Unicast source global quantum security multicast network communication method and system

Abstract

The invention discloses a unicast source global quantum security multicast network communication method and system. The quantum security multicast source can distribute the target key center for the multicast network to be established through the first access base station accessed in the global quantum security network, and requests the target key center to distribute the multicast group key through the first access base station, so that a source is provided for the multicast group key required by subsequent multicast, and the multicast group key distribution efficiency is improved. And a basis is provided for establishing multicast communication in the global quantum security network. Moreover, when the target key center distributes the multicast group key, the target key center also distributes an encryption key for the multicast group key, so that the encryption transmission of the multicast group key is subsequently realized through the encryption key, and the quantum security multicast source can safely download the multicast group key from the target key center.

Description

Technical Field

[0001] The present application relates to the field of information security and quantum encryption technology, and in particular to a unicast source global quantum secure multicast network communication method and system. Background Art

[0002] The global quantum secure communication solution is proposed to build a communication network that is both seamlessly covered and highly flexible. The core idea of ​​this solution is to use the access base station as a communication hub to achieve key relay between terminals connected to the quantum secure network, thereby ensuring that quantum secure terminals in any geographical location can achieve secure and efficient quantum communication.

[0003] In the global quantum secure communication solution, the encryption end's key is relayed in the global quantum secure network through the access base station to which the encryption end is connected, and finally reaches the access base station of the decryption end, which forwards the key to the decryption end. This key relay process ensures that a symmetric quantum secure key can be formed between the encryption end and the decryption end, thereby achieving encryption and decryption communication.

[0004] Among them, during the implementation of the global quantum secure communication solution, the two ends of direct communication, for example, between the quantum security terminal and the access base station, and between the access base stations, adopt a symmetric encryption method based on a true random number one-time key. This symmetric encryption method requires that only the two ends of direct communication have a unique true random number symmetric key to ensure the privacy of communication.

[0005] However, in a multicast network with a unicast source, the global quantum secure communication solution faces certain challenges. A multicast network is an efficient way of data transmission. Through the data sent by a sending source, the multicast message is sent to all members of the quantum secure multicast group at the same time using the multicast address. In global quantum secure communication, if all multicast members in a quantum secure multicast group are to be able to decrypt the global quantum secure encrypted multicast message, then each multicast member needs to hold the decryption key. This obviously contradicts the confidentiality principle of the global quantum secure communication mentioned above.

[0006] Multicast is widely used in daily applications, such as command issuance, video live broadcast, multimedia classroom, etc. Therefore, how to solve the application problems in multicast networks while maintaining the advantages of the global quantum secure communication solution is the focus of current research. Summary of the invention

[0007] The present application provides a unicast source global quantum secure multicast network communication method and system for realizing the establishment of a multicast network in a global quantum secure network.

[0008] In a first aspect, the present application provides a unicast source global quantum secure multicast network communication method, the method comprising:

[0009] The quantum secure multicast source initiates a key request message to the first access base station to which it is connected; wherein the key request message carries a multicast address and a key type identifier representing a multicast group key;

[0010] The first access base station receives the key request message; determines a target key center corresponding to the multicast address; and sends a key distribution request to the target key center; wherein the key distribution request carries the multicast address and the key type identifier;

[0011] The target key center receives the key distribution request; generates a multicast group key corresponding to the multicast address and an encryption key corresponding to the multicast group key when determining that the key type identifier carried in the key distribution request represents a multicast group key; and sends a key distribution response carrying the encryption key to the first access base station;

[0012] The first access base station receives the key distribution response; based on the symmetric key with the quantum secure multicast source, encrypts and sends a key response message to the quantum secure multicast source; wherein the key response message carries the address information of the target key center and the encryption key;

[0013] The quantum secure multicast source decrypts the received encrypted key response message based on the symmetric key with the first access base station to obtain the address information and the encryption key; based on the address information, downloads the encrypted multicast group key corresponding to the multicast address from the target key center; based on the encryption key, decrypts the encrypted multicast group key, obtains the multicast group key and saves it; and determines that the quantum secure multicast group of the multicast address has been established.

[0014] In a second aspect, the present application also provides a unicast source global quantum secure multicast network communication system, the system comprising a quantum secure multicast source, a first access base station, and a target key center for executing the above-mentioned method.

