Anti-attack global quantum security key supplement method

Abstract

The invention relates to the technical field of information security, in particular to an anti-attack global quantum security key supplement method. According to the scheme of the invention, the access base station is responsible for distributing the key centers for the quantum security terminal, and the distribution mechanism reduces the pressure of a single key center and also reduces the risk of being attacked because an attacker is difficult to predict which key center the terminal is to be connected with. And when receiving the key distribution request, the key center verifies the device ID of the terminal. Only the terminal with the legal device ID can obtain the key, so that the access of the illegal terminal and the key stealing are effectively prevented. An illegal terminal cannot forge a normal key distribution request, and due to the verification of the device ID, even if the quantum security terminal is restarted after distribution, the key can be normally supplemented through re-authentication.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an attack-resistant global quantum security key supplementation method. Background Art

[0002] In the existing global quantum security network, key distribution is usually carried out by the quantum security terminal requesting the access base station to distribute the key. The access base station will select a key center based on the network load and strategy, and request it to distribute the key. After receiving the request, the key center will generate the corresponding key and encryption key, and send the encryption key to the quantum security terminal through the access base station. However, this key distribution method has certain security risks.

[0003] In the prior art, as long as the attacker can obtain the key index, he can obtain the key center information through network messages and try to find the key center corresponding to the key index multiple times, so as to download the key from the key center. Although the keys downloaded by illegal quantum security terminals cannot be used because they do not have the encryption key to decrypt, this download behavior is still a burden on the key center, causing the key center to increase the burden due to useless downloads. Summary of the invention

[0004] To solve the above problems, the present application discloses an attack-resistant global quantum security key supplementation method, comprising the following steps:

[0005] A key center is allocated to a quantum security terminal requesting key allocation through an access base station. The key center establishes a key pool according to the device ID of the quantum security terminal, allocates a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key, wherein the security key includes a key encryption key and a key information encryption key;

[0006] The quantum security terminal sends a key distribution request to the key center according to the acquired key center information, carrying the pool index PID and its own device ID, wherein the device ID is encrypted by the key information encryption key;

[0007] The key center receives the key distribution request from the quantum security terminal, locates the key pool according to the pool index PID, matches the key information encryption key, decrypts to obtain the corresponding device ID, and compares and verifies it with the device ID in the key pool; and after the verification passes, sends a key distribution response message to the quantum security terminal, carrying the communication address assigned to the quantum security terminal, wherein the key distribution response message is sent to the quantum security terminal after quantum encryption;

[0008] The quantum security terminal receives the key distribution response message from the key center, obtains the assigned communication address after decryption using the encryption key, and then constructs a key download request message, which carries the pool index P ID, its own communication address and key index KID, wherein the communication address and key index KID are encrypted again using the key information encryption key;

[0009] The key center receives the key download request message from the quantum security terminal, locates the key pool through the pool index P ID, obtains the corresponding decryption key, decrypts the download request message to obtain the quantum security terminal communication address and key index KID; checks whether the communication address is consistent with the one generated by itself, and after the verification is passed, matches the generated supplementary quantum key based on the key index KID in the key download request message, and sends the supplementary quantum key to the quantum security terminal, wherein the supplementary key is encrypted by the key encryption key and sent to the quantum security terminal in the form of a file stream;

[0010] The quantum security terminal obtains the encrypted supplementary key, and after decrypting the encrypted key, obtains the real supplementary quantum key.

[0011] The key index KID is a hash value of the quantum secure supplementary key file.

[0012] The process of the quantum security terminal acquiring key center information includes:

[0013] The quantum security terminal accesses the quantum security access base station after passing the authentication;

[0014] The quantum security terminal sends a key supplement request carrying the device ID to the access base station; after receiving the request, the access base station selects a key center and sends a key distribution request to the selected key center;

[0015] The key center establishes a key pool according to the terminal device ID, allocates a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key; the pool index PID, the key index KID and the security key are carried in a key distribution response message and sent to the access base station;

[0016] After receiving the key distribution response message, the access base station sends the security key, key index KID, pool index PID and key center information to the quantum security terminal through the key distribution response message in a quantum secure encryption manner;

[0017] The quantum security terminal receives the key distribution response message, decrypts it and obtains the key center information, security key, key index KID, and pool index PID;

[0018] The security key includes a key encryption key and a key information encryption key.

