Universe quantum security multicast information transmission method

Abstract

The invention discloses a global quantum security multicast information transmission method. The method comprises the following steps: creating a multicast group based on a multicast service; each edge gateway device and the central gateway device download the key file from the key center; the central gateway device associates and stores the IP of the participant and the global quantum service link in a mapping table; the sender user sends the message to be sent, the IP of the sender user and the information of the message receiver user to the application server through the edge gateway equipment and the central gateway equipment; and the application server sends the processed data to each receiver user in the multicast group. According to the invention, users in the multicast group can participate in communication, and the communication data are encrypted and decrypted by using the related secret keys, so that irrelevant personnel are prevented from stealing communication messages; meanwhile, after the key is preset in advance or online preset successfully, service distribution is carried out, no key relay service exists, and normal operation of the high-load-flow service in the global quantum security network is ensured.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to a global quantum secure multicast information transmission method. Background Art

[0002] In a global quantum security environment, quantum encryption services use quantum key encryption services at the edge device end. In addition to transmitting the ciphertext along the original link, it is also necessary to notify the key center to distribute the quantum key to the corresponding client. The client can only obtain information after decrypting the ciphertext with the quantum key and continue business processing.

[0003] If an edge device needs to distribute a message to multiple devices, if unicast is used, each message sent to a device requires key distribution and relay. As the number of devices receiving messages increases and the amount of messages increases, key distribution and relay will become very complicated, resulting in a large amount of key loss and bandwidth load waste. For example: in a group chat service, if user 1 wants to send a message to user 2 and user 3, user 1 sends the message to the edge device, the edge device takes the key to encrypt the message and sends it to the central device, notifies the key center to forward the key to the central device, and the central device obtains the ciphertext / key and performs quantum decryption; subsequent messages are transmitted to user 2 and user 3, and user 2's message will be quantum encrypted, and the key will be relayed by the key center. When the key and ciphertext reach user 2's edge device, quantum decryption will be performed, and user 2 will receive the message and display it. The message sent to user 3 will also relay the key and ciphertext to the edge device connected to user 3, and after decryption by the edge device, the plaintext will be transmitted to user 3 for display.

[0004] Therefore, for one-to-many message encryption transmission services, the increase in network bandwidth brought by key relay and the key consumption of the key center are very huge. To solve this problem, this field urgently needs a multicast information transmission method to solve the problems of bandwidth congestion and huge key consumption, and ensure the normal operation of high-load traffic services in the global quantum security network. Summary of the invention

[0005] Purpose of the invention: The purpose of the present invention is to provide a global quantum security multicast information transmission method, which solves the problem that when messages are distributed to multiple devices in the existing unicast mode, as the number of devices receiving messages increases and the amount of messages increases, the distribution and relay of keys will become very complicated, which will cause a large amount of key loss and bandwidth load waste. Only users in the multicast group of the present invention can participate in the communication, and then use the relevant keys to encrypt and decrypt the communication data, which prevents irrelevant personnel from stealing communication messages; at the same time, the key is preset in advance or the online preset is successful before the service is distributed, and there is no key relay service, which solves the problems of network bandwidth congestion and huge key consumption caused by key relay, and ensures the normal operation of high-load traffic services in the global quantum security network.

[0006] Technical solution: The present invention provides a global quantum secure multicast information transmission method, comprising the following steps:

[0007] (1) A multicast group is created based on the multicast service and the multicast group is marked as g. The multicast group includes multiple users, edge gateway devices corresponding to the users, and a central gateway device connected to the edge gateway devices. One of the users is a sender user, and the other users are receiver users.

[0008] (2) Each edge gateway device and central gateway device downloads the key file from the key center;

[0009] (3) The central gateway device creates a global quantum service link link for this multicast service, associates the IP address of the participant with the global quantum service link link, and stores the associated IP address in a mapping table;

[0010] (4) The sender user sends the message to be sent, its own IP address, and the message recipient user information to the application server via the edge gateway device and the central gateway device;

[0011] (5) The application server sends the processed data data to each receiving user in the multicast group g via the central gateway device and the edge gateway device.

[0012] Further, each edge gateway device and the central gateway device downloads the key file from the key center, which means:

[0013] Each edge gateway device and central gateway device requests a key file from the key center. The request sent by each gateway device to the key center carries the multicast group mark g. The key center responds to the request carrying the mark g and issues a key file, that is, each gateway device in the multicast group downloads the same key file.

[0014] Furthermore, the key file is issued in an offline or online manner.

