so as to protect the segment identification information.

[0125] In some implementations, the processor is also used to encrypt the segment identification information according to the quantum key and a preset encryption algorithm to obtain quantum segment identification information, so as to protect the segment identification information.

[0126] Specifically, network devices encrypt segment identification information using a quantum key and a preset encryption algorithm to obtain quantum segment identification information, thereby protecting the segment identification information. By using a quantum key and encryption algorithm to encrypt the segment identification information, even if the data is intercepted, the encrypted segment identification information cannot be easily decrypted and understood, ensuring the security of the segment identification information during transmission.

[0127] Continuing with the example above, the preset encryption algorithm is a hash (HMAC) algorithm. In other implementations, encryption functions such as AES, DES, and secure hash algorithms can also be used, depending on the actual needs; no limitation is made here. Please refer again to Figure 2. The quantum-safe SRv6 device encrypts the SID list using the quantum key and the preset encryption algorithm to obtain a quantum SID list, which is then protected. Please refer again to Figure 8, where the encryption process for the SID list and the quantum key is shown.

[0128] In this way, the quantum-safe SRv6 device encrypts the segment identification information using quantum keys and encryption algorithms. Even if the data is intercepted, the segment identification information cannot be easily obtained, thus ensuring the security of the segment identification information during transmission.

[0129] Please refer to Figure 11. This application provides a communication method for use in a network device. The communication method includes the following steps:

[0130] 021: Receive data information sent by the preceding network device in the communication link where the network device is located. The data information includes the segment routing header obtained by processing based on any of the above information protection methods.

[0131] 022: Parse the data to obtain the quantum key identifier;

[0132] 023: Securely verify data information based on quantum key identifiers;

[0133] 024: If the security verification is successful, the data information is sent to the next network device in the communication link where the network device is located.

[0134] In some implementations, the receiving module is further configured to receive data information sent by the preceding network device in the communication link where the network device resides. The data information includes a segment routing header processed based on any of the aforementioned information protection methods. The parsing module is configured to parse the data information to obtain a quantum key identifier. The verification module is further configured to perform security verification on the data information based on the quantum key identifier. The sending module is configured to send the data information to the next network device in the communication link where the network device resides, provided that the security verification is successful.

[0135] In some implementations, the processor is further configured to receive data information sent by the preceding network device in the communication link where the network device is located. The data information includes a segment routing header processed based on any of the above information protection methods, and parsing the data information to obtain a quantum key identifier, and performing security verification on the data information based on the quantum key identifier, and sending the data information to the next network device in the communication link where the network device is located if the security verification is successful.

[0136] Specifically, a communication link is a physical or logical connection between network devices used for data transmission. A network device receives data from the preceding network device in its communication link. This data includes a segment routing header processed using any of the aforementioned information protection methods. The network device parses the data to obtain a quantum key identifier. Then, the network device performs security verification on the data based on the quantum key identifier. If the security verification is successful, the network device sends the data to the next network device in its communication link.

[0137] Continuing with the example above, referring to Figure 12, all quantum-safe SRv6 devices in the communication link where quantum-safe SRv6 device B is located are identical to quantum-safe SRv6 device B, and are connected to the quantum key management system and controller, respectively. Quantum-safe SRv6 device B receives data information sent by quantum-safe SRv6 device A in the communication link where it is located. This data information includes the SRH obtained by processing based on the information protection method described above. Quantum-safe SRv6 device B parses the data information to obtain the quantum key identifier. Then, quantum-safe SRv6 device B performs security verification on the data information based on the quantum key identifier. If the security verification passes, quantum-safe SRv6 device B sends the data information to quantum-safe SRv6 device C in the communication link where it is located.

[0138] Thus, within the communication link where a network device resides, the network device parses the data sent by the preceding network device using a quantum key identifier to obtain the quantum key identifier. The network device then uses the obtained quantum key identifier to perform security verification on the data. Only after successful security verification is the network device forwarding the data to the next network device in the communication link. This ensures the security of the communication link while improving the efficiency of data forwarding.

[0139] Please refer to Figure 13. In some embodiments, step 023 (security verification of data information based on quantum key identifier) ​​includes the following steps:

[0140] 0231: Query the network device for the quantum key corresponding to the quantum key identifier;

[0141] 0232: When a quantum key corresponding to the quantum key identifier is found in a network device, the security of the data information is confirmed through the quantum key.

[0142] In some implementations, the query module is further configured to query the network device for the quantum key corresponding to the quantum key identifier. The confirmation module is further configured to, if the quantum key corresponding to the quantum key identifier is found in the network device, confirm the security of the data information using the quantum key.