[0019] After receiving the request, the access base station provides a key center corresponding to the quantum security terminal according to load balancing and priority.

[0020] The key encryption key and the key information encryption key are both quantum true random number keys.

[0021] The solution of this application is that the access base station is responsible for allocating key centers to quantum security terminals. This allocation mechanism reduces the pressure on a single key center and also reduces the risk of being attacked, because it is difficult for attackers to predict which key center the terminal will connect to. When the key center receives a key distribution request, it verifies the device ID of the terminal. This ensures that only terminals with legitimate device IDs can obtain keys, thereby effectively preventing access and key theft by illegal terminals. Illegal terminals cannot forge normal key distribution requests, and because the verification is based on the device ID, even if the quantum security terminal is restarted and re-authenticated after allocation, the key can be replenished normally. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a flow chart of the global quantum security key supplement method in the embodiment of the present application;

[0023] Figure 2 This is a schematic diagram of the process of a quantum security terminal obtaining key center information in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0025] Example: Figure 1 As shown, a global quantum security key supplement method that is resistant to attack comprises the following steps:

[0026] S101: allocating a key center to a quantum security terminal requesting key allocation through an access base station, wherein the key center establishes a key pool according to the device ID of the quantum security terminal, allocates a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key, wherein the security key includes a key encryption key and a key information encryption key;

[0027] The pool index PID allocated by the key pool is unique to prevent confusion between different key pools; the generation of the supplementary quantum key should adopt the quantum random number generator (QRNG) to ensure the randomness and unpredictability of the key; the key index KID generated for the supplementary quantum key is also unique, and forms a mapping relationship with the pool index PID to facilitate the rapid retrieval of the key;

[0028] S102: The quantum security terminal sends a key distribution request to the key center according to the acquired key center information, carrying the pool index PID and its own device ID, wherein the device ID is encrypted by the key information encryption key to protect the security of the device ID during transmission;

[0029] S103: The key center receives the key distribution request from the quantum security terminal, locates the key pool according to the pool index P ID, matches the key information encryption key, decrypts to obtain the corresponding device ID, and compares and verifies it with the device ID in the key pool; and after the verification passes, sends a key distribution response message to the quantum security terminal, carrying the communication address allocated to the quantum security terminal, wherein the key distribution response message is sent to the quantum security terminal after quantum encryption;

[0030] When verifying the device ID, hash comparison or other security verification mechanisms can be used to prevent the device ID from being tampered with;

[0031] The device ID is verified through quantum encryption communication, so illegal terminals cannot forge normal key distribution requests, and the device ID is used for verification, so even if the terminal is restarted and re-authenticated after distribution, the key can be replenished normally;

[0032] S104: The quantum security terminal receives the key distribution response message from the key center, obtains the assigned communication address after decryption using the encryption key, and then constructs a key download request message, which carries the pool index PID, its own communication address and key index KID, wherein the communication address and key index KID are encrypted again using the key information encryption key;

[0033] S105: The key center receives the key download request message from the quantum security terminal, locates the key pool through the pool index P ID, obtains the corresponding decryption key, decrypts the download request message to obtain the quantum security terminal communication address and key index KID; checks whether the communication address is consistent with the one generated by itself, and after the verification is passed, matches the generated supplementary quantum key based on the key index KID in the key download request message, and sends the supplementary quantum key to the quantum security terminal, wherein the supplementary key is encrypted by the key encryption key and sent to the quantum security terminal in the form of a file stream;

[0034] S106: The quantum security terminal obtains the encrypted supplementary key, and obtains the real supplementary quantum key after decrypting the encryption key.