[0015] Furthermore, the method of issuing the key file is an offline method, which means that the key is taken out from the key center by using an authenticated Ukey or a distributor, and distributed to the key pool of all central gateway devices and edge gateway devices in the multicast group, thereby forming a unified key pool for use in business execution;

[0016] The method of issuing key files is online, which means that when any edge gateway device or central gateway device triggers a request to download the key, the key center distributes the same key to all central gateway devices and edge gateway devices in the multicast group through the Internet communication link and places them in their respective key pools, thereby forming a unified key pool for use when executing the business.

[0017] Furthermore, the specific process of step (3) is as follows:

[0018] The sender user sends his IP to the corresponding edge gateway device in a preset format. The edge gateway device receives and forwards it to the central gateway device. After receiving the data in this format, the central gateway device determines that the sender user's IP is used to apply for multicast services based on the frame type in the preset format, and then uses the sender user's IP as the sender in the global quantum service link link;

[0019] Similarly, the receiving user also sends its own IP to the central gateway device through the corresponding edge gateway device in a preset format. After receiving it, the central gateway device determines that the receiving user's IP is also used to apply for multicast services, and then uses the receiving user's IP as the receiver in the global quantum service link link;

[0020] Then, the IP of the sender user and the IP of the receiver user are associated with the global quantum service link link and stored in the mapping table; at the same time, the label g of the multicast group is associated with the global quantum service link link and stored in the mapping table.

[0021] Furthermore, the preset format includes frame length, frame type, multicast group tag and check code.

[0022] Furthermore, the specific process in which the sender user sends the to-be-sent message mes, its own IP and the message recipient user information to the application server via the edge gateway device and the central gateway device is as follows:

[0023] The sender user sends the message to be sent mes, his own IP and the user information of the message recipient to the corresponding edge gateway device. The edge gateway device obtains the encryption key K1 from the local key pool to encrypt the message to be sent mes and obtains the ciphertext MES. Then, the edge gateway device sends the location information of the encryption key K1, the ciphertext MES, the sender user's IP and the user information of the message recipient to the central gateway device.

[0024] The central gateway device extracts the message recipient user information from the received information, obtains the recipient user's IP according to the message recipient user information, and then matches the global quantum service link link and the multicast group tag g from the mapping table according to the recipient user's IP and the sender user's IP; then, through the multicast group tag g, the central gateway device takes out the decryption key K1′ from the key file related to the multicast group tag g according to the location information of the encryption key K1, decrypts the ciphertext MES, and obtains the plaintext message mes′; the central gateway device associates the plaintext message mes′ with the multicast group tag g and sends it to the application server.

[0025] Furthermore, the specific process of the application server sending the processed data data to each receiving user in the multicast group g via the central gateway device and the edge gateway device is as follows:

[0026] The application server sends the processed data information data to the central gateway device, and also sends the previously associated multicast group tag g to the central gateway device; the central gateway device obtains the second encryption key K2 from the key file related to the multicast group tag g to encrypt the data information data to obtain the ciphertext DATA; and matches the global quantum service link link from the mapping table according to the multicast group tag g, and then sends the ciphertext DATA to the edge gateway device corresponding to each receiving user related to the multicast group tag g according to the global quantum service link link for decryption, and the edge gateway device sends the decrypted data information data′ to the corresponding receiving user.

[0027] Furthermore, the message recipient user information at least includes the recipient user's IP address and the recipient user's multicast group identifier.

[0028] Beneficial effects of the present invention:

[0029] (1) In the present invention, only users in the multicast group can participate in the communication and have the relevant keys to encrypt and decrypt the communication data, thus preventing unauthorized persons from stealing the communication messages.

[0030] (2) In the present invention, the key is preset in advance or preset online successfully before the service is distributed. There is no key relay service during service distribution, which solves the problems of network bandwidth congestion and huge key consumption caused by key relay. In this way, the central gateway device and edge gateway device of the global security network can directly distribute the ciphertext to their respective devices, and complete the current service after decryption with a fixed key, making the multicast service more real-time, with lower latency, easier to obtain user recognition, improving user experience, and ensuring the normal operation of high-load traffic services in the global quantum security network. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a schematic diagram of the global quantum secure multicast information transmission process of the present invention;

[0032] Figure 2 This is a schematic diagram of the structure of the global quantum secure multicast group of the present invention;

[0033] Figure 3 A schematic diagram of each device of the present invention downloading a key file from a key center;

[0034] Figure 4 It is a schematic diagram of the mapping table structure of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be further described below in conjunction with the accompanying drawings and embodiments:

[0036] As described in the background technology, when an existing edge device needs to distribute a message to multiple devices, it adopts a unicast method, that is, each message sent to a device requires key distribution and relay. As the number of device ends receiving messages increases and the amount of messages increases, the distribution and relay of keys will become very complicated. The increase in network bandwidth brought by key relay and the key consumption of the key center are very huge, which will cause a large amount of key loss and bandwidth load waste. In view of this, the present application proposes a global quantum secure multicast information transmission method.