[0015] The beneficial effects of this application are as follows:

[0016] Since the quantum secure multicast source can allocate the target key center for the multicast network to be established through the first access base station it accesses in the global quantum secure network, and request the target key center to allocate the multicast group key through the first access base station, it provides a source for the multicast group key required for subsequent multicasts, and provides a basis for establishing multicast communication in the global quantum secure network. In addition, the target key center allocates an encryption key for the multicast group key while allocating the multicast group key, so that the encryption key can be used to realize the encrypted transmission of the multicast group key, and the quantum secure multicast source can safely download the multicast group key from the target key center. Since the target key center sends the encryption key to the quantum secure multicast source through the first access base station, and the first access base station encrypts the encryption key and the address information of the target key center and sends them to the quantum secure multicast source through the symmetric key with the quantum secure multicast source, the security of the encryption key and the address information is further guaranteed, and the reliability and security of the subsequent download of the multicast group key are enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0018] Figure 1 A schematic diagram of a unicast source global quantum secure multicast network communication method process provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of a specific unicast source global quantum secure multicast network communication method flow chart provided in an embodiment of the present application;

[0020] Figure 3 This is a system structure diagram of a unicast source global quantum secure multicast network communication provided in this application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0022] The global quantum security network can support secure and efficient quantum communication between any quantum security terminals connected to the network, regardless of their geographical location. A core of the global quantum security network is to use the access base station as a communication hub to connect quantum security terminals to the global quantum security network, and to achieve key relay between terminals connected to the global quantum security network.

[0023] During the access process, when a quantum security terminal accesses an access base station, the access base station will assign a network access identifier to the terminal, that is, a unique terminal identifier for the entire global quantum security network, which is used to identify the terminal. The network access identifier carries information about the country, operator, region, cell, access base station, and terminal. With this network access identifier, the terminal can be identified in the global quantum security network through this network access identifier within the time range that the terminal has this identifier. Subsequently, the quantum security terminal can apply for services and request resources from the global quantum security network through the access base station.

[0024] During the key relay process, the encryption end will relay the key through the encryption end access base station through the global quantum security network to the access base station of the decryption end, and then the decryption end access base station will forward the key to the decryption end, so as to ensure that a symmetric quantum security key is formed between the encryption end and the decryption end, and encryption and decryption communication can be achieved. The global quantum security network also includes a key center, which mainly distributes keys, i.e. quantum keys, to quantum security terminals connected to the global quantum security network.

[0025] In the above-mentioned global quantum security network, the two ends of direct communication, for example, between a quantum security terminal and an access base station, or between access base stations, use a symmetric encryption method based on a true random number one-time key. This symmetric encryption method requires that only the two ends of direct communication have a unique true random number symmetric key to ensure the privacy of the communication.

[0026] Multicast is widely used in daily applications, such as command issuance, video live broadcast, multimedia classroom and other scenarios. Multicast network is an efficient data transmission method. Through the data sent by a sending source, the multicast message is sent to all members of the quantum security multicast group at the same time using the multicast address. However, in the global quantum security network, it is not an easy task to implement multicast. In order to achieve that all multicast members in a quantum security multicast group will be able to decrypt the global quantum security encrypted multicast message, each multicast member needs to hold the decryption key. This obviously contradicts the confidentiality principle of the symmetric encryption method based on true random numbers and one-time secrets in the above-mentioned global quantum security communication.

[0027] Based on this, the present application provides a unicast source global quantum secure multicast network communication method and system to realize the establishment of a multicast network in a global quantum secure network.

[0028] Embodiment 1:

[0029] Figure 1 A schematic diagram of a unicast source global quantum secure multicast network communication method process provided in an embodiment of the present application, the process comprising:

[0030] S101: A quantum secure multicast source initiates a key request message to a first access base station to which it is connected; wherein the key request message carries a multicast address and a key type identifier representing a multicast group key.

[0031] In the present application, the quantum security multicast source can be any quantum security terminal in the global quantum security network. The quantum security terminal can be a client such as a quantum security all-in-one machine, a quantum security privacy computer, etc., or a server such as a quantum security application server, a quantum security business server, etc.

[0032] In this application, for a global quantum security unicast source multicast network, a quantum security terminal must first become a legal member of the global quantum security network before becoming a multicast member (including quantum security multicast source and multicast group member) in the global quantum security unicast source multicast network. In other words, any quantum security terminal needs to successfully access the access base station in the global quantum security network before participating in the global quantum security unicast source multicast activity and become an effective part of the global quantum security network. Exemplarily, after the quantum security terminal is powered on, it first initiates an access request to the access base station it accesses. After authentication and authorization by the access base station, the quantum security terminal can securely access the global quantum security network and request the quantum security services provided by the global quantum security network, such as key relay services, key supplement services, etc.

[0033] It should be noted that the specific process of the quantum security terminal connecting to the global quantum security network can refer to the technical solutions in patents such as application numbers CN202310087005.1, CN202210875414.3, and CN202210875431.7, which will not be described in detail here.

[0034] For a quantum secure multicast source in a global quantum secure unicast source multicast network, before the quantum secure multicast source needs to communicate in a unicast source global quantum secure multicast network, it is first necessary to establish a quantum secure multicast group, that is, to establish a global quantum secure unicast source multicast network. The quantum secure multicast group may contain only a quantum secure multicast source, or may contain a quantum secure multicast source and at least one multicast group member. In the process of establishing a global quantum secure unicast source multicast network, the quantum secure multicast source may allocate a key center (referred to as a target key center) to the multicast network to be established through an access base station (referred to as a first access base station) accessed by the quantum secure multicast source, and request the target key center to allocate a multicast group key to the multicast network, so that the subsequent multicast messages transmitted are encrypted based on the multicast group key.

