Quantum key distribution system and method
The quantum key distribution system, coordinated by a quantum key service platform and an SDN controller, solves the problems of low efficiency, multiple protocols, and complex operation and maintenance in traditional communication networks, and achieves efficient and secure key distribution and updates.
Patent Information
- Application Number
- CN202411357109.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-26
- Publication Date
- 2025-01-10
AI Technical Summary
Quantum key distribution technology suffers from problems such as high construction costs, low point-to-multipoint communication efficiency, and high network operation and maintenance complexity in traditional communication networks.
The system, consisting of a quantum key service platform, an SDN controller, a route reflector, and multiple routing devices, uses a custom BGP routing message to carry key request information and leverages the SDN controller to coordinate the generation and distribution of quantum keys, thereby achieving secure transmission and updating of quantum keys.
It improves the efficiency of quantum key distribution, simplifies network protocols, reduces operational complexity, and ensures communication security and convenient key distribution.
Smart Images
Figure CN119299086A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communication network technology, and specifically, to a quantum key distribution system and method. Background Art
[0002] In recent years, the development of quantum technology has made great progress and attracted widespread attention. Quantum security cryptography is a technology based on the principles of quantum physics to achieve the goals of classical cryptography. The most representative and practical one is quantum key distribution technology. Quantum security technology has shown broad application prospects in many fields such as finance, government affairs, and transportation.
[0003] However, quantum key distribution technology is currently mainly used within quantum key distribution networks, and there is a lack of effective quantum key-based key negotiation mechanisms in traditional communication networks. The main problems include:
[0004] 1. Generally speaking, quantum key distribution networks need to be built locally, and each communication node needs to be connected to a quantum device, resulting in high construction costs.
[0005] 2. In the traditional way, applying for keys using the HTTPS protocol can only achieve point-to-point key application, which is inefficient in multi-point to multi-point communication private network services.
[0006] 3. The communication network needs to maintain the status of BGP and IKE protocols at the same time, which increases the complexity of network operation.
[0007] In view of the above problems, an innovative method is urgently needed to improve the efficiency of point-to-point key distribution, simplify network protocols, and reduce operation and maintenance complexity.
[0008] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention
[0009] The embodiments of the present application provide a quantum key distribution system and method to at least solve the technical problems of low distribution efficiency, multiple protocols, and complex operation and maintenance when quantum key distribution technology is applied in current communication networks.
[0010] According to one aspect of an embodiment of the present application, a quantum key distribution system is provided, including: a quantum key service platform, an SDN controller, a route reflector, and multiple routing devices, wherein a first routing device whose quantum key is to be updated among the multiple routing devices is used to publish a first BGP routing message, and a custom group attribute of the first BGP routing message includes first key application information of the first routing device; the route reflector is used to send the first BGP routing message to other routing devices among the multiple routing devices; a second routing device whose quantum key is to be updated among the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, and the custom group attribute of the second BGP routing message includes second key application information of the second routing device; the route reflector is further used to send the first BGP routing message and the second BGP routing message to the SDN controller; the SDN controller is used to obtain the first quantum key generated by the quantum key service platform for the first routing device and the second quantum key generated for the second routing device, send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device.
[0011] Optionally, the formats of the custom group attribute, the first response message and the second response message are all type-length-value formats with a length of 32 bits; among them, bits 0-7 represent the message type, and the message type includes one of the following: application message, response message; bit 3 represents the key distribution type; bit 4 represents the key distribution subtype; bit 8 is the link flag, and a link flag of 1 indicates that there is the next custom group attribute or response message, and a link flag of 0 indicates that the current one is the last custom group attribute or response message; bits 9-11 represent the message length; bits 12-31 are the payload, and the payload includes one of the following: key application information and key response information.
[0012] Optionally, the key application information includes: a token for verifying the identity of the routing device, a credential, an authentication key identifier, a secure key medium identifier for identifying a medium in which the routing device stores a quantum key, and the length of the applied quantum key; the key response information includes: a hash value corresponding to the encrypted quantum key, the encrypted quantum key, a decryption algorithm for decrypting the encrypted quantum key, and a decryption key serial number.
[0013] Optionally, the SDN controller is further used to perform legitimacy verification on multiple routing devices, wherein only routing devices that pass the legitimacy verification can publish BGP routing messages.
[0014] Optionally, the SDN controller is used to parse the first key application information in the first BGP routing message, parse the second key application information in the second BGP routing message, and send the first key application information and the second key application information to the quantum key service platform based on the hypertext transfer protocol HTTP or the hypertext transfer security protocol HTTPS; the quantum key service platform is used to respond to the first key application information, generate a first physical true random number as the first quantum key using a quantum key distribution network; respond to the second key application information, generate a second physical true random number as the second quantum key using a quantum key distribution network; send the first quantum key and the second quantum key to the SDN controller based on HTTP or HTTPS; the SDN controller is used to encrypt the first quantum key and the second quantum key respectively using the pre-filled key, write the encrypted first quantum key into the first reply message, write the encrypted second quantum key into the second reply message, send the first reply message to the first routing device based on the network configuration Netconfig protocol or the secure shell SSH protocol, and send the second reply message to the second routing device.
