Fixed telephone network transmission system based on quantum security enhancement and its transmission method

Abstract

The application discloses a fixed telephone network transmission system based on quantum security enhancement, which comprises a plurality of local telephone networks, each of which has a local terminal device, and the local telephone networks are connected through the local terminal devices; each local terminal device is connected with one or more intermediate devices, each intermediate device is connected with a plurality of terminal devices, one terminal device is connected with one telephone set, and the system has an end-to-end security enhancement mechanism, which can provide security protection for the transmission channel between the local telephone switching system and the telephone set, applies quantum random numbers to the wired telephone communication system, adopts a negotiation distribution mechanism of "one-time security transmission protection one-time conversation", enhances the security and privacy ability of the last kilometer of telephone communication, makes up for the lack of identity authentication of the traditional telephone switching network, greatly reduces the security risks such as tampering and imitating attack of the telephone terminal, conduction leakage, radiation leakage, tone leakage and lapping eavesdropping and the like.

Description

Technical Field

[0001] The present invention belongs to the technical field of telephone networks. More specifically, the present invention relates to a fixed telephone network transmission system and a transmission method thereof based on quantum security enhancement. Background Art

[0002] The telephone is a classic technology in modern communications and a vital means of real-time communication. It consists of three main components: the telephone, switching circuits, and transmission circuits. With the deepening of digital transformation, communications are integrating with new technologies such as cloud computing, big data, artificial intelligence, the Internet of Things, and the Industrial Internet. The introduction of these new technologies and services has disrupted the traditional approach of building and managing telecommunications networks separately for different service networks. This has led to increasing network complexity and uncontrollability, pushing the boundaries of traditional information and communications technologies, and increasing network exposure.

[0003] Standardized telecommunications products widely adopt a "standards-first" development model. Attackers use public standard protocols to understand the working mechanisms of telecommunications products and use maliciously constructed commands to carry out attacks such as sensitive information query and information interception. Standardized telecommunications products are designed for universal service and lack security protection mechanisms, which inevitably lead to security vulnerabilities. Based on the performance and real-time communication requirements of transparent transmission links, intervention or control at any link in the link directly leads to the theft or tampering of calls, data and other information.

[0004] PSTN is an early circuit-switched network based on analog technology. It is a connection-oriented method. Its signaling protocols and related protocols such as voice data encapsulation lack security protection measures, cannot flexibly expand data frame fields, and cannot arbitrarily change time slot allocation. As a result, PSTN cannot use technologies such as IPsec VPN to implement channel protection, nor can it use the Real-Time Streaming Protocol (RTSP) to implement security measures such as media stream data protection and message authentication. Eavesdropping can be carried out by simple means such as telephone line conduction and radiation, crosstalk, and parallel wiring, posing huge security risks. Summary of the Invention

[0005] The present invention provides a fixed-line telephone network transmission system with enhanced quantum security, aiming to improve the above-mentioned problems.

[0006] The present invention is implemented as follows: a fixed telephone network transmission system based on quantum security enhancement, the system comprising:

[0007] Multiple local area telephone networks, each with a central office device, and local area telephone networks are connected through the central office device;

[0008] Each central office device is connected to one or more intermediate devices, each intermediate device is connected to multiple terminal devices, and one terminal device is connected to one telephone.

[0009] Telephones are used to send or receive voice analog signals;

[0010] The terminal equipment is used to encrypt the received voice analog signal, decrypt the received encrypted digital signal, and convert between digital and analog signals;

[0011] Intermediary equipment, used to convert received digital electrical signals into optical signals and encapsulate them, or convert received optical signals into digital electrical signals and analyze them;

[0012] The central office device decrypts the received encrypted signal based on the session key f of the sending terminal device f, and then encrypts the decrypted signal based on the session key j of the receiving terminal device j.