[0143] In some implementations, the processor is also configured to query the network device for the quantum key corresponding to the quantum key identifier based on the quantum key identifier, and, if the quantum key corresponding to the quantum key identifier is found in the network device, to verify the security of the data information through the quantum key.

[0144] Specifically, the network device queries the network device for the quantum key corresponding to the quantum key identifier. If the network device finds the quantum key corresponding to the quantum key identifier, it verifies the security of the data information using the quantum key. Thus, after finding the quantum key corresponding to the quantum key identifier, the network device verifies the security of the data information by checking whether the header of the routing segment has been tampered with.

[0145] Continuing the example above, the quantum-safe SRv6 device queries the security medium integrated within the device for the quantum key corresponding to the quantum key identifier. If the quantum key corresponding to the quantum key identifier is found in the security medium, the quantum-safe SRv6 device verifies the security of the data information using the quantum key.

[0146] Thus, after querying the quantum key corresponding to the quantum key identifier in the quantum-safe SRv6 device, the security of the data information is confirmed by verifying whether the SRH has been tampered with based on the queried quantum key.

[0147] Please refer to Figure 14. In some embodiments, step 023 (security verification of data information based on quantum key identifier) ​​includes the following steps:

[0148] 0233: If no quantum key corresponding to the quantum key identifier is found in the network device, the quantum key corresponding to the quantum key identifier is retrieved from the quantum key management system based on the quantum key identifier;

[0149] 0234: If a quantum key corresponding to the quantum key identifier is found in the quantum key management system, the security of the data information is confirmed through the quantum key.

[0150] 0235: If no quantum key corresponding to the quantum key identifier is found in the quantum key management system, the data information security is confirmed to be abnormal.

[0151] In some implementations, the query module is further configured to query the quantum key management system for the corresponding quantum key if no quantum key corresponding to the quantum key identifier is found in the network device. The confirmation module is configured to verify data security using the quantum key if a quantum key corresponding to the quantum key identifier is found in the quantum key management system. The confirmation module is also configured to confirm data security anomalies if no quantum key corresponding to the quantum key identifier is found in the quantum key management system.

[0152] In some implementations, the processor is further configured to: if the quantum key corresponding to the quantum key identifier is not found in the network device, query the quantum key management system for the quantum key corresponding to the quantum key identifier; if the quantum key corresponding to the quantum key identifier is found in the quantum key management system, confirm the security of the data information using the quantum key; and if the quantum key corresponding to the quantum key identifier is not found in the quantum key management system, confirm that the data information security is abnormal.

[0153] Specifically, if the network device cannot find the quantum key corresponding to the quantum key identifier, it queries the quantum key management system for the corresponding quantum key. If the quantum key is found in the quantum key management system, the network device verifies the security of the data using the quantum key. If the quantum key is not found in the quantum key management system, the data security is confirmed to be abnormal. Thus, by querying the quantum key management system and checking whether the header of the quantum key verification segment routing message has been tampered with, the security of the data is confirmed. If the quantum key is not found in the quantum key management system, the data security is confirmed to be abnormal.

[0154] Continuing the above example, if the quantum key corresponding to the quantum key identifier is not found in the security medium of the quantum-safe SRv6 device, the SRv6 device queries the quantum key management system for the corresponding quantum key. If the quantum key is found in the quantum key management system, the SRv6 device verifies the security of the data using the quantum key. If the quantum key is not found, the SRv6 device confirms that the data is not secure. Thus, the SRv6 device verifies the security of the data by finding the quantum key corresponding to the quantum key identifier in the quantum key management system and checking whether the SRH has been tampered with. If the quantum key is not found in the quantum key management system, the SRv6 device confirms that the data has been tampered with or viewed.

[0155] Thus, after the quantum-safe SRv6 device finds the quantum key corresponding to the quantum key identifier in the quantum key management service, it verifies the security of the data information by checking whether the header of the quantum key verification segment routing message has been tampered with. If no quantum key is found, the SRH has been tampered with or viewed. The quantum-safe SRv6 device ensures the security and confidentiality of the SRH by using quantum keys.

[0156] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the computing processing device according to the embodiments of this application. This application can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0157] For example, Figure 15 illustrates a computing processing device that can implement the methods according to this application. This computing processing device conventionally includes a processor 1010 and a computer program product or computer-readable medium in the form of a memory 1020. The memory 1020 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. The memory 1020 has a storage space 1030 for program code 1031 for performing any of the method steps described above. For example, the storage space 1030 for the program code can include various program codes 1031 respectively for implementing the various steps in the methods described above. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact discs (CDs), memory cards, or floppy disks. Such computer program products are typically portable or fixed storage units as described with reference to Figure 16. This storage unit can have storage segments, storage spaces, etc., arranged similarly to the memory 1020 in the computing processing device of Figure 15. The program code can be compressed, for example, in a suitable form. Typically, the storage unit includes computer-readable code 1031', which is code that can be read by a processor such as 1010, which, when run by a computing processing device, causes the computing processing device to perform the various steps in the method described above.