[0015] Optionally, the first routing device is further used to respond to the first reply message, use the pre-filled key to decrypt the encrypted first quantum key, obtain the first quantum key, and store the first quantum key; the second routing device is further used to respond to the second reply message, use the pre-filled key to decrypt the encrypted second quantum key, obtain the second quantum key, and store the second quantum key.
[0016] Optionally, multiple routing devices and the route reflector are in the same autonomous system, and the multiple routing devices and the route reflector communicate based on IBGP; when the SDN controller and the route reflector are in the same autonomous system, the SDN controller and the route reflector communicate based on IBGP; when the SDN controller and the route reflector are in different autonomous systems, the SDN controller and the route reflector communicate based on EBGP.
[0017] According to another aspect of an embodiment of the present application, a quantum key distribution method is also provided, including: when a quantum key needs to be updated, a first routing device publishes a first BGP routing message, wherein a custom group attribute of the first BGP routing message includes first key application information of the first routing device, the first BGP routing message is used to be sent to other routing devices and an SDN controller by a route reflector, a second routing device in other routing devices whose quantum key is to be updated is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes second key application information of the second routing device, and the SDN controller is used to obtain a first quantum key generated by a quantum key service platform for the first routing device, and encrypt the first quantum key; and receiving a first response message carrying the encrypted first quantum key fed back by the SDN controller.
[0018] According to another aspect of an embodiment of the present application, a quantum key distribution method is also provided, including: a second routing device receives a first BGP routing message from a first routing device sent by a route reflector, wherein the custom group attribute of the first BGP routing message includes first key application information of the first routing device; determines whether it needs to update the quantum key, and if the quantum key needs to be updated, publishes a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes second key application information of the second routing device, the route reflector is used to send the second BGP routing message to an SDN controller, the SDN controller is used to obtain a second quantum key generated by a quantum key service platform for the second routing device, and encrypt the second quantum key; receives a second response message carrying the encrypted second quantum key fed back by the SDN controller.
[0019] According to another aspect of an embodiment of the present application, a quantum key distribution method is also provided, including: a route reflector receives a first BGP routing message issued by a first routing device, wherein a custom group attribute of the first BGP routing message includes first key application information of the first routing device; the first BGP routing message is sent to other routing devices, wherein a second routing device to be updated with a quantum key in the other routing devices is used to respond to the first BGP routing message and issue a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes second key application information of the second routing device; the first BGP routing message and the second BGP routing message are sent to an SDN controller, wherein the SDN controller is used to obtain a first quantum key generated by a quantum key service platform for the first routing device and a second quantum key generated for the second routing device, and send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device.
[0020] According to another aspect of an embodiment of the present application, a computer program product is also provided, the computer program product comprising: a computer program, wherein the computer program implements the above-mentioned quantum key distribution method when executed by a processor.
[0021] According to another aspect of an embodiment of the present application, an electronic device is also provided, comprising: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned quantum key distribution method through the computer program.
[0022] In an embodiment of the present application, a quantum key service platform, an SDN controller, a route reflector, and a plurality of routing devices together constitute a quantum key distribution system, wherein a first routing device whose quantum key is to be updated among the plurality of routing devices is used to publish a first BGP routing message, wherein a custom group attribute of the first BGP routing message includes first key application information of the first routing device; the route reflector is used to send the first BGP routing message to other routing devices among the plurality of routing devices; a second routing device whose quantum key is to be updated among the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes second key application information of the second routing device; the route reflector is further used to send the first BGP routing message and the second BGP routing message to the SDN controller; the SDN controller is used to obtain a first quantum key generated by the quantum key service platform for the first routing device and a second quantum key generated for the second routing device, send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device. In this way, the SDN controller, as a centralized decision point, can better coordinate the generation, distribution and update process of quantum keys, improve management efficiency, and quickly respond to network changes. By embedding specific key application information in BGP routing messages, key requirements can be securely transmitted between routing devices. This method not only ensures the security of communication, but also makes the distribution of quantum keys more convenient, thereby solving the technical problems of low distribution efficiency, multiple protocols, and complex operation and maintenance when applying quantum key distribution technology in current communication networks. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0024] Figure 1 is a schematic structural diagram of an optional quantum key distribution system according to an embodiment of the present application;
[0025] Figure 2 It is a schematic diagram of the format of an optional custom group attribute, a first response message, and a second response message according to an embodiment of the present application;
[0026] Figure 3 is a flow chart of an optional quantum key distribution method according to an embodiment of the present application;
[0027] Figure 4 is a flow chart of an optional quantum key distribution method according to an embodiment of the present application;
[0028] Figure 5 is a flow chart of an optional quantum key distribution method according to an embodiment of the present application;
[0029] Figure 6 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION
[0030] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.
[0031] It should be noted that the terms "first", "second", etc. in the specification, claims and drawings of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0032] In order to better understand the embodiments of the present application, some nouns or terms that appear in the description of the embodiments of the present application are first translated and explained as follows:
[0033] SDN (Software-Defined Networking): A new network architecture approach that manages network traffic through a centralized controller, which can simplify network management and operation and provide a more flexible way to allocate network resources. In traditional network architecture, each network device (such as a router or switch) makes independent decisions and handles the forwarding of data packets, while in the SDN architecture, these decisions are made by one or more SDN controllers, which run on standard servers rather than on the network devices themselves. The controller uses open standard interfaces (such as OpenFlow) to communicate with network devices, enabling unified management and configuration of the entire network.