[0037] like Figure 1 As shown, the present invention provides a global quantum secure multicast information transmission method, comprising the following steps:

[0038] (1) A multicast group is created based on the multicast service and the multicast group is marked as g. The multicast group includes multiple users, edge gateway devices corresponding to the users, and a central gateway device connected to the edge gateway devices. The central gateway device is also connected to the application server, such as Figure 2 As shown, one of the users is a sender user, and the other users are receiver users. In this embodiment, user 1 is a sender, and the other users are receivers, forming a one-to-many service relationship in the multicast group.

[0039] (2) Each edge gateway device and central gateway device downloads the key file from the key center;

[0040] Specifically, since each edge gateway device corresponds to multiple users in the multicast group one by one, each edge gateway device and the central gateway device requests the key file from the key center, and each gateway device sends a request to the key center with the multicast group tag g; the key center responds to the request with the tag g and issues the key file, that is, each gateway device in the multicast group downloads the same key file. Of course, the key file requested for the multicast group tag g is associated with the multicast group tag g.

[0041] like Figure 3 As shown, the key center can issue key files in an offline or online manner. The offline method refers to: using a certified Ukey or a distribution machine and other security devices to take out the key from the key center and distribute it to the key pool of all central gateway devices and edge gateway devices in the multicast group, thereby forming a unified key pool for use when executing the business. The online method refers to: when any edge gateway device or central gateway device triggers a key download request, the key center distributes the same key to all central gateway devices and edge gateway devices in the multicast group through the Internet communication link and places it in their respective key pools, thereby forming a unified key pool for use when executing the business.

[0042] In the subsequent business execution process, when the use of the key file in the key pool of any gateway device reaches the preset threshold, the gateway device can request a supplementary key from the key center; at this time, although there is only a key request from this gateway device, when the key center obtains the request carrying the multicast group tag g, it will actively send the supplementary key file to all gateway devices carrying the multicast group tag g. It should be noted that the central gateway device can have different key pools for different multicast groups, such as one multicast group corresponds to one key pool.

[0043] In some embodiments, the order of step (1) and step (2) can be interchanged. If step (2) is performed first, the same key file is preset in the key pool of each device, and then some users are selected from all users to form a multicast group.

[0044] (3) The central gateway device creates a global quantum service link link for this multicast service, associates the IP address of the participant with the global quantum service link link, and stores the associated IP address in a mapping table;

[0045] First, the sender user sends its own IP to the corresponding edge gateway device in a preset format. The edge gateway device receives and forwards it to the central gateway device. After receiving the data in this format, the central gateway device determines that the sender user's IP is used to apply for multicast services according to the frame type in the preset format, and then uses the sender user's IP as the sender in the global quantum service link link; in this embodiment, user 1 is the sender, and it sends its own IP1 to the corresponding edge gateway device in a preset format. The preset format includes frame length, frame type, multicast group tag and check code. The edge gateway device receives the corresponding user 1's IP1 and sends the IP1 to the central gateway device. The central gateway device determines that this IP1 is used to apply for multicast services according to the frame type, and uses this IP1 as the sender in the global quantum service link link, that is, user 1 is the sender;

[0046] Similarly, the receiving user also sends its own IP to the central gateway device via the corresponding edge gateway device in a preset format. After receiving the IP, the central gateway device determines that the receiving user's IP is also used to apply for multicast services, and then uses the receiving user's IP as the receiver in the global quantum service link link; in this embodiment, user 2, user 3, and user 4 are the receivers of this communication service, and IP2, IP3, and IP4 are used as the receivers in the global quantum service link link. At this point, the global quantum service link link is completed, covering the sender IP1 and the receivers IP2, IP3, and IP4 of this multicast service.

[0047] If a new receiver joins, repeat this step, bind the new receiver's IP to link, update the connection relationship of link, and obtain a new global quantum service link link′.

[0048] Then, the IP of the sender user and the IP of the receiver user are associated with the global quantum service link link and stored in the mapping table; at the same time, the tag g of the multicast group is associated with the global quantum service link link and stored in the mapping table. The tag g of the multicast group, the sender IP1 of the multicast service, and the receiver IP2, IP3, and IP4 are associated with the global quantum service link link and stored in the mapping table.