[0035] For example, assume there is a quantum security terminal whose device ID is “QTerm12345”;

[0036] The key center establishes a key pool for the terminal, assuming that the pool index P ID is "Pool#001";

[0037] The key center generates four supplementary quantum keys, namely "QKey1", "QKey2", "QKey3", and "QKey4", and the corresponding key indexes KID are "KID001", "KID002", "KID003", and "KID004" respectively;

[0038] For each supplementary quantum key, a transmission key “TransKey1-4” and a key information encryption key “EncKey1-4” are generated;

[0039] By establishing a device-specific key pool, the key management is more targeted;

[0040] The quantum security terminal "QTerm12345" sends a key distribution request to the key center, carrying "Pool#001" and the encrypted device ID;

[0041] Enhanced security of key requests by encrypting device IDs;

[0042] After receiving the request, the key center finds the key pool through "Pool#001", uses "EncKey1-4" to decrypt the device ID, and after verification, sends a quantum encrypted key distribution response message with the assigned communication address "CommAddr#QTerm12345";

[0043] The quantum security terminal decrypts the response message, obtains "CommAddr#QTerm12345", and constructs a key download request message, which carries "Pool#001", "CommAddr#QTerm12345" and the encrypted "KID001-004";

[0044] The key center receives the request, verifies the communication address, matches "KID001", and sends the encrypted "QKey1";

[0045] The quantum security terminal decrypts the file stream and obtains "QKey1".

[0046] The key index KID is the hash value of the quantum security supplementary key file. The device D ID is verified through quantum encryption communication, and the key index KID is used as the hash value of the quantum security supplementary key file to ensure that illegal terminals cannot forge normal key distribution requests.

[0047] like Figure 2 As shown, the process of the quantum security terminal acquiring the key center information includes:

[0048] S201: The quantum security terminal accesses the quantum security access base station after passing the authentication;

[0049] The quantum security terminal can use its unique device ID to authenticate with the quantum security access base station. After the authentication is passed, a secure quantum communication session is established. Authentication ensures that only legitimate terminals can access the network, ensuring the security of the network.

[0050] S202: The quantum security terminal sends a key supplement request carrying a device ID to the access base station; after receiving the request, the access base station selects a key center and sends a key distribution request to the selected key center;

[0051] In one possible implementation, the quantum security terminal generates a key supplement request containing a device ID and a timestamp, signs the request using the terminal's private key to ensure the integrity and authenticity of the request, and sends the request to the access base station; the combination of the device ID and timestamp can prevent replay attacks, and the signature ensures that the source of the request is reliable;

[0052] S203: The key center establishes a key pool according to the terminal device ID, allocates a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key; the pool index PID, the key index KID and the security key are carried in a key distribution response message and sent to the access base station;

[0053] The key center verifies the validity of the terminal device ID and creates a key pool for the terminal, which contains multiple quantum keys; generates a unique key index KID for each quantum key; uses quantum keys to generate security keys, including key encryption keys and key information encryption keys; and packages all information in a key distribution response message;

[0054] The randomness and unpredictability of quantum keys ensure the security of keys, and the key pool and multi-index mechanism improve the flexibility of key management and the ability to replace keys;

[0055] S204: After receiving the key distribution response message, the access base station sends the security key, key index KID, pool index PID and key center information to the quantum security terminal through the key distribution response message in a quantum secure encryption manner;

[0056] The access base station verifies the integrity of the key distribution response message, encrypts the key information using quantum-safe encryption, and sends the encrypted information to the quantum-safe terminal; quantum-safe encryption uses the absolute security of quantum keys to ensure the security of key information during transmission;

[0057] S205: The quantum security terminal receives the key distribution response message, decrypts it and obtains the key center information, security key, key index KID, and pool index P ID, wherein the security key includes a key encryption key and a key information encryption key;

[0058] The quantum security terminal receives the key distribution response message and decrypts it using the pre-shared quantum key, verifies the integrity and authenticity of the message, and stores the key center information, security key, key index KID and pool index PID. The quantum security terminal processes the key information to ensure the confidentiality and integrity of the key.

[0059] After receiving the request, the access base station provides a key center corresponding to the quantum security terminal according to load balancing and priority.