[0034] Autonomous System (AS): A logical division unit in the Internet, which refers to a group of routers managed by a single entity and using a single internal routing selection strategy. The autonomous system is a basic component of the Internet architecture, which allows different network entities (such as Internet service providers, enterprise networks, university networks, etc.) to manage and configure their internal network resources according to their own needs. Each autonomous system has a unique number and can independently decide how to route data packets within it without being affected by the external network.
[0035] BGP (Border Gateway Protocol): One of the routing protocols used in the core of the Internet, mainly used for communication between autonomous systems. The main function of BGP is to exchange reachability and path information between different autonomous systems to ensure that data packets can be correctly transmitted between different parts of the Internet. The working principle of BGP is briefly described as follows: BGP routers establish sessions with BGP routers of other autonomous systems to share network reachability information. When an autonomous system wants to send data to another autonomous system, it uses BGP to determine the best path. BGP uses multiple criteria to select the best path, including path length, priority (local preference), next hop address, etc. BGP supports multiple address families, including IPv4, IPv6, various private address families, etc.
[0036] IBGP (Internal Border Gateway Protocol): A variant of BGP, used to exchange routing information between routers within the same autonomous system. IBGP is used to solve the routing selection problem within the same autonomous system. In IBGP, route reflectors can be used to reduce the need for full connectivity between IBGP neighbors. Route reflectors can replace full mesh connectivity between IBGP neighbors. You only need to configure the selected router as a reflector, and other IBGP routers become clients. Route reflectors reflect the routes learned from the clients to other clients.
[0037] EBGP (External Border Gateway Protocol): A part of BGP, specifically used to exchange routing information between different autonomous systems. Unlike IBGP, EBGP is used to handle routing selection and data packet forwarding between different autonomous systems. EBGP requires a direct physical or logical connection between adjacent BGP peers. Usually, this means that there should be a direct link between EBGP neighbors to ensure reliable transmission of routing information. When selecting a route, EBGP tends to choose a path that passes through the least number of autonomous systems. This is because transmitting data through fewer autonomous systems usually means lower latency and higher reliability.
[0038] Community Attributes: An optional non-transitional attribute in BGP that is used to pass additional information within the network and help implement routing control policies. Community attributes allow network administrators to implement specific behaviors for specific routes, thereby achieving more refined routing control. The standard community attribute is the most commonly used community attribute. The format is represented by a 32-bit number, usually composed of two 16-bit numbers, called the high bit and the low bit. Among them, the high bit usually represents the autonomous system number, and the low bit usually identifies the community attribute value.
[0039] Example 1
[0040] According to an embodiment of the present application, a quantum key distribution system is first provided, such as Figure 1 As shown, the system at least includes: a quantum key service layer, a network operation control layer and a network forwarding layer, the quantum key service layer includes a quantum key service platform 11, the network operation control layer includes an SDN controller 12 and a routing reflector 13, and the network forwarding layer includes multiple routing devices 14 (1-m), wherein,
[0041] A first routing device to be updated with a quantum key among the multiple routing devices is used to publish a first BGP routing message, wherein the custom community attribute of the first BGP routing message includes first key application information of the first routing device;
[0042] The route reflector 13 is used to send the first BGP routing message to other routing devices in the plurality of routing devices;
[0043] A second routing device to be updated with a quantum key among other routing devices, used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom community attribute of the second BGP routing message includes second key application information of the second routing device;
[0044] The route reflector 13 is further configured to send the first BGP routing message and the second BGP routing message to the SDN controller;
[0045] The SDN controller 12 is used to obtain the first quantum key generated by the quantum key service platform 11 for the first routing device and the second quantum key generated for the second routing device, send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device.
[0046] The functions of each module in the quantum key distribution system are explained below in conjunction with the specific implementation process.
[0047] In order to improve the security of the network and prevent unauthorized routing devices from participating in routing decisions, thereby protecting the network from malicious attacks and configuration errors, in an embodiment of the present application, before the routing device publishes a BGP routing message, the SDN controller verifies the legitimacy of multiple routing devices, and only routing devices that pass the legitimacy verification can publish BGP routing messages.
[0048] When the quantum key needs to be updated, the first routing device publishes a first BGP routing message, wherein the custom community attribute of the first BGP routing message includes first key application information of the first routing device.
[0049] The route reflector receives the first BGP routing message issued by the first routing device, and sends the first BGP routing message to other routing devices.
[0050] The second routing device receives the first BGP routing message sent by the route reflector from the first routing device; determines whether it needs to update the quantum key, and if the quantum key needs to be updated, publishes a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes the second key application information of the second routing device.
[0051] The first key application information and the second key application information include: a token for verifying the identity of the routing device, a credential, an authentication key identifier, a secure key medium identifier for identifying the medium in which the routing device stores the quantum key, and the length of the applied quantum key; the key response information includes: a hash value corresponding to the encrypted quantum key, the encrypted quantum key, a decryption algorithm for decrypting the encrypted quantum key, and a decryption key serial number.
