CN118041522A - TSN clock synchronization process dynamic protection system and method based on QKD technology - Google Patents
TSN clock synchronization process dynamic protection system and method based on QKD technology Download PDFInfo
- Publication number
- CN118041522A CN118041522A CN202410136176.3A CN202410136176A CN118041522A CN 118041522 A CN118041522 A CN 118041522A CN 202410136176 A CN202410136176 A CN 202410136176A CN 118041522 A CN118041522 A CN 118041522A
- Authority
- CN
- China
- Prior art keywords
- synchronous
- tsn
- module
- node
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 33
- 238000004540 process dynamic Methods 0.000 title claims abstract description 16
- 238000005516 engineering process Methods 0.000 title claims abstract description 15
- 230000001360 synchronised effect Effects 0.000 claims abstract description 198
- 230000005540 biological transmission Effects 0.000 claims abstract description 54
- 230000008569 process Effects 0.000 claims abstract description 23
- 238000012545 processing Methods 0.000 claims abstract description 23
- 238000012795 verification Methods 0.000 claims abstract description 10
- 238000012544 monitoring process Methods 0.000 claims description 52
- 230000003993 interaction Effects 0.000 claims description 14
- 238000010586 diagram Methods 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000004806 packaging method and process Methods 0.000 description 1
- 238000004353 relayed correlation spectroscopy Methods 0.000 description 1
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention provides a TSN clock synchronization process dynamic protection system and method based on QKD technology, comprising: CNC starts the synchronous configuration process, formulates a synchronous spanning tree, generates configuration information and sends the configuration information to each TSN node in the synchronous spanning tree, and sends synchronous data transmission requirements of each TSN node to QKDN controllers; the QKDN controller calculates the optimal key transmission path between Q-UNs connected with each TSN node, and configures QKDN node route; the TSN node needing time synchronization firstly requests a key from the connected Q-UN before sending synchronous data; the connected Q-UN generates a key according to the optimal key transmission path calculated before and sends the key to a TSN node and a target node which need time synchronization; the TSN nodes needing time synchronization encrypt synchronous data by using the secret key and send the synchronous data to the target node; the target node uses the secret key to verify the data integrity and reports the data integrity to the CNC; and the CNC performs corresponding processing according to the integrity verification result. The method and the device can effectively prevent malicious tampering attack on TSN synchronous data.
Description
Technical Field
The invention relates to the technical field of time-sensitive network clock synchronization data security, in particular to a TSN clock synchronization process dynamic protection system and method based on QKD technology.
Background
Time-sensitive network (Time-SENSITIVE NETWORKING, TSN) technology generally refers to a series of technical standards established by the TSN working group of IEEE, the former of which is the audio video bridging (Audio and Video Bridge, AVB) working group, which was originally focused on standardized work for real-Time audio video transmission over ethernet architecture. With the interest of industry, IEEE has named AVB working group more TSN working group in 2012, and further increased standard protocols in terms of traffic scheduling, network configuration, resource management, etc., to promote low latency, high reliability, and transmission certainty of time-sensitive networks.
The flow scheduling mechanism of the TSN is completed based on time slots, and clock synchronization is the basis of the TSN technology, so that it is important to ensure the safety of the clock synchronization process. The TSN uses IEEE 802.1AS protocol to realize clock synchronization of master and slave nodes in the network, but the protocol does not provide precautionary measures for potential information security attacks in the network, and an attacker can intercept synchronous data and tamper key clock information therein, so that clock synchronization is disordered.