[0035] Exemplarily, a quantum secure multicast source may initiate a key request message to the first access base station to which it is connected. The key request message carries a multicast address and a key type identifier. The multicast address is used to identify a specific quantum secure multicast group. The multicast address may be displayed by an IP address, and the IP address range is within a specific IP address block, which is reserved for multicast communication. For example, in the IPv4 communication protocol, an IPv4 multicast address may be 239.255.255.250. For another example, in the IPv6 communication protocol, the multicast address may be FF02::1:FF00:0 / 104. The key type identifier is used to indicate the required key type, which refers to the multicast group key. The display form of the key type identifier may vary according to different protocols or implementations. For example, the key type identifier may be a numerical value, such as 1 for the key required for point-symmetric encryption, 2 for the multicast group key, etc. For another example, the key type identifier may also be a string used to uniquely identify the type of key, such as "GROUP_KEY" for the multicast group key.

[0036] S102: The first access base station receives the key request message; determines a target key center corresponding to the multicast address; and sends a key distribution request to the target key center; wherein the key distribution request carries the multicast address and the key type identifier.

[0037] Based on the above embodiment, the first access base station can receive a key request message sent by a quantum secure multicast source. The first access base station can parse the key request message to obtain the multicast address and key type identifier carried in the key request message. Then, a target key center supporting multicast is assigned to the multicast address, and the address information of the target key center is obtained. A key distribution request is generated according to the multicast address and the key type identifier representing the multicast group key. The key distribution request is sent to the target key center to request the target key center to distribute a quantum key for multicast to the quantum secure multicast group of the multicast address.

[0038] In a possible implementation, the first access base station may determine whether the key type identifier represents a multicast group key after acquiring the key type identifier. The first access base station determines that the key type identifier represents a multicast group key before subsequently determining a target key center corresponding to the multicast address.

[0039] In one example, the first access base station can obtain a key center information library configured by a network management system. The key center information library records detailed information such as the address information of at least one key center, the supported key types, whether the multicast function is supported, and the key centers corresponding to each pre-configured multicast address. After the first access base station receives the key request message, it can query the key center information library. During the query process, the first access base station determines the target key center corresponding to the multicast address carried in the key request message from the key centers corresponding to each pre-configured multicast address.

[0040] S103: The target key center receives the key distribution request; upon determining that the key type identifier carried in the key distribution request represents a multicast group key, generates a multicast group key corresponding to the multicast address and an encryption key corresponding to the multicast group key; and sends a key distribution response carrying the encryption key to the first access base station.

[0041] Based on the above embodiment, the target key center can receive a key distribution request sent by the first access base station. The target key center can parse the key distribution request and obtain the key type identifier and multicast address carried in the key distribution request. When the target key center determines that the key type identifier represents a multicast group key, it can establish a corresponding multicast key pool for the multicast address and generate a multicast group key corresponding to the multicast address in the multicast key pool, so that the transmission of subsequent multicast messages can use the multicast group key for quantum encryption.

[0042] In order to ensure the security of the process in which multicast members in the global quantum secure unicast source multicast network download the multicast group key from the target key center, in this application, the target key center will also generate a corresponding encryption key for the multicast group key, so as to encrypt and transmit the multicast group key through the encryption key. When the target key center generates and saves the multicast group key corresponding to the multicast address and the encryption key corresponding to the multicast group key, a key distribution response carrying the encryption key can be sent to the first access base station, so as to forward the encryption key to the quantum secure multicast source through the first access base station.

[0043] S104: The first access base station receives the key distribution response; based on the symmetric key with the quantum secure multicast source, encrypts and sends a key response message to the quantum secure multicast source; wherein the key response message carries the address information of the target key center and the encryption key.

[0044] Once the first access base station receives the key distribution response sent by the target key center, it can parse the key distribution response and extract the encryption key carried in the key distribution response. Subsequently, the first access base station can notify the quantum secure multicast source of the encryption key and the address information of the target key center.

[0045] In a possible implementation, after the quantum secure multicast source obtains the encryption key, it can determine whether the encryption key passes the security check. Exemplarily, the security check includes one or more of the following:

[0046] 1. Integrity check

[0047] To ensure that the encryption key is not tampered with or damaged during transmission or storage, in this application, the quantum secure multicast source can perform an integrity check on the received encryption key. For example, by performing a hash check on the encryption key, it is determined whether the encryption key passes the integrity check. If the encryption key passes the integrity check, the quantum secure multicast source retains the encryption key; if the encryption key does not pass the integrity check, the quantum secure multicast source discards the encryption key.