[0052] After receiving the first BGP routing message and the second BGP routing message sent by the multiple routing devices, the route reflector sends the first BGP routing message and the second BGP routing message to the SDN controller. The multiple routing devices and the route reflector are in the same autonomous system, and the multiple routing devices and the route reflector communicate based on IBGP; when the SDN controller and the route reflector are in the same autonomous system, the SDN controller and the route reflector communicate based on IBGP; when the SDN controller and the route reflector are in different autonomous systems, the SDN controller and the route reflector communicate based on EBGP.
[0053] The SDN controller parses the first key application information in the first BGP routing message, parses the second key application information in the second BGP routing message, and then sends the first key application information and the second key application information to the quantum key service platform based on the Hypertext Transfer Protocol HTTP or the Hypertext Transfer Security Protocol HTTPS.
[0054] The quantum key service platform responds to the first key application information and generates a first physical true random number as the first quantum key using the quantum key distribution network; responds to the second key application information and generates a second physical true random number as the second quantum key using the quantum key distribution network; and sends the first quantum key and the second quantum key to the SDN controller based on HTTP or HTTPS.
[0055] The SDN controller obtains the first quantum key generated by the quantum key service platform for the first routing device and the second quantum key generated for the second routing device, and then uses the pre-filled key to encrypt the first quantum key and the second quantum key respectively, writes the encrypted first quantum key into the first response message, writes the encrypted second quantum key into the second response message, and then sends the first response message to the first routing device based on the network configuration Netconfig protocol or the secure shell SSH protocol, and sends the second response message to the second routing device.
[0056] The first routing device responds to the first reply message, decrypts the encrypted first quantum key using the pre-filled key, obtains the first quantum key, and stores the first quantum key; the second routing device responds to the second reply message, decrypts the encrypted second quantum key using the pre-filled key, obtains the second quantum key, and stores the second quantum key.
[0057] Among them, the format of the custom group attribute, the first response message and the second response message are all type-length-value format, with a length of 32 bits; among them, the 0th to 7th bits represent the message type, and the message type includes one of the following: application message, response message; the 3rd bit represents the key distribution type; the 4th bit represents the key distribution subtype; the 8th bit is the link flag bit, and the link flag bit is 1 to indicate that there is the next custom group attribute or response message, and the link flag bit is 0 to indicate that the current one is the last custom group attribute or response message; the 9th to 11th bits represent the message length; the 12th to 31st bits are the payload, and the payload includes one of the following: key application information, key response information. The formats of the above custom group attributes, the first response message and the second response message are as follows: Figure 2 As shown, at the same time, Figure 2 The format of the community attribute defined in the RFC1997 document is also given. The length is 32 bits, with bits 0-15 representing the autonomous system AS number and bits 16-32 representing the community attribute value.
[0058] In an embodiment of the present application, a quantum key service platform, an SDN controller, a route reflector, and a plurality of routing devices together constitute a quantum key distribution system, wherein a first routing device whose quantum key is to be updated among the plurality of routing devices is used to publish a first BGP routing message, wherein a custom group attribute of the first BGP routing message includes first key application information of the first routing device; the route reflector is used to send the first BGP routing message to other routing devices among the plurality of routing devices; a second routing device whose quantum key is to be updated among the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes second key application information of the second routing device; the route reflector is further used to send the first BGP routing message and the second BGP routing message to the SDN controller; the SDN controller is used to obtain a first quantum key generated by the quantum key service platform for the first routing device and a second quantum key generated for the second routing device, send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device. In this way, the SDN controller, as a centralized decision point, can better coordinate the generation, distribution and update process of quantum keys, improve management efficiency, and quickly respond to network changes. By embedding specific key application information in BGP routing messages, key requirements can be securely transmitted between routing devices. This method not only ensures the security of communication, but also makes the distribution of quantum keys more convenient, thereby solving the technical problems of low distribution efficiency, multiple protocols, and complex operation and maintenance when applying quantum key distribution technology in current communication networks.
[0059] Example 2
[0060] According to an embodiment of the present application, a quantum key distribution method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0061] Figure 3 is a flow chart of a quantum key distribution method provided according to an embodiment of the present application, such as Figure 3 As shown, the method comprises the following steps:
[0062] Step S302: When the quantum key needs to be updated, the first routing device publishes a first BGP routing message, wherein the custom group attribute of the first BGP routing message includes the first key application information of the first routing device, and the first BGP routing message is used to be sent to other routing devices and the SDN controller by the route reflector, and the second routing device whose quantum key is to be updated in the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes the second key application information of the second routing device, and the SDN controller is used to obtain the first quantum key generated by the quantum key service platform for the first routing device, and encrypt the first quantum key;
[0063] Step S304: receiving a first response message carrying an encrypted first quantum key fed back by the SDN controller.
[0064] The following describes each step of the quantum key distribution method in conjunction with a specific implementation process.
[0065] In order to improve the security of the network and prevent unauthorized routing devices from participating in routing decisions, thereby protecting the network from malicious attacks and configuration errors, in an embodiment of the present application, before the routing device publishes a BGP routing message, the SDN controller verifies the legitimacy of multiple routing devices, and only routing devices that pass the legitimacy verification can publish BGP routing messages.