[0060] In the specific scheme, after receiving the key supplement request from the quantum security terminal, the access base station first checks the load in the current system;

[0061] According to the preset load balancing algorithm (such as polling, least number of connections, hashing, etc.), select a key center with a lower load;

[0062] At the same time, the priority of the terminal is considered (which may be based on the terminal type, service level agreement SLA, etc.). If the terminal has a higher priority, a specific or higher priority key center may be selected;

[0063] The selected key center information is recorded in the log of the access base station for subsequent management and auditing;

[0064] Load balancing ensures that the resources of the key center are reasonably allocated to avoid overloading of a single key center. At the same time, the priority mechanism ensures that key businesses can receive timely responses.

[0065] The key encryption key and the key information encryption key are both quantum true random number keys. The process specifically includes: the key center uses a quantum random number generator (QRNG) to generate a set of quantum true random number keys;

[0066] The generated quantum true random number key is divided into two parts: one part is used for the key encryption key (KEK), and the other part is used for the key information encryption key (IEK);

[0067] This ensures that the generated quantum true random number key meets security requirements, such as sufficient randomness and length.

[0068] Quantum true random number keys are generated based on quantum physics phenomena. Their randomness and unpredictability are far higher than traditional pseudo-random numbers, and therefore can provide higher security.

[0069] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A global quantum security key supplementation method that is resistant to attack, characterized in that: The following steps are involved: A key center is allocated to a quantum security terminal requesting key allocation through an access base station. The key center establishes a key pool according to the device ID of the quantum security terminal, allocates a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key, wherein the security key includes a key encryption key and a key information encryption key; The quantum security terminal sends a key distribution request to the key center according to the acquired key center information, carrying the pool index PID and its own device ID, wherein the device ID is encrypted by the key information encryption key; The key center receives the key distribution request from the quantum security terminal, locates the key pool according to the pool index PID, matches the key information encryption key, decrypts to obtain the corresponding device ID, and compares and verifies it with the device ID in the key pool; and after the verification passes, sends a key distribution response message to the quantum security terminal, carrying the communication address assigned to the quantum security terminal, wherein the key distribution response message is sent to the quantum security terminal after quantum encryption; The quantum security terminal receives the key distribution response message from the key center, obtains the assigned communication address after decryption using the encryption key, and then constructs a key download request message, which carries the pool index PID, its own communication address and key index KID, wherein the communication address and key index KID are encrypted again using the key information encryption key; The key center receives the key download request message from the quantum security terminal, locates the key pool through the pool index PID, obtains the corresponding decryption key, decrypts the download request message to obtain the quantum security terminal communication address and key index KID; checks whether the communication address is consistent with the one generated by itself, and after the verification is passed, matches the generated supplementary quantum key based on the key index KID in the key download request message, and sends the supplementary quantum key to the quantum security terminal, wherein the supplementary key is encrypted by the key encryption key and sent to the quantum security terminal in the form of a file stream; The quantum security terminal obtains the encrypted supplementary key, and after decrypting the encrypted key, obtains the real supplementary quantum key.

2. The method according to claim 1, characterized in that The key index KID is a hash value of the quantum secure supplementary key file.

3. The method according to claim 1, characterized in that The process of the quantum security terminal acquiring key center information includes: The quantum security terminal accesses the quantum security access base station after passing the authentication and verification; The quantum security terminal sends a key supplement request carrying the device ID to the access base station; after receiving the request, the access base station selects a key center and sends a key distribution request to the selected key center; The key center establishes a key pool according to the terminal device ID, allocates a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key; the pool index PID, the key index KID and the security key are carried in a key distribution response message and sent to the access base station; After receiving the key distribution response message, the access base station sends the security key, key index KID, pool index PID and key center information to the quantum security terminal through the key distribution response message in a quantum secure encryption manner; The quantum security terminal receives the key distribution response message, decrypts it and obtains the key center information, security key, key index KID, and pool index PID; The security key includes a key encryption key and a key information encryption key.

4. The method according to claim 3, characterized in that After receiving the request, the access base station provides a key center corresponding to the quantum security terminal according to load balancing and priority.

5. The method according to claim 1, characterized in that The key encryption key and the key information encryption key are both quantum true random number keys.

Images