[0049] At the same time, to ensure the smooth progress of the service, the central gateway device forwards the received IP1 to the application server, and the application server adds the IP1 to the application service group. Similarly, user 2, user 3, and user 4, as the recipients of this communication service, also send their own IP2, IP3, and IP4 to the application server via the corresponding edge gateway device and central gateway device, and join the application service group. Here, the application service group is consistent with the participants in the multicast group.

[0050] Since the central gateway device may serve multiple communication services at the same time, the IP in different communication services and the global quantum service link form a binding mapping table, such as Figure 4 shown.

[0051] Through the above steps (1) to (3), the system has completed the preparations for the execution of multicast services, including the creation of multicast groups, key file preparation, and service party association. Only users in the multicast group can participate in the communication and have the relevant keys to encrypt and decrypt the communication data, thus preventing irrelevant personnel from stealing communication messages. The key is preset in advance or the online preset is successful before the service is distributed. In this way, there is no key relay service when distributing the service, which solves the problems of network bandwidth congestion and huge key consumption caused by key relay. The central gateway device and the edge gateway device can directly distribute the ciphertext to their respective devices in the later stage, and complete the current service after decryption with a fixed key, making the multicast service more real-time;

[0052] (4) The sender user sends the message to be sent, its own IP address and the message recipient user information to the application server via the edge gateway device and the central gateway device. The specific process is as follows:

[0053] The sending user, user 1, sends the message to be sent mes, its own IP1 and the message recipient user information to the corresponding edge gateway device. The message recipient user information at least includes the recipient user's IP and the multicast group tag to which the recipient user belongs; the edge gateway device obtains the encryption key K1 from the local key pool to encrypt the message to be sent mes to obtain the ciphertext MES; then, the edge gateway device sends the location information of the encryption key K1, the ciphertext MES, the sender user's IP (that is, user 1's IP1) and the message recipient user information to the central gateway device; since user 1 is the sender in the multicast group, the encryption key used by user 1 must be the key in the communication process of multicast group g.

[0054] The central gateway device extracts the message receiver user information from the received information, obtains the receiver user's IP according to the message receiver user information, and then matches the global quantum service link link and the multicast group tag g from the mapping table according to the receiver user's IP and the sender user's IP. Here, by matching the receiver user's IP and the sender user's IP in the mapping table at the same time, the correctness and security of the matched global quantum service link link and the multicast group tag g can be guaranteed. For example, Figure 4 As shown, the central gateway device learns that the sender is user 1 and the receivers are user 2, user 3, and user 4, then the multicast group matched in the mapping table for this message communication is g1, and accordingly, the global quantum service link for this multicast service is link1.

[0055] Next, through the multicast group tag g, the central gateway device takes out the decryption key K1′ from the key file related to the multicast group tag g according to the location information of the encryption key K1, decrypts the ciphertext MES, and obtains the plaintext message mes′; the central gateway device associates the plaintext message mes′ with the multicast group tag g and sends it to the application server, and the application service performs subsequent processing.

[0056] (5) The application server sends the processed data data to each receiving user in the multicast group g via the central gateway device and the edge gateway device. The specific process is as follows:

[0057] The application server sends the processed data information data to the central gateway device, and also sends the previously associated multicast group tag g to the central gateway device; the central gateway device obtains the second encryption key K2 from the key file related to the multicast group tag g to encrypt the data information data to obtain the ciphertext DATA; and matches the global quantum service link link from the mapping table according to the multicast group tag g, and then sends the ciphertext DATA to the edge gateway device corresponding to each receiving user related to the multicast group tag g according to the global quantum service link link for decryption, and the edge gateway device sends the decrypted data information data′ to the corresponding receiving user.

[0058] Only users in the multicast group of the present invention can participate in communication, and then use relevant keys to encrypt and decrypt communication data, thereby preventing irrelevant personnel from stealing communication messages; at the same time, keys are preset in advance or successfully preset online before service distribution, and there is no key relay service, which solves the problems of network bandwidth congestion and huge key consumption caused by key relay, and ensures the normal operation of high-load traffic services in the global quantum security network.