[0066] When the quantum key needs to be updated, the first routing device publishes a first BGP routing message, wherein the custom community attribute of the first BGP routing message includes first key application information of the first routing device.
[0067] The route reflector receives the first BGP routing message issued by the first routing device, and sends the first BGP routing message to other routing devices and the SDN controller. The second routing device to be updated with the quantum key in the other routing devices is used to respond to the first BGP routing message and issue a second BGP routing message, and the custom group attribute of the second BGP routing message includes the second key application information of the second routing device.
[0068] The first key application information and the second key application information include: a token for verifying the identity of the routing device, a credential, an authentication key identifier, a secure key medium identifier for identifying the medium in which the routing device stores the quantum key, and the length of the applied quantum key; the key response information includes: a hash value corresponding to the encrypted quantum key, the encrypted quantum key, a decryption algorithm for decrypting the encrypted quantum key, and a decryption key serial number.
[0069] After receiving the first BGP routing message sent by the route reflector, the SDN controller parses the first key application information in the first BGP routing message, and then sends the first key application information to the quantum key service platform based on the Hypertext Transfer Protocol HTTP or the Hypertext Transfer Security Protocol HTTPS.
[0070] The quantum key service platform responds to the first key application information and uses the quantum key distribution network to generate a first physical true random number as the first quantum key; then sends the first quantum key to the SDN controller based on HTTP or HTTPS.
[0071] The SDN controller obtains the first quantum key generated by the quantum key service platform for the first routing device, and then encrypts the first quantum key using the pre-filled key, writes the encrypted first quantum key into the first response message, and then sends the first response message to the first routing device based on the network configuration Netconfig protocol or the secure shell SSH protocol.
[0072] The first routing device responds to the first response message, decrypts the encrypted first quantum key using the pre-filled key to obtain the first quantum key, and stores the first quantum key.
[0073] Among them, the formats of the above-mentioned custom group attributes and the first response message are both type-length-value formats with a length of 32 bits; among them, bits 0-7 represent the message type, and the message type includes one of the following: application message, response message; bit 3 represents the key distribution type; bit 4 represents the key distribution subtype; bit 8 is the link flag bit, and a link flag bit of 1 indicates that there is the next custom group attribute or response message, and a link flag bit of 0 indicates that the current one is the last custom group attribute or response message; bits 9-11 represent the message length; bits 12-31 are the payload, and the payload includes one of the following: key application information, key response information.
[0074] It should be noted that the implementation steps of the quantum key distribution method in the embodiment of the present application correspond to the implementation processes of each module in the quantum key distribution system in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1, and will not be repeated here.
[0075] Example 3
[0076] According to an embodiment of the present application, a quantum key distribution method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0077] Figure 4 is a flow chart of a quantum key distribution method provided according to an embodiment of the present application, such as Figure 4 As shown, the method comprises the following steps:
[0078] Step S402: The second routing device receives a first BGP routing message sent by a route reflector from the first routing device, wherein the user-defined community attribute of the first BGP routing message includes first key application information of the first routing device;
[0079] Step S404, determining whether the quantum key needs to be updated, and if the quantum key needs to be updated, publishing a second BGP routing message, wherein the custom community attribute of the second BGP routing message includes the second key application information of the second routing device, and the route reflector is used to send the second BGP routing message to the SDN controller, and the SDN controller is used to obtain the second quantum key generated by the quantum key service platform for the second routing device, and encrypt the second quantum key;
[0080] Step S406: Receive a second response message carrying the encrypted second quantum key fed back by the SDN controller.
[0081] The following describes each step of the quantum key distribution method in conjunction with a specific implementation process.
[0082] In order to improve the security of the network and prevent unauthorized routing devices from participating in routing decisions, thereby protecting the network from malicious attacks and configuration errors, in an embodiment of the present application, before the routing device publishes a BGP routing message, the SDN controller verifies the legitimacy of multiple routing devices, and only routing devices that pass the legitimacy verification can publish BGP routing messages.
[0083] The second routing device receives a first BGP routing message sent by the route reflector from the first routing device, wherein the user-defined community attribute of the first BGP routing message includes first key application information of the first routing device.
[0084] After receiving the first BGP routing message sent by the route reflector from the first routing device, the second routing device determines whether it needs to update the quantum key, and if it needs to update the quantum key, publishes a second BGP routing message, wherein the custom community attribute of the second BGP routing message includes the second key application information of the second routing device.
[0085] The first key application information and the second key application information include: a token for verifying the identity of the routing device, a credential, an authentication key identifier, a secure key medium identifier for identifying the medium in which the routing device stores the quantum key, and the length of the applied quantum key; the key response information includes: a hash value corresponding to the encrypted quantum key, the encrypted quantum key, a decryption algorithm for decrypting the encrypted quantum key, and a decryption key serial number.
[0086] After receiving the second BGP routing message, the route reflector sends the second BGP routing message to the SDN controller.
[0087] The SDN controller parses the second key application information in the second BGP routing message, and then sends the second key application information to the quantum key service platform based on the Hypertext Transfer Protocol HTTP or the Hypertext Transfer Security Protocol HTTPS.