[0013] The present invention is implemented as follows: a fixed telephone network transmission method based on a fixed telephone network transmission system enhanced by quantum security, the method comprising the following steps:

[0014] (1) The terminal device f converts the analog voice signal sent by the landline phone f into a digital signal, encrypts the digital signal based on the session root f1, and sends the encrypted digital signal and the encrypted session root f1 to the corresponding intermediate device F;

[0015] (2) The intermediate device F encapsulates the received encrypted digital signal, converts it into an optical signal, and sends it to the central office device. The encapsulated optical signal carries the identifier of the target device terminal j;

[0016] (3) The central office device converts the encrypted optical signal into a digital electrical signal, determines the device terminal f that sent the digital electrical signal, decrypts the encrypted session root f1, decrypts the encrypted optical signal based on the session root f1, determines the target device terminal j, encrypts the decrypted optical signal using the session root j1, and sends the encrypted optical signal and the encrypted session root j1 to the intermediate device G;

[0017] (4) The intermediate device G converts the encrypted optical signal into a digital electrical signal, parses the digital electrical signal, and sends it to the terminal device j;

[0018] (5) Terminal device j decrypts the encrypted session root j1 to obtain session root j1, decrypts the encrypted digital signal using session root j, converts the decrypted digital signal into an analog signal, and sends it to phone j;

[0019] Among them, session root f and session root j are formed based on quantum random numbers.

[0020] Furthermore, the session root includes: session root f and session root j. The method for generating the session root is as follows:

[0021] The device terminal or the central office device generates a first quantum random number of a specified length in real time, and uses the first quantum random number as a session root between the corresponding device terminal and the central office device.

[0022] Furthermore, the session root synchronization method is as follows:

[0023] The session root f1 generated by the terminal device f is encrypted using the time domain root f2 of the terminal device f. The encrypted session root f1 is transmitted to the central office device. The central office device decrypts the encrypted session root f1 based on the time domain root f2 of the terminal device f, and the central office device obtains the session root f1.

[0024] Or,

[0025] The central office device generates a session root j1, encrypts it using the time domain root j2 of the terminal device j, and transmits the encrypted session root j1 to the terminal device j. The terminal device j decrypts the encrypted session root j1 based on its own time domain root j2, and the terminal device j obtains the session root j1.

[0026] Among them, the time domain root f2 and the time domain root j2 remain unchanged over a period of time.

[0027] Furthermore, the time domain root is generated by the central office device and synchronized to the corresponding terminal device.

[0028] Furthermore, the method for generating the time domain root is as follows:

[0029] The local end device periodically generates a second quantum random number of a set length and uses the quantum random number as a time domain root, wherein the generation frequency of the second quantum random number is lower than that of the first quantum random number.

[0030] Furthermore, the time domain root synchronization method is as follows:

[0031] The time domain root generated by the central office device is encrypted with the regional root of the terminal device, and the encrypted time domain root is transmitted to the corresponding terminal device. The terminal device decrypts the encrypted time domain root based on its own regional root, and the terminal device obtains the time domain root;

[0032] Furthermore, the method for forming regional roots is as follows:

[0033] After the central office device and the terminal device have authenticated their identities, they negotiate and generate a regional root corresponding to the terminal device based on the device root parameters.

[0034] Furthermore, the identity process of the central office and the terminal device is as follows:

[0035] Before deployment, the central office equipment and terminal equipment are injected with device root security parameters for identification;

[0036] The central office equipment and terminal equipment perform identity authentication based on their own device root security parameters.

[0037] Furthermore, if the terminal device f and the terminal device j are not located in the same local area telephone network, the local area telephone network where the terminal device f is located will convert the encrypted optical signal into an electrical signal, determine the sending device terminal f, decrypt the encrypted session root f, and then decrypt the encrypted optical signal based on the session root f to determine the target device terminal j, determine the local area telephone network where the target terminal device j is located, and send the decrypted optical signal to the local area telephone network device d2. The local area telephone network device d2 will then use the session root j to encrypt the decrypted optical signal, and send the encrypted optical signal and the encrypted session root j to the intermediate device G.