[0158] It is understood that a computer program includes computer program code. Computer program code can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, external hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0159] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0160] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this application pertain.

[0161] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. An information protection method based on SRv6 technology, wherein, The information protection method is used in a network device, and the method includes: Obtaining quantum keys; The segment identification information in the segment routing message header is encrypted using the quantum key to obtain quantum segment identification information, which is then used to protect the segment identification information.

2. The information protection method based on SRv6 technology according to claim 1, wherein, The network device is communicatively connected to both the controller and the quantum key management system. The acquisition of the quantum key includes: The controller initiates a quantum key request to the quantum key management system. Receive the first key information distributed by the quantum key management system according to the quantum key application; The first key information is decrypted to obtain the quantum key and the quantum key identifier corresponding to the quantum key.

3. The information protection method based on SRv6 technology according to claim 2, wherein, The step of initiating a quantum key request to the quantum key management system through the controller includes: At preset intervals, the controller initiates a quantum key request to the quantum key management system.

4. The information protection method based on SRv6 technology according to claim 2, wherein, The quantum key application includes the security device identifier of the network device. The first key information is obtained by the quantum key management system by encrypting the second key information according to the quantum master key. The second key information is randomly generated by the quantum key management system. The quantum master key is pre-filled in the network device and determined according to the security device identifier.

5. The information protection method based on SRv6 technology according to claim 4, wherein, The quantum key application also includes a quantum key quantity, and the second key information also includes an initial quantum key quantity corresponding to the quantum key quantity; and / or The quantum key application also includes a quantum key length, and the second key information also includes an initial quantum key corresponding to the quantum key length.

6. The information protection method based on SRv6 technology according to claim 2, wherein, The information protection method further includes: A registration request is initiated to the controller, the registration request including the security device identifier of the network device, in order to perform security authentication with the quantum key management system through the controller.

7. The information protection method based on SRv6 technology according to claim 2, wherein, The information protection method further includes: The quantum key identifier and the quantum segment identifier information are stored in a preset field in the segment routing message header.

8. The information protection method based on SRv6 technology according to claim 1, wherein, The step of encrypting the segment identification information in the segment routing message header according to the quantum key to obtain quantum segment identification information, and protecting the segment identification information, includes: The segment identification information is encrypted using the quantum key and a preset encryption algorithm to obtain quantum segment identification information, thereby protecting the segment identification information.

9. A communication method, wherein, The communication method is used in the network device, and the communication method includes: Receive data information sent by the preceding network device in the communication link where the network device is located, the data information including a segment routing header processed based on the information protection method based on SRv6 technology as described in any one of claims 1-8; The data information is parsed to obtain the quantum key identifier; The data information is securely verified based on the quantum key identifier; If the security verification is successful, the data information is sent to the next network device in the communication link where the network device is located.

10. The communication method according to claim 9, wherein, The step of performing security verification on the data information based on the quantum key identifier includes: The network device is queried according to the quantum key identifier to find the quantum key corresponding to the quantum key identifier; If a quantum key corresponding to the quantum key identifier is found in the network device, the security of the data information is confirmed through the quantum key.

11. The communication method according to claim 10, wherein, The step of performing security verification on the data information based on the quantum key identifier includes: If no quantum key corresponding to the quantum key identifier is found in the network device, the quantum key corresponding to the quantum key identifier is retrieved from the quantum key management system based on the quantum key identifier. If a quantum key corresponding to the quantum key identifier is found in the quantum key management system, the security of the data information is confirmed through the quantum key. If no quantum key corresponding to the quantum key identifier is found in the quantum key management system, the data information is confirmed to be insecure.

12. A network device, wherein, The network device includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the method as described in any one of claims 1-8 or 9-11.

13. A communication system, wherein, The communication system includes the network device, controller, and quantum key management system as described in claim 12, wherein the network device is communicatively connected to the controller and the quantum key management system, respectively.

14. A computing processing device, wherein, include: Memory containing computer-readable code; One or more processors, when the computer-readable code is executed by the one or more processors, the computing processing device performs the method as described in any one of claims 1-8 or 9-11.

15. A computer program comprising computer-readable code that, when executed on a computing processing device, causes the computing processing device to perform the method according to any one of claims 1-8 or 1-8 or 9-11.

16. A computer-readable storage medium, wherein, The computer-readable storage medium stores the computer program as described in claim 15.

Images