[0088] The quantum key service platform responds to the second key application information and uses the quantum key distribution network to generate a second physical true random number as the second quantum key; then sends the second quantum key to the SDN controller based on HTTP or HTTPS.
[0089] The SDN controller obtains the second quantum key generated by the quantum key service platform for the second routing device, encrypts the second quantum key using the pre-filled key, writes the encrypted second quantum key into the second response message, and then sends the second response message to the second routing device based on the network configuration Netconfig protocol or the secure shell SSH protocol.
[0090] The second routing device responds to the second response message, decrypts the encrypted second quantum key using the pre-filled key, obtains the second quantum key, and stores the second quantum key.
[0091] Among them, the format of the custom group attribute and the second response message are both type-length-value format, with a length of 32 bits; among them, bits 0-7 represent the message type, and the message type includes one of the following: application message, response message; bit 3 represents the key distribution type; bit 4 represents the key distribution subtype; bit 8 is the link flag bit, and the link flag bit is 1 to indicate that there is the next custom group attribute or response message, and the link flag bit is 0 to indicate that the current one is the last custom group attribute or response message; bits 9-11 represent the message length; bits 12-31 are the payload, and the payload includes one of the following: key application information and key response information.
[0092] It should be noted that the implementation steps of the quantum key distribution method in the embodiment of the present application correspond to the implementation processes of each module in the quantum key distribution system in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1, and will not be repeated here.
[0093] Example 4
[0094] According to an embodiment of the present application, a quantum key distribution method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.
[0095] Figure 5 is a flow chart of a quantum key distribution method provided according to an embodiment of the present application, such as Figure 5 As shown, the method comprises the following steps:
[0096] Step S502: The route reflector receives a first BGP routing message issued by a first routing device, wherein the user-defined community attribute of the first BGP routing message includes first key application information of the first routing device;
[0097] Step S504, sending the first BGP routing message to other routing devices, wherein the second routing device whose quantum key is to be updated in the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom community attribute of the second BGP routing message includes the second key application information of the second routing device;
[0098] Step S506: Send the first BGP routing message and the second BGP routing message to the SDN controller, wherein the SDN controller is used to obtain the first quantum key generated by the quantum key service platform for the first routing device and the second quantum key generated for the second routing device, send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device.
[0099] The following describes each step of the quantum key distribution method in conjunction with a specific implementation process.
[0100] In order to improve the security of the network and prevent unauthorized routing devices from participating in routing decisions, thereby protecting the network from malicious attacks and configuration errors, in an embodiment of the present application, before the routing device publishes a BGP routing message, the SDN controller verifies the legitimacy of multiple routing devices, and only routing devices that pass the legitimacy verification can publish BGP routing messages.
[0101] The route reflector receives a first BGP routing message issued by a first routing device, wherein a custom group attribute of the first BGP routing message includes first key application information of the first routing device; and then sends the first BGP routing message to other routing devices, wherein a second routing device whose quantum key is to be updated in the other routing devices is used to respond to the first BGP routing message and issue a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes second key application information of the second routing device.
[0102] The first key application information and the second key application information include: a token for verifying the identity of the routing device, a credential, an authentication key identifier, a secure key medium identifier for identifying the medium in which the routing device stores the quantum key, and the length of the applied quantum key; the key response information includes: a hash value corresponding to the encrypted quantum key, the encrypted quantum key, a decryption algorithm for decrypting the encrypted quantum key, and a decryption key serial number.
[0103] After receiving the first BGP routing message and the second BGP routing message, the route reflector sends the first BGP routing message and the second BGP routing message to the SDN controller.
[0104] After receiving the first BGP routing message and the second BGP routing message, the SDN controller parses the first key application information in the first BGP routing message, parses the second key application information in the second BGP routing message, and then sends the first key application information and the second key application information to the quantum key service platform based on the Hypertext Transfer Protocol HTTP or the Hypertext Transfer Security Protocol HTTPS.
[0105] The quantum key service platform responds to the first key application information and generates a first physical true random number as the first quantum key using the quantum key distribution network; responds to the second key application information and generates a second physical true random number as the second quantum key using the quantum key distribution network; and sends the first quantum key and the second quantum key to the SDN controller based on HTTP or HTTPS.
[0106] The SDN controller obtains the first quantum key generated by the quantum key service platform for the first routing device and the second quantum key generated for the second routing device, and then uses the pre-filled key to encrypt the first quantum key and the second quantum key respectively, writes the encrypted first quantum key into the first response message, writes the encrypted second quantum key into the second response message, and then sends the first response message to the first routing device based on the network configuration Netconfig protocol or the secure shell SSH protocol, and sends the second response message to the second routing device.
[0107] The first routing device responds to the first reply message, decrypts the encrypted first quantum key using the pre-filled key, obtains the first quantum key, and stores the first quantum key; the second routing device responds to the second reply message, decrypts the encrypted second quantum key using the pre-filled key, obtains the second quantum key, and stores the second quantum key.
[0108] Among them, the formats of the custom group attribute, the first response message and the second response message are all type-length-value formats with a length of 32 bits; among them, the 0th to 7th bits represent the message type, and the message type includes one of the following: application message, response message; the 3rd bit represents the key distribution type; the 4th bit represents the key distribution subtype; the 8th bit is the link flag bit, and the link flag bit is 1 to indicate that there is the next custom group attribute or response message, and the link flag bit is 0 to indicate that the current one is the last custom group attribute or response message; the 9th to 11th bits represent the message length; the 12th to 31st bits are the payload, and the payload includes one of the following: key application information and key response information.