[0038] The quantum security-enhanced fixed-line telephone network transmission system proposed in this invention has an end-to-end security enhancement mechanism, which can provide security protection for the transmission channel between the local telephone exchange system and the telephone. It applies quantum random numbers to the wired telephone communication system and adopts a "one-time secure transmission protects one-time call" negotiation and distribution mechanism, which enhances the security and confidentiality of telephone communications in the last mile, makes up for the lack of identity authentication in traditional telephone exchange networks, and greatly reduces security risks such as telephone terminal tampering and counterfeit attacks, conduction leakage, radiation leakage, crosstalk leakage, and overlapping eavesdropping. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of the structure of a fixed-line telephone network transmission system based on quantum security enhancement provided by an embodiment of the present invention;

[0040] Figure 2 This is a flow chart of the fixed-line telephone network transmission method based on quantum security enhancement provided in Example 1 of the present invention;

[0041] Figure 3 This is a flowchart of the fixed-line telephone network transmission method based on quantum security enhancement provided in Example 2 of the present invention. Implementation Method

[0042] The specific implementation methods of the present invention will be further explained in detail below by describing the embodiments with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0043] Figure 1 This is a schematic diagram of the structure of a fixed-line telephone network transmission system based on quantum security enhancement provided by an embodiment of the present invention. For ease of explanation, only the parts related to the embodiment of the present invention are shown. The system includes:

[0044] Multiple local area telephone networks, each with a central office device, and local area telephone networks are connected through the central office device;

[0045] Each central office device is connected to one or more intermediate devices, each intermediate device is connected to multiple terminal devices, and one terminal device is connected to one telephone.

[0046] Telephones are used to send or receive voice analog signals;

[0047] The terminal equipment is used to encrypt the received voice analog signal, decrypt the received encrypted digital signal, and convert between digital and analog signals;

[0048] Intermediary equipment, used to convert received digital electrical signals into optical signals and encapsulate them, or convert received optical signals into digital electrical signals and analyze them;

[0049] The central office device decrypts the received encrypted optical signal based on the session key f of the sending terminal device f, and then encrypts the decrypted optical signal based on the session key j of the receiving terminal device j.

[0050] The functions of the above components are described in detail below:

[0051] ① Telephone

[0052] It is a traditional telephone with general functions such as dialing and talking;

[0053] ②Terminal equipment

[0054] (21) Converting analog telephone service signals from telephones into digital signals, or converting digital signals from intermediate equipment into analog telephone service signals;

[0055] (22) The digital line interface provides two 64 kbit / s channels, totaling 128 kbit / s. One 64 kbit / s channel transmits voice data, while the other 64 kbit / s channel transmits signaling and security parameters, including session root f1, time domain root f2, and regional root f3.

[0056] (23) The intrinsically secure telephone channel is based on quantum security enhanced protection measures, which establishes a one-time secure channel for each call to protect the confidentiality and integrity of user information during transmission.

[0057] ③Intermediate equipment

[0058] It generally connects one central office device and multiple terminal devices, or multiple central office devices. It combines or splits telephone signals through time division multiplexing / demultiplexing, provides photoelectric conversion, multiplexing / demultiplexing, and digital line interface, and provides security sensing and remote power feeding functions.

[0059] (31) Optical-to-electrical conversion refers to converting 155.520 Mbit / s optical signals from central office equipment into electrical signals for local demultiplexing or multiplexing local telephone services into 155.520 Mbit / s optical signals for transmission to central office equipment;

[0060] (32) Multiplexing / demultiplexing is to demultiplex telephone services from 155.520Mbit / s into multiple 64Kbit / s PCM signals or to encapsulate several 64Kbit / s PCM signals into 155.520Mbit / s optical signals according to the SDH standard;

[0061] (33) The digital line interface provides two 64 kbit / s channels, totaling 128 kbit / s. One 64 kbit / s channel transmits voice data, and the other 64 kbit / s channel transmits signaling and security parameters.

[0062] (34) The security perception function includes the parallel sensing function for monitoring illegal intrusions such as parallel wiring and the status perception function for monitoring conducted radiation, crosstalk and fault measurement.

[0063] (35) Remote power feeding adopts the co-linear transmission mode of power supply and signal, and adopts the voltage feeding mode to convert power through a high-efficiency switching DC / DC converter to obtain a low-voltage, high-current output power for remote power feeding of terminal equipment.