[0048] 2.Consistency check

[0049] To prevent errors or inconsistencies in the encryption key during distribution or storage, the quantum secure multicast source can also perform consistency check on the encryption key with the first access base station. For example, the quantum secure multicast source can compare the hash value of the encryption key with the hash value of the encryption key received by the first access base station to determine whether the encryption key meets the consistency check. If the encryption key passes the consistency check, the quantum secure multicast source retains the encryption key; if the encryption key fails the consistency check, the quantum secure multicast source discards the encryption key.

[0050] It should be noted that the method for the quantum secure multicast source to perform security verification on the encryption key may include one or more of the above. In the case where the security verification includes the above multiple verification methods, that is, the security of the encryption key is ensured by combining integrity verification and consistency verification, the quantum secure multicast source first ensures that the encryption key has not been tampered with during transmission or storage through integrity verification; then, the consistency between the encryption key and the encryption key generated by the target key center is ensured through consistency verification. If the encryption key passes both checks at the same time, it can be considered that the encryption key is safe and reliable and can be used for subsequent encrypted communications. If the encryption key fails any of the checks, then corresponding security measures need to be taken, such as discarding the encryption key, re-requesting the encryption key, or reporting a security incident.

[0051] Considering the security of the communication between the first access base station and the quantum secure multicast source, and in the global quantum secure network, a paired symmetric key is stored between any quantum secure terminal and the access base station to which it is connected. Therefore, in order to ensure that the first access base station can securely send the encryption key to the quantum secure multicast source, in this application, the first access base station can use the symmetric key paired with the quantum secure multicast source to encrypt and send the key response message carrying the encryption key and the address information of the target key center to the quantum secure multicast source, thereby avoiding the encryption key being directly exposed in plain text in the network.

[0052] S105: The quantum secure multicast source decrypts the received encrypted key response message based on the symmetric key with the first access base station to obtain the address information and the encryption key; based on the address information, downloads the encrypted multicast group key corresponding to the multicast address from the target key center; based on the encryption key, decrypts the encrypted multicast group key, obtains the multicast group key and saves it; and determines that the quantum secure multicast group of the multicast address has been established.

[0053] If the quantum secure multicast source receives the encrypted key response message sent by the first access base station, it can obtain the symmetric key with the first access base station, and then decrypt the encrypted key response message according to the symmetric key to obtain the address information and encryption key of the target key center. Once the quantum secure multicast source obtains the address information of the target key center and the encryption key assigned by the target key center through the first access base station, it can generate a key download request. Among them, the key download request carries the multicast address. Then, according to the address information, the key download request is sent to the target key center to download the multicast group key corresponding to the multicast address from the target key center.

[0054] After receiving the key download request sent by the quantum secure multicast source, the target key center can parse the key download request and extract the multicast address carried in the key download request. Then, based on the multicast address, the target key center searches for the multicast key pool previously established for the multicast address and obtains the multicast group key corresponding to the multicast address and the encryption key corresponding to the multicast group key from the multicast key pool. Based on the encryption key, the target key center encrypts the multicast group key and transmits it to the quantum secure multicast source.

[0055] When the quantum secure multicast source receives the encrypted multicast group key sent by the target key center, it can decrypt the encrypted multicast group key based on the encryption key corresponding to the multicast group key stored locally to obtain and save the multicast group key required for multicast.

[0056] In a possible implementation, after the quantum secure multicast source obtains the multicast group key, it may perform a security check on the multicast group key, and if it is determined that the multicast group key passes the security check, the multicast group key is saved.

[0057] It should be noted that the method of performing security verification on the multicast group key is similar to the method of performing security verification on the encryption key in the above embodiment, and will not be described in detail here.

[0058] At this point, the global quantum secure unicast source multicast network has been established.

[0059] The beneficial effects of this application are as follows:

[0060] Since the quantum secure multicast source can allocate the target key center for the multicast network to be established through the first access base station it accesses in the global quantum secure network, and request the target key center to allocate the multicast group key through the first access base station, it provides a source for the multicast group key required for subsequent multicasts, and provides a basis for establishing multicast communication in the global quantum secure network. In addition, the target key center allocates an encryption key for the multicast group key while allocating the multicast group key, so that the encryption key can be used to realize the encrypted transmission of the multicast group key, and the quantum secure multicast source can safely download the multicast group key from the target key center. Since the target key center sends the encryption key to the quantum secure multicast source through the first access base station, and the first access base station encrypts the encryption key and the address information of the target key center and sends them to the quantum secure multicast source through the symmetric key with the quantum secure multicast source, the security of the encryption key and the address information is further guaranteed, and the reliability and security of the subsequent download of the multicast group key are enhanced.