Claims

1. A global quantum secure multicast information transmission method, characterized in that: The following steps are involved: (1) A multicast group is created based on the multicast service and the multicast group is marked as g. The multicast group includes multiple users, edge gateway devices corresponding to the users, and a central gateway device connected to the edge gateway devices. One of the users is a sender user, and the other users are receiver users. (2) Each edge gateway device and central gateway device downloads the key file from the key center; (3) The central gateway device creates a global quantum service link link for this multicast service, associates the IP address of the participant with the global quantum service link link, and stores the associated IP address in a mapping table; (4) The sender user sends the message to be sent, its own IP address, and the message recipient user information to the application server via the edge gateway device and the central gateway device; (5) The application server sends the processed data data to each receiving user in the multicast group g via the central gateway device and the edge gateway device.

2. A global quantum secure multicast information transmission method according to claim 1, characterized in that: The edge gateway devices and the central gateway device downloading the key file from the key center refers to: Each edge gateway device and central gateway device requests a key file from the key center. The request sent by each gateway device to the key center carries the multicast group mark g. The key center responds to the request carrying the mark g and issues a key file, that is, each gateway device in the multicast group downloads the same key file.

3. A global quantum secure multicast information transmission method according to claim 2, characterized in that: The key file is issued in an offline or online manner.

4. A global quantum secure multicast information transmission method according to claim 3, characterized in that: The method of issuing the key file is an offline method, which means that the key is taken out from the key center by using an authenticated Ukey or a distributor, and distributed to the key pools of all central gateway devices and edge gateway devices in the multicast group, thereby forming a unified key pool for use when executing the service; The method of issuing key files is online, which means that when any edge gateway device or central gateway device triggers a request to download the key, the key center distributes the same key to all central gateway devices and edge gateway devices in the multicast group through the Internet communication link and places them in their respective key pools, thereby forming a unified key pool for use when executing the business.

5. A global quantum secure multicast information transmission method according to claim 1, characterized in that: The specific process of step (3) is as follows: The sender user sends his IP to the corresponding edge gateway device in a preset format. The edge gateway device receives and forwards it to the central gateway device. After receiving the data in this format, the central gateway device determines that the sender user's IP is used to apply for multicast services based on the frame type in the preset format, and then uses the sender user's IP as the sender in the global quantum service link link; Similarly, the receiving user also sends its own IP to the central gateway device through the corresponding edge gateway device in a preset format. After receiving it, the central gateway device determines that the receiving user's IP is also used to apply for multicast services, and then uses the receiving user's IP as the receiver in the global quantum service link link; Then, the IP of the sender user and the IP of the receiver user are associated with the global quantum service link link and stored in the mapping table; at the same time, the label g of the multicast group is associated with the global quantum service link link and stored in the mapping table.

6. A global quantum secure multicast information transmission method according to claim 5, characterized in that: The preset format includes frame length, frame type, multicast group mark and check code.

7. A global quantum secure multicast information transmission method according to claim 5, characterized in that: The specific process of the sender user sending the to-be-sent message mes, its own IP and the message recipient user information to the application server via the edge gateway device and the central gateway device is as follows: The sender user sends the message to be sent mes, its own IP and the user information of the message recipient to the corresponding edge gateway device. The edge gateway device obtains the encryption key K1 from the local key pool to encrypt the message to be sent mes and obtains the ciphertext MES. Then, the edge gateway device sends the location information of the encryption key K1, the ciphertext MES, the sender user's IP, and the message receiver user information to the central gateway device; The central gateway device extracts the message receiver user information from the received information, obtains the receiver user's IP according to the message receiver user information, and then matches the global quantum service link link and the multicast group tag g from the mapping table according to the receiver user's IP and the sender user's IP; then, through the multicast group tag g, the central gateway device takes out the decryption key K1′ from the key file related to the multicast group tag g according to the location information of the encryption key K1, decrypts the ciphertext MES, and obtains the plaintext message mes′; The central gateway device associates the plaintext message mes′ with the multicast group tag g and sends it to the application server.

8. A global quantum secure multicast information transmission method according to claim 7, characterized in that: The specific process of the application server sending the processed data data to each receiving user in the multicast group g via the central gateway device and the edge gateway device is as follows: The application server sends the processed data information data to the central gateway device, and also sends the previously associated multicast group tag g to the central gateway device; the central gateway device obtains the second encryption key K2 from the key file associated with the multicast group tag g to encrypt the data information data to obtain the ciphertext DATA; And according to the multicast group tag g, the global quantum service link link is matched from the mapping table, and then the ciphertext DATA is sent to the edge gateway device corresponding to each receiving user related to the multicast group tag g for decryption according to the global quantum service link link. The edge gateway device sends the decrypted data information data′ to the corresponding receiving user.

9. A global quantum secure multicast information transmission method according to claim 7, characterized in that: The message recipient user information at least includes the recipient user's IP address and the recipient user's multicast group identifier.

Images