Disclosure of Invention
The invention provides a TSN clock synchronization process dynamic protection system and method based on QKD technology, which are used for solving the problems existing in the prior art, and the technical scheme provided by the invention is as follows:
In one aspect, a TSN clock synchronization process dynamic protection system based on QKD technology is provided, the system comprising: centralized network controller CNC, time sensitive network TSN node, quantum key distribution network QKDN controller, QKDN user node Q-UN connected with TSN node;
The CNC is used for starting a synchronous configuration process, formulating a synchronous spanning tree, generating configuration information and sending the configuration information to each TSN node in the synchronous spanning tree;
The CNC is further configured to send synchronous data transmission requirements of each TSN node to the QKDN controller;
The QKDN controller is configured to calculate an optimal key transmission path between Q-UN connected to each TSN node according to the synchronous data transmission requirement, and configure QKDN node routing;
the TSN node which needs to perform time synchronization is used for starting a synchronization process after completing configuration, and requesting a key from a connected Q-UN before sending synchronization data;
the connected Q-UN is used for generating a key according to the optimal key transmission path calculated before and sending the key to the TSN node and the target node which need to be time synchronized;
The TSN node needing time synchronization is further used for encrypting the synchronous data by using the key and sending the encrypted synchronous data to the target node;
The target node is used for verifying the integrity of the data by using the secret key after receiving the encrypted synchronous data, and reporting the integrity verification result to the CNC;
The CNC is further used for performing corresponding processing according to the integrity verification result.
Optionally, the CNC specifically includes: the system comprises a synchronous path decision module, an SDN controller, a network topology information storage unit and a QKDN interaction module;
the CNC starts a synchronous configuration process after receiving a synchronous request for configuring a CUC (compute unified device) by a centralized user, the synchronous path decision module discovers physical network topology through the SDN controller and checks whether a network node supports 802.1AS standards or not, stores the information into the network topology information storage unit, simultaneously formulates a synchronous spanning tree according to the information, then issues a master clock configuration and port attributes of all nodes to all TSN nodes in the synchronous spanning tree through the SDN controller, and then all the TSN nodes in the synchronous spanning tree spontaneously start the synchronous process;
The synchronous path decision module also generates synchronous data transmission demand data which can be understood by the QKDN controller according to the synchronous spanning tree, and then sends the synchronous data transmission demand data to the QKDN controller through the QKDN interaction module.
Optionally, the QKDN controller is specifically configured to: according to the synchronous data transmission requirement, on the basis of QKDN network topology, calculating an optimal key transmission path between Q-UNs connected with each TSN node, configuring a key transmission route for QKDN nodes on the optimal key transmission path, and preparing for acquiring keys for subsequent TSN nodes;
When the TSN node needs to send a clock synchronous data frame, a key is requested to the connected Q-UN, the connected Q-UN carries out encryption transmission of a one-time codebook through a quantum key generated hop by hop according to key transmission route configuration, so that a shared symmetric key is generated with the Q-UN connected with the target node, the key is sent to the TSN nodes at two ends, and the integrity of synchronous data is protected by using the key.
Optionally, the target node includes a receiving module, a synchronous data security monitoring module and a data processing module;
the receiving module is used for receiving the encrypted synchronous data and the secret key;
the synchronous data security monitoring module is used for monitoring whether malicious tampering attack exists in the synchronous data received by the target node;
The data processing module is used for reserving the received synchronous data and carrying out subsequent synchronous operation if the data processing module is not tampered; if tampered, the data is discarded directly.
Optionally, the synchronous data security monitoring module includes: the system comprises a data acquisition sub-module, a key acquisition sub-module, an integrity verification sub-module and an integrity reporting sub-module;
The data acquisition sub-module is used for acquiring synchronous data received by the target node;
The key acquisition sub-module is used for acquiring the key received by the target node;
The integrity checking sub-module is used for checking whether the received synchronous data is tampered according to an encryption algorithm;
If not tampered, the integrity reporting sub-module reports to the CNC that the current TSN node is not attacked; and if the current TSN node is tampered, the integrity reporting sub-module reports that the current TSN node is attacked to the CNC.
Optionally, the CNC further comprises an AS monitoring module and an attacked network segment information storage unit inside;
The AS monitoring module is used for continuously monitoring the reporting information of the synchronous data security monitoring modules of all TSN nodes in the network through the SDN controller, once the data integrity is found to be damaged, recording the source node and the target node of the data and storing the source node and the target node in the information storage unit of the attacked network segment, reporting the synchronous path decision module, re-making a synchronous spanning tree by the synchronous path decision module, continuously monitoring the attacked network segment, and updating the information of the attacked network segment after the attack is detected to disappear.