[0061] Embodiment 2:

[0062] In order to securely join the established global quantum secure unicast source multicast network, based on the above embodiment, in this application, the method further includes:

[0063] For any quantum security terminal to be added to the quantum security multicast group, a request to join the multicast is initiated to the second access base station to which it is connected; wherein the request to join the multicast carries the multicast address;

[0064] The second access base station receives the joining multicast request; determines the target key center based on the multicast address; and sends the multicast group key request carrying the multicast address to the target key center;

[0065] The target key center receives the multicast group key request; determines the multicast group key corresponding to the multicast address and the encryption key corresponding to the multicast group key; and sends a multicast group key response carrying the encryption key to the second access base station;

[0066] The second access base station receives the multicast group key response; based on the symmetric key with the quantum security terminal, encrypts and sends a join multicast response to the quantum security terminal; wherein the join multicast response carries the address information of the target key center and the encryption key;

[0067] The quantum security terminal decrypts the received encrypted join multicast response based on the symmetric key with the second access base station to obtain the address information and the encryption key; based on the address information, downloads the encrypted multicast group key corresponding to the multicast address from the target key center; based on the encryption key, decrypts the encrypted multicast group key, obtains the multicast group key and saves it; and determines that the quantum security terminal has become a multicast member in the quantum security multicast group.

[0068] For any quantum security terminal in the global quantum security network, if the quantum security terminal wishes to join an established quantum security multicast group, that is, to become a multicast member in a quantum security multicast group, and receive multicast messages transmitted by quantum security multicast sources in the quantum security multicast group through quantum encryption, it is necessary to first obtain the multicast group key of the quantum security multicast group. Based on this, for any quantum security terminal to be added to the quantum security multicast group, the multicast address of the quantum security multicast group can be obtained. Then, a join multicast request carrying the multicast address is sent to the access base station (referred to as the second access base station) to which the quantum security terminal accesses.

[0069] After receiving the join multicast request, the second access base station can parse the join multicast request and extract the multicast address carried in the join multicast request. Then, from the key centers corresponding to the pre-configured multicast addresses, it is queried whether there is a target key center corresponding to the multicast address carried in the join multicast request. If it is determined that there is a target key center corresponding to the multicast address, it means that there is a quantum secure multicast group corresponding to the multicast address, and the address information of the target key center is obtained. According to the address information, the multicast group key request carrying the multicast address is sent to the target key center. If it is determined that there is no target key center corresponding to the multicast address, it means that the quantum secure multicast group corresponding to the multicast address has not been established, and a join failure response can be generated and sent to the multicast member.

[0070] In a possible implementation manner, after the second access base station receives the multicast join request and before determining the target key center based on the multicast address, the method further includes:

[0071] The second access base station obtains the identity information of the quantum security terminal from the join multicast request; and determines, based on the identity information, whether the quantum security terminal has the authority to join the quantum security multicast group.

[0072] In order to ensure the legitimacy of the quantum security terminal joining the quantum security multicast group, in the present application, the second access base station can verify the identity information of the quantum security terminal requesting to join, so as to determine that the quantum security terminal has the authority to join the quantum security multicast group. Wherein, the identity information may include but is not limited to: MAC address, IP address, network access identification or other security credentials that can be used to verify the identity. Exemplarily, after receiving the request to join the multicast, the second access base station can obtain the multicast address and the identity information of the quantum security terminal that sent the request to join the multicast from the request to join the multicast. In the case where the quantum security multicast group corresponding to the multicast address is queried from the network management configuration according to the multicast address, based on the identity information, it is determined whether the quantum security terminal meets the joining conditions of joining the quantum security multicast group. Wherein, the joining conditions can be in various forms, including but not limited to: the identity information of the multicast member is the identity information authorized to join the quantum security multicast group, the identity information of the multicast member is not the identity information rejected to join the quantum security multicast group, and the number of times the identity information joins the quantum security multicast group in a unit time period is less than the preset number threshold, etc. If, based on the identity information, it is determined that the quantum security terminal meets the conditions for joining the quantum security multicast group, it means that the quantum security terminal has the authority to join the quantum security multicast group, and then the target key center is determined according to the multicast address. If, based on the identity information, it is determined that the quantum security terminal does not meet the conditions for joining the quantum security multicast group, it means that the quantum security terminal is illegal and does not have the authority to join the quantum security multicast group, then the quantum security terminal is refused to respond.

[0073] Based on the above embodiment, the target key center can receive the multicast group key request sent by the second access base station, parse the multicast group key request, and obtain the multicast address carried in the multicast group key. Then, according to the multicast address, find the multicast key pool previously established for the multicast address, and obtain the encryption key corresponding to the multicast group key from the multicast key pool. Then, send the multicast group key response carrying the encryption key to the second access base station, so that the encryption key is forwarded to the multicast member to be joined through the second access base station.