[0064] ④Local end equipment

[0065] It is mainly composed of internal security telephone channels, security control, PCM, optical interface, digital line interface and communication management. It is a convergence device for PSTN security transmission, adopts quantum security strategy and security enhancement mechanism, transmits telephone services through SDH standard protocol and digital line interface, and uses communication optical fiber or communication twisted pair. It has two interfaces: optical fiber communication and digital line.

[0066] (41) The intrinsically secure telephone channel is based on quantum security enhanced protection measures, which establishes a one-time secure channel for each call to protect the confidentiality and integrity of user information during transmission.

[0067] (42) Security management and control: Establish a whitelist system, complete the registration and authentication of all devices, adopt an authorization mechanism, and assign corresponding access rights to each device. Review device authentication and authorization information in real time to prevent illegal or unauthorized access requests. Use access control technology to restrict unauthorized devices from accessing network resources. Establish an isolation mechanism to isolate channels with security risks to prevent the expansion of security threats.

[0068] (43) PCM is the basis of the quantum security-enhanced fixed-line telephone network transmission system. PCM communication is a digital communication method for transmitting analog signals, used to convert analog signals into digital signals and realize the transmission of voice data in the communication network. It mainly includes three parts: transmission, channel and reception. Among them, the transmission part includes low-pass filtering, sampling, quantization and encoding (i.e. analog-to-digital conversion); the channel part includes digital subscriber lines for point-to-point signal transmission using telephone lines as the transmission medium; reception includes signal regeneration and digital-to-analog conversion, where the digital-to-analog conversion includes decoding and low-pass filtering.

[0069] (44) The optical interface complies with SDH technical standards, including multiplexing methods, mapping methods, and synchronization methods. It has a unified frame structure, a standard digital transmission rate, and a standard optical interface. The rate is 155.520 Mbit / s, with the purpose of improving telephone communication coverage.

[0070] (45) The digital line interface provides two 64 kbit / s channels, for a total of 128 kbit / s. One 64 kbit / s channel transmits user information such as voice and data, while the other 64 kbit / s channel transmits signaling and security parameters.

[0071] (46) Communication Management: Check and review the access device function modules and assign corresponding channels to each terminal according to the security control authorization mechanism. Monitor and record all device requests, including the source address, destination address, signaling or protocol type, and other information. Monitor the device's operating status and network activity in real time to ensure that the device is operating normally within the authorized scope.

[0072] Figure 2 This is a flowchart of a fixed-line telephone network transmission method based on quantum security enhancement provided in Example 1 of the present invention. In Example 1, voice data is transmitted between device terminals f and j in the same local area telephone network. The fixed-line telephone network transmission method based on quantum security enhancement specifically includes the following steps:

[0073] (1) The terminal device f converts the analog voice signal sent by the landline phone f into a digital signal, encrypts the digital signal based on the session root f1, and sends the encrypted digital signal and the encrypted session root f1 to the intermediate device F connected to it;

[0074] In the embodiment of the present invention, the process of generating the session root f is as follows:

[0075] The terminal device f generates a first quantum random number of a specified length in real time and uses the first quantum random number as the session root f1. Since the session root f1 needs to be transmitted to the central office device, the transmitted session root f1 needs to be encrypted. The session root f1 is encrypted using the time domain root f2 of the terminal device f. The time domain root f2 remains unchanged over a period of time.

[0076] In the embodiment of the present invention, the time domain root f2 is regularly generated by the central office device and synchronized to the corresponding terminal device f. The time domain root f2 is a second quantum random number of a specified length regularly generated by the central office device. The generation frequency of the second quantum random number is lower than the generation frequency of the first quantum random number. The synchronization process of the time domain root f2 is specifically as follows:

[0077] The time domain root f2 generated by the central office device is encrypted with the regional root f3 of the terminal device f, and the encrypted time domain root f2 is transmitted to the terminal device f. The terminal device f decrypts the encrypted time domain root f2 based on its own regional root f3 to obtain the time domain root f2.

[0078] The specific process of generating the regional root f3 is as follows: after the central office device and the terminal device f have authenticated their identities, the central office device and the terminal device f negotiate based on their respective device root parameters to generate the regional root f3 between the terminal device f and the central office device.