In another aspect, there is provided a centralized network controller CNC, comprising: the system comprises a synchronous path decision module, an SDN controller, a network topology information storage unit and a QKDN interaction module;
the CNC starts a synchronous configuration process after receiving a synchronous request for configuring a CUC (compute unified device) by a centralized user, the synchronous path decision module discovers physical network topology through the SDN controller and checks whether a network node supports 802.1AS standards or not, stores the information into the network topology information storage unit, simultaneously formulates a synchronous spanning tree according to the information, then issues a master clock configuration and port attributes of all nodes to all TSN nodes in the synchronous spanning tree through the SDN controller, and then all the TSN nodes in the synchronous spanning tree spontaneously start the synchronous process;
The synchronous path decision module also generates synchronous data transmission demand data which can be understood by the QKDN controller according to the synchronous spanning tree, and then sends the synchronous data transmission demand data to the QKDN controller through the QKDN interaction module.
Optionally, the CNC further comprises an AS monitoring module and an attacked network segment information storage unit inside;
The AS monitoring module is used for continuously monitoring the reporting information of the synchronous data security monitoring modules of all TSN nodes in the network through the SDN controller, once the data integrity is found to be damaged, recording the source node and the target node of the data and storing the source node and the target node in the information storage unit of the attacked network segment, reporting the synchronous path decision module, re-making a synchronous spanning tree by the synchronous path decision module, continuously monitoring the attacked network segment, and updating the information of the attacked network segment after the attack is detected to disappear.
On the other hand, a target node of a time sensitive network TSN is provided, which comprises a receiving module, a synchronous data security monitoring module and a data processing module;
the receiving module is used for receiving the encrypted synchronous data and the secret key;
the synchronous data security monitoring module is used for monitoring whether malicious tampering attack exists in the synchronous data received by the target node;
The data processing module is used for reserving the received synchronous data and carrying out subsequent synchronous operation if the data processing module is not tampered; if tampered, the data is discarded directly.
On the other hand, a TSN clock synchronization process dynamic protection method based on QKD technology is provided, and the system is used for TSN clock synchronization process dynamic protection.
Compared with the prior art, the technical scheme has at least the following beneficial effects:
according to the invention, a key is generated by using the QKD network according to the transmission requirement of the TSN synchronous data for protecting the integrity of the synchronous data, meanwhile, the condition that the synchronous data of the TSN node is attacked is dynamically monitored, and the TSN synchronous path and QKDN key generation path can be re-planned when the attack exists, so that the malicious tampering attack aiming at the TSN synchronous data can be effectively prevented.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly described below, and it is apparent that the drawings in the following description are only some embodiments of the present invention, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a schematic diagram of an overall architecture of a TSN clock synchronization process dynamic protection system based on QKD technology according to an embodiment of the present invention;
FIG. 2 is a block diagram of the CNC internal functional module provided by the embodiment of the invention;
FIG. 3 is a block diagram illustrating an internal structure of a synchronous data security monitoring module according to an embodiment of the present invention;
Fig. 4 is a block diagram of a target node structure of a TSN according to an embodiment of the present invention;
Fig. 5 is a flowchart of a TSN clock synchronization process dynamic protection method based on QKD technology according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. It will be apparent that the described embodiments are some, but not all, embodiments of the invention. All other embodiments, which can be made by a person skilled in the art without creative efforts, based on the described embodiments of the present invention fall within the protection scope of the present invention.