[0074] Once the second access base station receives the multicast group key response sent by the target key center, it can parse the multicast group key response and extract the encryption key carried in the multicast group key response. Subsequently, the second access base station can notify the quantum security terminal of the encryption key and the address information of the target key center.

[0075] Considering the security of the communication between the second access base station and the quantum security terminal, and in the global quantum security network, a paired symmetric key is stored between any quantum security terminal and the access base station to which it is connected. Therefore, in order to ensure that the second access base station can safely send the encryption key to the quantum security terminal, in this application, the second access base station can use the symmetric key paired with the quantum security terminal to encrypt and send the join multicast response carrying the encryption key and the address information of the target key center to the quantum security terminal, thereby avoiding the encryption key being directly exposed in plain text in the network.

[0076] If the quantum security terminal receives the encrypted join multicast response sent by the second access base station, it can obtain the symmetric key with the second access base station, and then decrypt the encrypted join multicast response according to the symmetric key to obtain the address information and encryption key of the target key center. Once the quantum security terminal obtains the address information of the target key center and the encryption key assigned by the target key center through the second access base station, it can generate a key download request. Among them, the key download request carries the multicast address. Then, according to the address information, the key download request is sent to the target key center to download the multicast group key corresponding to the multicast address from the target key center.

[0077] It should be noted that the quantum security terminal will also perform security verification on the received encryption key. The security verification process can refer to the process of security verification of the encryption key by the above-mentioned quantum security multicast source, which will not be repeated here.

[0078] After receiving the key download request sent by the quantum security terminal, the target key center can parse the key download request and extract the multicast address carried in the key download request. Then, based on the multicast address, the target key center searches for the multicast key pool previously established for the multicast address and obtains the multicast group key corresponding to the multicast address and the encryption key corresponding to the multicast group key from the multicast key pool. Based on the encryption key, the target key center encrypts the multicast group key and transmits it to the quantum security terminal.

[0079] When the quantum security terminal receives the encrypted multicast group key sent by the target key center, it can decrypt the encrypted multicast group key based on the encryption key corresponding to the multicast group key stored locally to obtain and save the multicast group key required for multicast.

[0080] It should be noted that the quantum security terminal will also perform security verification on the received multicast group key. The security verification process is similar to the process of security verification of the encryption key by the above-mentioned quantum security multicast source, and will not be repeated here.

[0081] At this point, the quantum security terminal has successfully joined the quantum security multicast group and become a member of the quantum security multicast group. Subsequently, based on the multicast group key and multicast address, the quantum security multicast source quantum encrypted multicast message in the quantum security multicast group can be obtained.

[0082] Embodiment 3:

[0083] In order to realize quantum encrypted transmission of multicast messages, based on the above embodiments, in this application, the method further includes:

[0084] The quantum secure multicast source obtains a multicast message; based on the multicast group key stored locally, the multicast message is encrypted; through a traditional network, according to the multicast address, the encrypted multicast message is sent to each multicast member who joins the quantum secure multicast group;

[0085] For each of the multicast group members, the encrypted multicast message is received; based on the multicast group key stored locally, the encrypted multicast message is decrypted to obtain the multicast message.

[0086] After the quantum security multicast source successfully establishes a quantum security multicast group in the global quantum security network, the quantum security terminal joins the quantum security multicast group, and the quantum security multicast source and all multicast group members of the global quantum security unicast source multicast network have the multicast group key, then the quantum security multicast source can send quantum encrypted multicast messages to the multicast group members in the quantum security multicast group. Exemplarily, when the quantum security multicast source obtains a multicast message of a quantum security multicast group to be multicasted to a certain multicast address, it can obtain the multicast group key corresponding to the multicast address stored locally. Then, based on the multicast group key, the multicast message is quantum encrypted to obtain an encrypted multicast message. Through the traditional network, the encrypted multicast message is sent according to the multicast address to transmit the encrypted multicast message to each multicast group member who has joined the quantum security multicast group.

[0087] For any multicast member in the quantum secure multicast group, after successfully joining the quantum secure multicast group, the multicast member configures itself on the network interface to receive multicast messages from the multicast address. When the multicast member receives an encrypted multicast message from a multicast address, it can obtain the multicast group key corresponding to the multicast address stored locally. Then, based on the multicast group key, the encrypted multicast message is decrypted to obtain the multicast message.

[0088] In one example, the method further includes:

[0089] For any multicast member that joins the quantum secure multicast group, if the multicast member exits the quantum secure multicast group, the multicast resources of the quantum secure multicast group are reclaimed; wherein the multicast resources include a multicast group key and the encryption key.

[0090] In the present application, there may be a situation where a certain multicast member in a quantum secure multicast group exits the quantum secure multicast group, that is, the multicast member no longer receives multicast messages in the quantum secure multicast group, and the multicast member can reclaim the multicast resources of the quantum secure multicast group. The multicast resources include the multicast group key corresponding to the quantum secure multicast group and the encryption key corresponding to the multicast group key.