[0079] In an embodiment of the present invention, the identity process of the central office device and the terminal device is as follows: before deployment, the central office device and the terminal device inject device root security parameters for identity identification; the central office device and the terminal device perform identity legitimacy authentication based on their own device root security parameters.

[0080] (2) Intermediate device F converts the received encrypted digital signal into an optical signal, encapsulates the optical signal and sends it to the central office device. The encapsulated optical signal carries the identifier of the target terminal j, which is the communication terminal device of terminal device f.

[0081] (3) The central office device converts the encrypted optical signal into a digital electrical signal, determines the device terminal f that sent the digital electrical signal, decrypts the encrypted session root f1, decrypts the encrypted optical signal based on the session root f1, determines the target device terminal j, encrypts the decrypted optical signal using the session root j1, and sends the encrypted optical signal and the encrypted session root j1 to the intermediate device G;

[0082] In an embodiment of the present invention, since the regional root f3 and the time domain root f2 of the terminal device f exist in the local end device, the session root f1 is encrypted by the time domain root f2. At this time, the local end device can decrypt the encrypted session root f1 after reading the time domain root f2 of the terminal device f to obtain the session root f1, and then decrypt the encrypted optical signal based on the session root f1 to determine the target device terminal j.

[0083] The local device generates a first quantum random number of a specified length in real time and uses the first quantum random number as the session root j1 of the target terminal device j. Since the session root j1 needs to be transmitted to the target terminal device j, the transmitted session root j1 needs to be encrypted. The session root j1 is encrypted using the time domain root j2 of the terminal device j. The time domain root j2 remains unchanged over a period of time.

[0084] The time domain root j2 is generated regularly by the central office device and then synchronized to the corresponding target terminal device j. The time domain root j2 is a second quantum random number of a specified length regularly generated by the central office device. The generation frequency of the second quantum random number is lower than the generation frequency of the first quantum random number. The synchronization process of the time domain root j2 is as follows:

[0085] The time domain root j2 generated by the local device is encrypted using the regional root j3 of the target terminal device j. The encrypted time domain root j2 is transmitted to the target terminal device j. The target terminal device j decrypts the encrypted time domain root j2 based on its own regional root j3, and the target terminal device j obtains the time domain root j2.

[0086] (4) The intermediate device G converts the encrypted optical signal into a digital electrical signal, parses the digital electrical signal, and sends it to the terminal device j;

[0087] (5) Terminal device j decrypts the encrypted session root j1 to obtain session root j1, decrypts the encrypted digital signal using session root j1, converts the decrypted digital signal into an analog signal, and sends it to phone j;

[0088] In this embodiment of the present invention, since the encrypted session root j1 is encrypted by the time domain root j2 of the terminal device j, the terminal device j decrypts the encrypted session root j1 based on its own time domain root j2 to obtain the session root j1, and then decrypts the encrypted digital electrical signal based on the session root j1 to obtain the digital electrical signal, converts the decrypted digital electrical signal into an analog signal, and sends it to the phone j.

[0089] Figure 3This is a flowchart of a fixed-line telephone network transmission method based on quantum security enhancement provided in Example 2 of the present invention. In Example 1, voice data is transmitted between device terminals f and j that are not in the same local area telephone network. Terminal device f is located in local area telephone network D1, and the central office device of local area telephone network D1 is represented by d1. Terminal device j is located in local area telephone network D2, and the central office device of local area telephone network D2 is represented by d2. The fixed-line telephone network transmission method based on quantum security enhancement specifically includes the following steps:

[0090] (1) The terminal device f converts the analog voice signal sent by the landline phone f into a digital signal, encrypts the digital signal based on the session root f, and sends the encrypted digital signal and the encrypted session root f to the corresponding intermediate device F;

[0091] (2) The intermediate device F converts the received encrypted digital signal into an optical signal, encapsulates the optical signal and sends it to the central office device d1. The encapsulated optical signal carries the identifier of the target device terminal j.

[0092] (3) The central office device d1 converts the encrypted optical signal into an electrical signal, identifies the device terminal f that sent the digital electrical signal, decrypts the encrypted session root f, and then decrypts the encrypted optical signal based on the session root f, identifies the target device terminal j, identifies the central office device d2 of the local area telephone network where the target terminal j is located, and sends the decrypted optical signal to the central office device d2. The central office device d2 then encrypts the decrypted optical signal using the session root j, and sends the encrypted optical signal and the encrypted session root j to the intermediate device G.