The current quantum key distribution network (Quantum Key Distribution Network, QKDN) mainly refers to a novel network which takes a large number of interconnected QKD devices as a physical basis and takes key distribution services providing information theory security as main services. The QKDN nodes are divided into three types of user nodes (Q-UN), access nodes (Q-AN) and relay nodes (Q-RN), QKDN user nodes can be directly connected with the QKDN access nodes to access the QKD network, and can also be accessed through AN optical quantum multiplexer so as to realize multiplexing of multiplex QKDN user signals, and then, a remote key relay is realized through quantum backbone (Quantum BackBone network, QBB) backbone links formed by a plurality of QKDN relay nodes. The multi-hop path formed by QKDN user nodes, access nodes and relay nodes forms an end-to-end quantum key transmission channel, and the channel carries out encryption transmission in a One-Time-Pad (OTP) mode through quantum keys generated hop by hop, so that key distribution of Information security (Information TheoreticSecure, ITS) between any two user nodes in a network can be realized, wherein QKDN user nodes (QKDN User Node, Q-UN): q is typically composed of a QKD signal transmitter (QKD TRANSMITTER, Q-Tx) and a Quantum key manager (Quantum KEY MANAGER, QKM) at lower cost than the receiver, Q-UN being deployed on the user side, responsible for acquiring symmetric shared Quantum key pairs from the QKD network according to service requests, and providing the corresponding Quantum keys to specific applications for secure communications; QKDN relay Node (QKDN RELAY Node, Q-RN): the key relay transmission system is composed of a plurality of pairs of Q-Tx and QKD receivers (QKD RECEIVER, Q-Rx) which are connected through QKM, wherein Q-RN is a main network element in the QKD network based on a trusted relay scheme, and the limitation of the transmission distance of the QKD quantum channels is broken through by forming a multi-hop quantum key OTP channel between Q-UN, so that the key relay transmission of information theory security is realized; QKDN access Node (QKDN ACCESS Node, Q-AN): consists of a QKD receiver (QKD RECEIVER, Q-Rx) connected to the Q-UN and a Q-Tx or Q-Rx connected to the Q-RN, which functions like an access gateway of the QKD user by QKM connection, is responsible for converging the belonging Q-UN traffic and forwarding to the QKD node of the next hop; QKD local key manager (Quantum KEY MANAGER, QKM): QKM functional modules are built in Q-UN, Q-AN and Q-RN and are responsible for carrying out local processing on quantum keys generated by QKD nodes, and QKM in the Q-UN is mainly responsible for safely packaging the quantum keys according to user requests and providing the quantum keys for application programs; QKM in the Q-RN is responsible for relay forwarding and local protection of the quantum key; QKM in the Q-AN is responsible for managing the belonged Q-UN and relaying the key with the corresponding Q-RN; QKDN controller (QKD Network Controller, Q-NC): the Q-NC is used as a control plane functional entity of the QKD network and is responsible for collecting the state and request information of each node and issuing various network management and control instructions.
The embodiment of the invention introduces an interaction flow of a centralized network controller (CentralNetwork Controller, CNC) and a QKDN controller on the basis of a TSN AS configuration flow, dynamically synchronizes the result to a QKDN controller after the CNC formulates a synchronous spanning tree, so that a QKD network generates a symmetric key for a corresponding TSN node for protecting clock synchronous data integrity, and simultaneously the TSN node is added with a synchronous data safety monitoring module for monitoring potential tampering attacks in the network, reporting the CNC once the attacks are monitored, and reconfiguring a clock synchronous link, wherein the overall architecture of the system is AS shown in figure 1, and the embodiment of the invention provides a TSN clock synchronous process dynamic protection system based on the QKD technology, which comprises the following steps: centralized network controller CNC, time sensitive network TSN node, quantum key distribution network QKDN controller, QKDN user node Q-UN connected with TSN node;
The CNC is used for starting a synchronous configuration process, formulating a synchronous spanning tree, generating configuration information and sending the configuration information to each TSN node in the synchronous spanning tree;
The CNC is further configured to send synchronous data transmission requirements of each TSN node to the QKDN controller;
The QKDN controller is configured to calculate an optimal key transmission path between Q-UN connected to each TSN node according to the synchronous data transmission requirement, and configure QKDN node routing;
the TSN node which needs to perform time synchronization is used for starting a synchronization process after completing configuration, and requesting a key from a connected Q-UN before sending synchronization data;
the connected Q-UN is used for generating a key according to the optimal key transmission path calculated before and sending the key to the TSN node and the target node which need to be time synchronized;
The TSN node needing time synchronization is further used for encrypting the synchronous data by using the key and sending the encrypted synchronous data to the target node;
The target node is used for verifying the integrity of the data by using the secret key after receiving the encrypted synchronous data, and reporting the integrity verification result to the CNC;
The CNC is further used for performing corresponding processing according to the integrity verification result.