[0091] Embodiment 4:

[0092] The specific unicast source global quantum secure multicast network communication method provided by this application is described below through a specific embodiment. Figure 2 A schematic diagram of a specific unicast source global quantum secure multicast network communication process provided in an embodiment of the present application. The process mainly includes a network establishment phase, a group member joining phase, and a multicast transmission phase. For each phase, the process includes:

[0093] Phase 1: Network establishment phase.

[0094] S201: The quantum secure multicast source initiates a key request message to the first access base station it accesses.

[0095] The key request message carries a multicast address and a key type identifier representing a multicast group key.

[0096] S202: The first access base station receives a key request message.

[0097] S203: When determining that the key request message carries a key type identifier representing a multicast group key, the first access base station determines a target key center corresponding to the multicast address and obtains address information of the target key center.

[0098] S204: The first access base station sends a key distribution request to the target key center according to the address information.

[0099] The key distribution request carries a multicast address and a key type identifier.

[0100] S205: The target key center receives the key distribution request.

[0101] S206: The target key center determines that the key type identifier carried in the key distribution request represents the multicast group key, and generates a multicast group key corresponding to the multicast address and an encryption key corresponding to the multicast group key.

[0102] S207: The target key center sends a key distribution response carrying the encryption key to the first access base station.

[0103] S208: The first access base station receives the key distribution response, and based on the symmetric key with the quantum secure multicast source, encrypts and sends a key response message to the quantum secure multicast source.

[0104] The key response message carries the address information of the target key center and the encryption key.

[0105] S209: The quantum secure multicast source decrypts the received encrypted key response message based on the symmetric key with the first access base station to obtain the address information and the encryption key.

[0106] S210: The quantum secure multicast source downloads the encrypted multicast group key corresponding to the multicast address from the target key center based on the changed address information; decrypts the encrypted multicast group key based on the encryption key, obtains the multicast group key and saves it.

[0107] At this point, Phase 1 is completed, that is, the global quantum secure unicast source multicast network has been established, and we can enter Phase 2.

[0108] Phase 2: Team member joining phase.

[0109] For any multicast member to be added to the quantum secure multicast group, the following S301 to S30 are executed to join the quantum secure multicast group of the multicast address.

[0110] S301: A multicast member to be joined to a quantum secure multicast group initiates a request to join the multicast group to a second access base station to which it is connected.

[0111] The multicast joining request carries a multicast address.

[0112] S302: The second access base station receives a request to join the multicast.

[0113] S303: The second access base station obtains the identity information of the multicast member from the multicast joining request, and determines whether the multicast member has the authority to join the quantum secure multicast group based on the identity information.

[0114] S304: When determining that the multicast group member has the authority to join the quantum secure multicast group, the second access base station determines a target key center based on the multicast address.

[0115] S305: The second access base station sends a multicast group key request carrying a multicast address to a target key center.

[0116] S306: The target key center receives the multicast group key request.

[0117] S307: The target key center determines the multicast group key corresponding to the multicast address and the encryption key corresponding to the multicast group key, and sends a multicast group key response carrying the encryption key to the second access base station.

[0118] S308: The second access base station receives a multicast group key response.

[0119] S309: The second access base station sends an encrypted join multicast response to the multicast member based on the symmetric key with the multicast member.

[0120] The join multicast response carries the address information of the target key center and the encryption key.

[0121] S310: The multicast member decrypts the received encrypted join multicast response based on the symmetric key with the second access base station to obtain address information and encryption key.

[0122] S311: The multicast group member downloads the encrypted multicast group key corresponding to the multicast address from the target key center based on the address information, decrypts the encrypted multicast group key based on the encryption key, obtains the multicast group key and saves it.

[0123] At this point, the multicast member has successfully joined the quantum secure multicast group. Subsequently, based on the multicast group key and multicast address, the multicast message transmitted by the quantum secure multicast source in the quantum secure multicast group can be obtained, that is, entering stage three.

[0124] Phase 3: Multicast transmission phase.

[0125] S401: The quantum secure multicast source obtains a multicast message of a quantum secure multicast group to be multicasted to a certain multicast address.

[0126] S402: The quantum secure multicast source obtains the multicast group key corresponding to the multicast address stored locally, and encrypts the multicast message based on the multicast group key to obtain an encrypted multicast message.

[0127] S403: The quantum secure multicast source sends the encrypted multicast message through the traditional network according to the multicast address.

[0128] For any multicast member that has joined the quantum secure multicast group, the following S404 to S40 are executed:

[0129] S404: The multicast member receives the encrypted multicast message corresponding to the multicast address through the network interface.

[0130] S405: The multicast group member obtains the multicast group key corresponding to the multicast address stored locally, and decrypts the encrypted multicast message based on the multicast group key to obtain the multicast message.