[0109] It should be noted that the implementation steps of the quantum key distribution method in the embodiment of the present application correspond to the implementation processes of each module in the quantum key distribution system in Example 1. Since a detailed description has been given in Example 1, some details not reflected in this embodiment can be referred to Example 1, and will not be repeated here.
[0110] Example 5
[0111] According to an embodiment of the present application, a computer program product is also provided, which includes a computer program, wherein when the computer program is executed by a processor, the quantum key distribution method in Example 2, Example 3 or Example 4 is implemented.
[0112] According to an embodiment of the present application, a non-volatile storage medium is also provided, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the quantum key distribution method in Example 2, Example 3 or Example 4 by running the computer program.
[0113] According to an embodiment of the present application, a processor is also provided, which is used to run a computer program, wherein the computer program executes the quantum key distribution method in Example 2, Example 3 or Example 4 when running.
[0114] According to an embodiment of the present application, an electronic device is also provided, which includes: a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the quantum key distribution method in Example 2, Example 3 or Example 4 through the computer program.
[0115] Specifically, when the computer program is running, the following steps can be executed: when the quantum key needs to be updated, the first routing device publishes a first BGP routing message, wherein the custom group attribute of the first BGP routing message includes the first key application information of the first routing device, the first BGP routing message is used to be sent to other routing devices and the SDN controller by the route reflector, and the second routing device whose quantum key is to be updated in the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes the second key application information of the second routing device, and the SDN controller is used to obtain the first quantum key generated by the quantum key service platform for the first routing device, and encrypt the first quantum key; and receive the first response message carrying the encrypted first quantum key fed back by the SDN controller.
[0116] Specifically, when the computer program is running, the following steps can also be executed: the second routing device receives a first BGP routing message from the first routing device sent by the route reflector, wherein the custom group attribute of the first BGP routing message includes the first key application information of the first routing device; determines whether it needs to update the quantum key, and if the quantum key needs to be updated, publishes a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes the second key application information of the second routing device, the route reflector is used to send the second BGP routing message to the SDN controller, the SDN controller is used to obtain the second quantum key generated by the quantum key service platform for the second routing device, and encrypt the second quantum key; receives a second response message carrying the encrypted second quantum key fed back by the SDN controller.
[0117] Specifically, when the computer program is running, the following steps can also be executed: the route reflector receives a first BGP routing message issued by a first routing device, wherein the custom group attribute of the first BGP routing message includes the first key application information of the first routing device; the first BGP routing message is sent to other routing devices, wherein the second routing device whose quantum key is to be updated in the other routing devices is used to respond to the first BGP routing message and issue a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes the second key application information of the second routing device; the first BGP routing message and the second BGP routing message are sent to the SDN controller, wherein the SDN controller is used to obtain the first quantum key generated by the quantum key service platform for the first routing device and the second quantum key generated for the second routing device, and send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device.
[0118] As an optional implementation, the electronic device may be in the form of a mobile terminal, a computer terminal or a similar computing device. Figure 6 FIG. 1 shows a hardware structure block diagram of an electronic device for implementing a quantum key distribution method. Figure 6 As shown, the electronic device 60 may include one or more (602a, 602b, ..., 602n are used to illustrate) processors 602 (the processor 602 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 604 for storing data, and a transmission device 606 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 6 More or fewer components as shown, or with Figure 6 Different configurations are shown.
[0119] It should be noted that the one or more processors 602 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the electronic device 60. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).
[0120] The memory 604 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the quantum key distribution method in the embodiment of the present application. The processor 602 executes various functional applications and data processing by running the software programs and modules stored in the memory 604, that is, realizing the vulnerability detection method of the above-mentioned application. The memory 604 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 604 may further include a memory remotely arranged relative to the processor 602, and these remote memories may be connected to the electronic device 60 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.
[0121] The transmission device 606 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device 60. In one example, the transmission device 606 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 606 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.
[0122] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 60 .
[0123] The serial numbers of the above embodiments are only for description and do not represent the advantages or disadvantages of the embodiments.
[0124] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.
[0125] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.
[0126] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
[0127] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0128] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.
[0129] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.
Claims
1. A quantum key distribution system, characterized in that: include: Quantum key service platform, software defined network SDN controller, route reflector and multiple routing devices, among which, A first routing device whose quantum key is to be updated among the multiple routing devices is used to publish a first Border Gateway Protocol BGP routing message, wherein the custom community attribute of the first BGP routing message includes first key application information of the first routing device; The route reflector is used to send the first BGP routing message to other routing devices among the multiple routing devices; The second routing device whose quantum key is to be updated among the other routing devices is configured to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom community attribute of the second BGP routing message includes the second key application information of the second routing device; The route reflector is further configured to send the first BGP routing message and the second BGP routing message to the SDN controller; The SDN controller is used to obtain a first quantum key generated by the quantum key service platform for the first routing device and a second quantum key generated for the second routing device, send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device.