The embodiment of the invention designs a corresponding CNC internal functional module, so that the CNC has the dynamic decision capability aiming at network attack and the interaction function with QKDN controllers.
Optionally, as shown in fig. 2, the CNC specifically includes: the system comprises a synchronous path decision module, an SDN controller, a network topology information storage unit and a QKDN interaction module;
The CNC starts a synchronous configuration process after receiving a synchronous request of centralized user configuration (Centralized User Configuration, CUC), the synchronous path decision module discovers physical network topology through the SDN controller and checks whether network nodes support 802.1AS standards or not, stores the information into the network topology information storage unit, formulates a synchronous spanning tree according to the information, then issues a master clock configuration and port attributes of all nodes to all TSN nodes in the synchronous spanning tree through the SDN controller, and then spontaneously starts the synchronous process by all TSN nodes in the synchronous spanning tree;
The synchronous path decision module also generates synchronous data transmission demand data which can be understood by the QKDN controller according to the synchronous spanning tree, and then sends the synchronous data transmission demand data to the QKDN controller through the QKDN interaction module.
Optionally, the QKDN controller is specifically configured to: according to the synchronous data transmission requirement, on the basis of QKDN network topology, calculating an optimal key transmission path between Q-UNs connected with each TSN node, configuring a key transmission route for QKDN nodes on the optimal key transmission path, and preparing for acquiring keys for subsequent TSN nodes;
When the TSN node needs to send a clock synchronous data frame, a key is requested to the connected Q-UN, the connected Q-UN carries out encryption transmission of a one-time codebook through a quantum key generated hop by hop according to key transmission route configuration, so that a shared symmetric key is generated with the Q-UN connected with the target node, the key is sent to the TSN nodes at two ends, and the integrity of synchronous data is protected by using the key.
The specific calculation process of the optimal key transmission path and the specific generation process of the key are both prior art, and are not described herein.
Optionally, the target node includes a receiving module, a synchronous data security monitoring module and a data processing module;
the receiving module is used for receiving the encrypted synchronous data and the secret key;
the synchronous data security monitoring module is used for monitoring whether malicious tampering attack exists in the synchronous data received by the target node;
The data processing module is used for reserving the received synchronous data and carrying out subsequent synchronous operation if the data processing module is not tampered; if tampered, the data is discarded directly.
Optionally, as shown in fig. 3, the synchronous data security monitoring module includes: the system comprises a data acquisition sub-module, a key acquisition sub-module, an integrity verification sub-module and an integrity reporting sub-module;
The data acquisition sub-module is used for acquiring synchronous data received by the target node;
The key acquisition sub-module is used for acquiring the key received by the target node;
The integrity checking sub-module is used for checking whether the received synchronous data is tampered according to an encryption algorithm;
the specific process of verifying whether the received synchronous data is tampered according to the encryption algorithm is the prior art, and will not be described here again.
If not tampered, the integrity reporting sub-module reports to the CNC that the current TSN node is not attacked; and if the current TSN node is tampered, the integrity reporting sub-module reports that the current TSN node is attacked to the CNC.
Optionally, the CNC further comprises an AS monitoring module and an attacked network segment information storage unit inside;
The AS monitoring module is used for continuously monitoring the reporting information of the synchronous data security monitoring modules of all TSN nodes in the network through the SDN controller, once the data integrity is found to be damaged, recording the source node and the target node of the data and storing the source node and the target node in the information storage unit of the attacked network segment, reporting the synchronous path decision module, re-making a synchronous spanning tree by the synchronous path decision module, continuously monitoring the attacked network segment, and updating the information of the attacked network segment after the attack is detected to disappear.