[0093] (4) The intermediate device G converts the encrypted optical signal into a digital electrical signal, parses the decrypted digital electrical signal, and sends it to the terminal device j;

[0094] (5) Terminal device j decrypts the encrypted session root j1 to obtain session root j1, decrypts the encrypted digital signal using session root j1, converts the decrypted digital signal into an analog signal, and sends it to phone j;

[0095] In the embodiment of the present invention, the generation and synchronization process of the session root, time domain root and regional root f3 of the terminal device is the same as the method described in the first embodiment, and the present invention will not be repeated here.

[0096] The present invention has been described exemplarily. Obviously, the specific implementation of the present invention is not limited to the above-mentioned method. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the scope of protection of the present invention.

Claims

1. A fixed-line telephone network transmission method based on quantum security enhancement, wherein the fixed-line telephone network system includes multiple local area telephone networks, each of which has a central office device, and the local area telephone networks are connected through the central office devices. Each local area telephone network also includes one or more intermediate devices, each of which is connected to multiple terminal devices, and each terminal device is connected to a telephone. The method is characterized in that: Landline network delivery methods include: Key exchange process: Before deployment, the central office and terminal devices are injected with device root security parameters for identity identification. The central office and terminal devices authenticate their identities based on their own device root security parameters. After completing the authentication, the central office and terminal devices negotiate to generate the corresponding regional root for the terminal device based on the device root parameters. The central office device periodically generates a time domain root, encrypts it with the regional root, and transmits the encrypted time domain root to the corresponding terminal device. The terminal device decrypts the time domain root based on the regional root to obtain the time domain root. The session root f1 generated by the terminal device f is encrypted using the time domain root. The encrypted session root f1 is transmitted to the central office device. The central office device decrypts the encrypted session root f1 based on the time domain root to obtain the session root f1. Alternatively, the central office device generates a session root j1, encrypts it using the time domain root, transmits the encrypted session root j1 to the terminal device j, and the terminal device j decrypts the encrypted session root j1 based on the time domain root, and the terminal device j obtains the session root j1; Speech signal interaction process: The terminal device f converts the analog voice signal sent by the landline phone f into a digital signal, encrypts the digital signal based on the session root f1, and sends the encrypted digital signal and the encrypted session root f1 to the corresponding intermediate device F; The intermediate device F encapsulates the received encrypted digital signal, converts it into an optical signal, and sends it to the central office device. The encapsulated optical signal carries the identifier of the target terminal device j. The central office device converts the encrypted optical signal into a digital electrical signal, identifies the terminal device f that sent the digital electrical signal, decrypts the encrypted session root f1, decrypts the encrypted optical signal based on the session root f1, identifies the target terminal device j, encrypts the decrypted optical signal using the session root j1, and sends the encrypted optical signal and the encrypted session root j1 to the intermediate device G. The intermediate device G converts the encrypted optical signal into a digital electrical signal, parses the digital electrical signal, and sends it to the terminal device j; Terminal device j decrypts the encrypted session root j1 to obtain session root j1, decrypts the encrypted digital electrical signal through session root j1, converts the decrypted digital electrical signal into an analog signal, and sends it to phone j.

2. The fixed telephone network transmission method based on quantum security enhancement according to claim 1 is characterized in that: The session root f1 and session root j1 are formed based on quantum random numbers.

3. The fixed telephone network transmission method based on quantum security enhancement according to claim 2 is characterized in that: The session roots include: session root f1 and session root j1. The method for generating the session root is as follows: The terminal device or the central office device generates a first quantum random number of a specified length in real time, and uses the first quantum random number as the session root between the corresponding terminal device and the central office device.

4. The fixed telephone network transmission method based on quantum security enhancement according to claim 3 is characterized in that: The method for generating time domain roots is as follows: The local end device periodically generates a second quantum random number of a set length and uses the quantum random number as a time domain root, wherein the generation frequency of the second quantum random number is lower than that of the first quantum random number.

Images