[0131] In a possible implementation, there may be a situation where a certain multicast member in a quantum secure multicast group exits the quantum secure multicast group, that is, the multicast member no longer receives multicast messages in the quantum secure multicast group, and the multicast member can reclaim the multicast resources of the quantum secure multicast group. The multicast resources include a multicast group key corresponding to the quantum secure multicast group and an encryption key corresponding to the multicast group key.

[0132] At this point, a quantum secure multicast communication has been completed.

[0133] Embodiment 5:

[0134] Based on the same inventive concept, this application also provides a unicast source global quantum secure multicast network communication system. Figure 3 A system structure diagram of a unicast source global quantum secure multicast network communication provided in the present application, the system includes a quantum secure multicast source 31 for executing the method described in any of the above embodiments 1-4, a first access base station 32 for executing the method described in any of the above embodiments 1-4, and a target key center 33 for executing the method described in any of the above embodiments 1-4.

[0135] It should be noted that the principle of solving the problem by the unicast source global quantum secure multicast network communication system is the same as the principle of solving the technical problem in the above method embodiment, and the repeated parts will not be repeated.

Claims

1. A unicast source global quantum secure multicast network communication method, characterized in that: The method comprises: The quantum secure multicast source initiates a key request message to the first access base station to which it is connected; wherein the key request message carries a multicast address and a key type identifier representing a multicast group key; The first access base station receives the key request message; determines a target key center corresponding to the multicast address; and sends a key distribution request to the target key center; wherein the key distribution request carries the multicast address and the key type identifier; The target key center receives the key distribution request; generates a multicast group key corresponding to the multicast address and an encryption key corresponding to the multicast group key when determining that the key type identifier carried in the key distribution request represents a multicast group key; and sends a key distribution response carrying the encryption key to the first access base station; The first access base station receives the key distribution response; based on the symmetric key with the quantum secure multicast source, encrypts and sends a key response message to the quantum secure multicast source; wherein the key response message carries the address information of the target key center and the encryption key; The quantum secure multicast source decrypts the received encrypted key response message based on the symmetric key with the first access base station to obtain the address information and the encryption key; based on the address information, downloads the encrypted multicast group key corresponding to the multicast address from the target key center; based on the encryption key, decrypts the encrypted multicast group key, obtains the multicast group key and saves it; and determines that the quantum secure multicast group of the multicast address has been established.

2. The method according to claim 1, characterized in that After the first access base station receives the key request message and before determining the target key center corresponding to the multicast address, the method includes: It is determined that the key request message carries a key type identifier representing a multicast group key.

3. The method according to claim 1, characterized in that The method further comprises: For any quantum security terminal to be added to the quantum security multicast group, a request to join the multicast is initiated to the second access base station to which it is connected; wherein the request to join the multicast carries the multicast address; The second access base station receives the joining multicast request; determines the target key center based on the multicast address; and sends the multicast group key request carrying the multicast address to the target key center; The target key center receives the multicast group key request; determines the multicast group key corresponding to the multicast address and the encryption key corresponding to the multicast group key; and sends a multicast group key response carrying the encryption key to the second access base station; The second access base station receives the multicast group key response; based on the symmetric key with the quantum security terminal, encrypts and sends a join multicast response to the quantum security terminal; wherein the join multicast response carries the address information of the target key center and the encryption key; The quantum security terminal decrypts the received encrypted join multicast response based on the symmetric key with the second access base station to obtain the address information and the encryption key; based on the address information, downloads the encrypted multicast group key corresponding to the multicast address from the target key center; based on the encryption key, decrypts the encrypted multicast group key, obtains the multicast group key and saves it; and determines that the quantum security terminal has become a multicast member in the quantum security multicast group.

4. The method according to claim 3, characterized in that After the second access base station receives the multicast join request and before determining the target key center based on the multicast address, the method further includes: The second access base station obtains the identity information of the quantum security terminal from the join multicast request; and determines, based on the identity information, whether the quantum security terminal has the authority to join the quantum security multicast group.

5. The method according to claim 3, characterized in that The method further comprises: The quantum secure multicast source obtains a multicast message; based on the multicast group key stored locally, the multicast message is encrypted; through a traditional network, according to the multicast address, the encrypted multicast message is sent to each multicast member who joins the quantum secure multicast group; For each of the multicast group members, the encrypted multicast message is received; based on the multicast group key stored locally, the encrypted multicast message is decrypted to obtain the multicast message.

6. The method according to any one of claims 4 to 6, characterized in that: The method further comprises: For any multicast member that joins the quantum secure multicast group, if the multicast member exits the quantum secure multicast group, the multicast resources of the quantum secure multicast group are reclaimed; wherein the multicast resources include a multicast group key and the encryption key.

7. A unicast source global quantum secure multicast network communication system, characterized in that: The system includes a quantum secure multicast source, a first access base station, and a target key center for executing any of the methods described in claims 1-6.

Images