As shown in fig. 2, an embodiment of the present invention further provides a CNC of a centralized network controller, including: the system comprises a synchronous path decision module, an SDN controller, a network topology information storage unit and a QKDN interaction module;
the CNC starts a synchronous configuration process after receiving a synchronous request for configuring a CUC (compute unified device) by a centralized user, the synchronous path decision module discovers physical network topology through the SDN controller and checks whether a network node supports 802.1AS standards or not, stores the information into the network topology information storage unit, simultaneously formulates a synchronous spanning tree according to the information, then issues a master clock configuration and port attributes of all nodes to all TSN nodes in the synchronous spanning tree through the SDN controller, and then all the TSN nodes in the synchronous spanning tree spontaneously start the synchronous process;
The synchronous path decision module also generates synchronous data transmission demand data which can be understood by the QKDN controller according to the synchronous spanning tree, and then sends the synchronous data transmission demand data to the QKDN controller through the QKDN interaction module.
Optionally, the CNC further comprises an AS monitoring module and an attacked network segment information storage unit inside;
The AS monitoring module is used for continuously monitoring the reporting information of the synchronous data security monitoring modules of all TSN nodes in the network through the SDN controller, once the data integrity is found to be damaged, recording the source node and the target node of the data and storing the source node and the target node in the information storage unit of the attacked network segment, reporting the synchronous path decision module, re-making a synchronous spanning tree by the synchronous path decision module, continuously monitoring the attacked network segment, and updating the information of the attacked network segment after the attack is detected to disappear.
As shown in fig. 4, the embodiment of the present invention further provides a target node of a time sensitive network TSN, which includes a receiving module, a synchronous data security monitoring module and a data processing module;
the receiving module is used for receiving the encrypted synchronous data and the secret key;
the synchronous data security monitoring module is used for monitoring whether malicious tampering attack exists in the synchronous data received by the target node;
The data processing module is used for reserving the received synchronous data and carrying out subsequent synchronous operation if the data processing module is not tampered; if tampered, the data is discarded directly.
As shown in fig. 5, the embodiment of the present invention further provides a TSN clock synchronization process dynamic protection method based on QKD technology, and the TSN clock synchronization process dynamic protection is performed by using the above system.
The foregoing description of the preferred embodiments of the invention is not intended to limit the invention to the precise form disclosed, and any such modifications, equivalents, and alternatives falling within the spirit and scope of the invention are intended to be included within the scope of the invention.
Claims (10)
1. A TSN clock synchronization process dynamic protection system based on QKD technology, the system comprising: centralized network controller CNC, time sensitive network TSN node, quantum key distribution network QKDN controller, QKDN user node Q-UN connected with TSN node;
The CNC is used for starting a synchronous configuration process, formulating a synchronous spanning tree, generating configuration information and sending the configuration information to each TSN node in the synchronous spanning tree;
The CNC is further configured to send synchronous data transmission requirements of each TSN node to the QKDN controller;
The QKDN controller is configured to calculate an optimal key transmission path between Q-UN connected to each TSN node according to the synchronous data transmission requirement, and configure QKDN node routing;
the TSN node which needs to perform time synchronization is used for starting a synchronization process after completing configuration, and requesting a key from a connected Q-UN before sending synchronization data;
The connected Q-UN is used for generating a key according to the optimal key transmission path calculated before and sending the key to the TSN node and the target node which need to be time synchronized;
The TSN node needing time synchronization is further used for encrypting the synchronous data by using the key and sending the encrypted synchronous data to the target node;
The target node is used for verifying the integrity of the data by using the secret key after receiving the encrypted synchronous data, and reporting the integrity verification result to the CNC;
The CNC is further used for performing corresponding processing according to the integrity verification result.