2. The system according to claim 1, characterized in that The formats of the custom group attribute, the first response message and the second response message are all type-length-value formats with a length of 32 bits; wherein, bits 0-7 represent the message type, and the message type includes one of the following: application message, response message; bit 3 represents the key distribution type; bit 4 represents the key distribution subtype; bit 8 is the link flag bit, and a link flag bit of 1 indicates that there is the next custom group attribute or response message, and a link flag bit of 0 indicates that the current one is the last custom group attribute or response message; bits 9-11 represent the message length; bits 12-31 are the payload, and the payload includes one of the following: key application information and key response information.
3. The system according to claim 2, characterized in that The key application information includes: a token for verifying the identity of the routing device, a credential, an authentication key identifier, a secure key medium identifier for identifying the medium in which the routing device stores the quantum key, and the length of the applied quantum key; The key response information includes: a hash value corresponding to the encrypted quantum key, the encrypted quantum key, a decryption algorithm for decrypting the encrypted quantum key, and a decryption key serial number.
4. The system according to claim 1, characterized in that The SDN controller is further used to perform legitimacy verification on the multiple routing devices, wherein only routing devices that pass the legitimacy verification can publish BGP routing messages.
5. The system according to claim 1, characterized in that The SDN controller is configured to parse the first key application information in the first BGP routing message, parse the second key application information in the second BGP routing message, and send the first key application information and the second key application information to the quantum key service platform based on the hypertext transfer protocol HTTP or the hypertext transfer security protocol HTTPS; The quantum key service platform is used to respond to the first key application information and use a quantum key distribution network to generate a first physical true random number as the first quantum key; In response to the second key application information, using the quantum key distribution network to generate a second physical true random number as the second quantum key; Sending the first quantum key and the second quantum key to the SDN controller based on HTTP or HTTPS; The SDN controller is used to encrypt the first quantum key and the second quantum key respectively by using a pre-filled key, write the encrypted first quantum key into the first response message, write the encrypted second quantum key into the second response message, send the first response message to the first routing device based on a network configuration Netconfig protocol or a secure shell SSH protocol, and send the second response message to the second routing device.
6. The system according to claim 5, characterized in that The first routing device is further configured to respond to the first response message, decrypt the encrypted first quantum key using the pre-filled key to obtain the first quantum key, and store the first quantum key; The second routing device is further configured to respond to the second response message, decrypt the encrypted second quantum key using the pre-filled key to obtain the second quantum key, and store the second quantum key.
7. The system according to any one of claims 1 to 6, characterized in that: The multiple routing devices and the route reflector are in the same autonomous system, and the multiple routing devices communicate with the route reflector based on an internal border gateway protocol (IBGP); When the SDN controller and the route reflector are in the same autonomous system, the SDN controller and the route reflector communicate with each other based on IBGP; In a case where the SDN controller and the route reflector are in different autonomous systems, the SDN controller and the route reflector communicate with each other based on an external border gateway protocol (EBGP).
8. A quantum key distribution method, characterized in that: include: When the quantum key needs to be updated, the first routing device publishes a first BGP routing message, wherein the custom group attribute of the first BGP routing message includes the first key application information of the first routing device, and the first BGP routing message is used to be sent to other routing devices and the SDN controller by the route reflector, and the second routing device whose quantum key is to be updated in the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom group attribute of the second BGP routing message includes the second key application information of the second routing device, and the SDN controller is used to obtain the first quantum key generated by the quantum key service platform for the first routing device, and encrypt the first quantum key; A first response message carrying the encrypted first quantum key fed back by the SDN controller is received.
9. A quantum key distribution method, characterized in that: include: The second routing device receives a first BGP routing message from the first routing device and sent by the route reflector, wherein the custom community attribute of the first BGP routing message includes first key application information of the first routing device; Determine whether it needs to update the quantum key, and if it needs to update the quantum key, publish a second BGP routing message, wherein the custom community attribute of the second BGP routing message includes the second key application information of the second routing device, and the route reflector is used to send the second BGP routing message to the SDN controller, and the SDN controller is used to obtain the second quantum key generated by the quantum key service platform for the second routing device, and encrypt the second quantum key; A second response message carrying the encrypted second quantum key fed back by the SDN controller is received.
10. A quantum key distribution method, characterized in that: include: The route reflector receives a first BGP routing message issued by a first routing device, wherein the custom community attribute of the first BGP routing message includes first key application information of the first routing device; Sending the first BGP routing message to other routing devices, wherein a second routing device whose quantum key is to be updated among the other routing devices is used to respond to the first BGP routing message and publish a second BGP routing message, wherein the custom community attribute of the second BGP routing message includes the second key application information of the second routing device; The first BGP routing message and the second BGP routing message are sent to the SDN controller, wherein the SDN controller is used to obtain a first quantum key generated by a quantum key service platform for the first routing device and a second quantum key generated for the second routing device, send a first response message carrying the encrypted first quantum key to the first routing device, and send a second response message carrying the encrypted second quantum key to the second routing device.
11. A computer program product, characterized in that include: A computer program, wherein when the computer program is executed by a processor, the quantum key distribution method according to any one of claims 8 to 10 is implemented.
12. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the quantum key distribution method according to any one of claims 8 to 10 through the computer program.