2. The system according to claim 1, characterized in that the CNC, in particular, comprises: the system comprises a synchronous path decision module, an SDN controller, a network topology information storage unit and a QKDN interaction module;
the CNC starts a synchronous configuration process after receiving a synchronous request for configuring a CUC (compute unified device) by a centralized user, the synchronous path decision module discovers physical network topology through the SDN controller and checks whether a network node supports 802.1AS standards or not, stores the information into the network topology information storage unit, simultaneously formulates a synchronous spanning tree according to the information, then issues a master clock configuration and port attributes of all nodes to all TSN nodes in the synchronous spanning tree through the SDN controller, and then all the TSN nodes in the synchronous spanning tree spontaneously start the synchronous process;
The synchronous path decision module also generates synchronous data transmission demand data which can be understood by the QKDN controller according to the synchronous spanning tree, and then sends the synchronous data transmission demand data to the QKDN controller through the QKDN interaction module.
3. The system of claim 2, wherein the QKDN controller is specifically configured to: according to the synchronous data transmission requirement, on the basis of QKDN network topology, calculating an optimal key transmission path between Q-UNs connected with each TSN node, configuring a key transmission route for QKDN nodes on the optimal key transmission path, and preparing for acquiring keys for subsequent TSN nodes;
When the TSN node needs to send a clock synchronous data frame, a key is requested to the connected Q-UN, the connected Q-UN carries out encryption transmission of a one-time codebook through a quantum key generated hop by hop according to key transmission route configuration, so that a shared symmetric key is generated with the Q-UN connected with the target node, the key is sent to the TSN nodes at two ends, and the integrity of synchronous data is protected by using the key.
4. The system of claim 3, wherein the target node comprises a receiving module, a synchronous data security monitoring module, and a data processing module;
the receiving module is used for receiving the encrypted synchronous data and the secret key;
the synchronous data security monitoring module is used for monitoring whether malicious tampering attack exists in the synchronous data received by the target node;
The data processing module is used for reserving the received synchronous data and carrying out subsequent synchronous operation if the data processing module is not tampered; if tampered, the data is discarded directly.
5. The system of claim 4, wherein the synchronous data security monitoring module comprises: the system comprises a data acquisition sub-module, a key acquisition sub-module, an integrity verification sub-module and an integrity reporting sub-module;
The data acquisition sub-module is used for acquiring synchronous data received by the target node;
The key acquisition sub-module is used for acquiring the key received by the target node;
The integrity checking sub-module is used for checking whether the received synchronous data is tampered according to an encryption algorithm;
If not tampered, the integrity reporting sub-module reports to the CNC that the current TSN node is not attacked; and if the current TSN node is tampered, the integrity reporting sub-module reports that the current TSN node is attacked to the CNC.
6. The system of claim 5, wherein the CNC further comprises an AS monitor module and an attacked segment information storage unit inside;
The AS monitoring module is used for continuously monitoring the reporting information of the synchronous data security monitoring modules of all TSN nodes in the network through the SDN controller, once the data integrity is found to be damaged, recording the source node and the target node of the data and storing the source node and the target node in the information storage unit of the attacked network segment, reporting the synchronous path decision module, re-making a synchronous spanning tree by the synchronous path decision module, continuously monitoring the attacked network segment, and updating the information of the attacked network segment after the attack is detected to disappear.
7. A centralized network controller CNC, comprising: the system comprises a synchronous path decision module, an SDN controller, a network topology information storage unit and a QKDN interaction module;
the CNC starts a synchronous configuration process after receiving a synchronous request for configuring a CUC (compute unified device) by a centralized user, the synchronous path decision module discovers physical network topology through the SDN controller and checks whether a network node supports 802.1AS standards or not, stores the information into the network topology information storage unit, simultaneously formulates a synchronous spanning tree according to the information, then issues a master clock configuration and port attributes of all nodes to all TSN nodes in the synchronous spanning tree through the SDN controller, and then all the TSN nodes in the synchronous spanning tree spontaneously start the synchronous process;
The synchronous path decision module also generates synchronous data transmission demand data which can be understood by the QKDN controller according to the synchronous spanning tree, and then sends the synchronous data transmission demand data to the QKDN controller through the QKDN interaction module.
8. The CNC of claim 7, wherein the CNC further comprises an AS monitor module and an attacked segment information storage unit within the CNC;
The AS monitoring module is used for continuously monitoring the reporting information of the synchronous data security monitoring modules of all TSN nodes in the network through the SDN controller, once the data integrity is found to be damaged, recording the source node and the target node of the data and storing the source node and the target node in the information storage unit of the attacked network segment, reporting the synchronous path decision module, re-making a synchronous spanning tree by the synchronous path decision module, continuously monitoring the attacked network segment, and updating the information of the attacked network segment after the attack is detected to disappear.
9. The target node of the time sensitive network TSN is characterized by comprising a receiving module, a synchronous data security monitoring module and a data processing module;
the receiving module is used for receiving the encrypted synchronous data and the secret key;
the synchronous data security monitoring module is used for monitoring whether malicious tampering attack exists in the synchronous data received by the target node;
The data processing module is used for reserving the received synchronous data and carrying out subsequent synchronous operation if the data processing module is not tampered; if tampered, the data is discarded directly.
10. A TSN clock synchronization process dynamic protection method based on QKD technology, characterized in that TSN clock synchronization process dynamic protection is performed using the system of any of claims 1-6.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202410136176.3A CN118041522A (en) | 2024-01-31 | 2024-01-31 | TSN clock synchronization process dynamic protection system and method based on QKD technology |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202410136176.3A CN118041522A (en) | 2024-01-31 | 2024-01-31 | TSN clock synchronization process dynamic protection system and method based on QKD technology |
Publications (1)
Publication Number | Publication Date |
---|---|
CN118041522A true CN118041522A (en) | 2024-05-14 |
Family
ID=90998314
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202410136176.3A Pending CN118041522A (en) | 2024-01-31 | 2024-01-31 | TSN clock synchronization process dynamic protection system and method based on QKD technology |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN118041522A (en) |
-
2024
- 2024-01-31 CN CN202410136176.3A patent/CN118041522A/en active Pending
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2021203733A1 (en) | Power edge gateway device and device-based sensor data uplink storage method | |
CN109302288B (en) | Quantum secret communication network system based on quantum key distribution technology and application thereof | |
KR100933167B1 (en) | Transmission Method for Authentication and Privacy Guarantee in Tree-structured Networks | |
US20050008158A1 (en) | Key management device and method for providing security service in ethernet-based passive optical network | |
US20190123847A1 (en) | System and method for protecting communication in time-sensitive networks using shared secret information | |
CN112565230B (en) | Software-defined Internet of things network topology data transmission safety management method and system | |
CN102142958B (en) | Communication system and communication device | |
KR100594153B1 (en) | Formation of Logical Link and Its Secure Communication Method in Network of Point-to-Manage Topology | |
CN110808837B (en) | Quantum key distribution method and system based on tree-shaped QKD network | |
US20100123572A1 (en) | Alarm reordering to handle alarm storms in large networks | |
US11784984B2 (en) | Methods to strengthen cyber-security and privacy in a deterministic internet of things | |
CN113595735B (en) | Supervised privacy protection block chain crossing system based on CP-ABE | |
CN110166853A (en) | In the method and apparatus of the consistency check of the dense wavelength division multiplexing system of decomposition | |
WO2013104987A1 (en) | Method for authenticating identity of onu in gpon network | |
JP2023506908A (en) | How to Secure Time Synchronization for Ethernet Vehicle Networks | |
Bush et al. | A perspective on industrial quantum networks | |
Al Salti et al. | LINK-GUARD: an effective and scalable security framework for link discovery in SDN networks | |
Hajduczenia et al. | On EPON security issues | |
CN118041522A (en) | TSN clock synchronization process dynamic protection system and method based on QKD technology | |
Gaderer et al. | Security aspects for IEEE 1588 based clock synchronization protocols | |
KR102587055B1 (en) | System for Detecting Anomaly Computing Based on Artificial Intelligence | |
CN109195160A (en) | Network equipment resource detects the anti-tamper storage system and its control method of information | |
CN109039612B (en) | Secure interaction method and system for software defined optical network | |
AU2021104109A4 (en) | Encryption signalling network and authentication-link | |
CN116192281B (en) | Quantum communication-based network topology control method |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination |