OpenVPN network system based on quantum key negotiation, communication method and storage medium

Abstract

The embodiment of the invention relates to the technical field of quantum keys, and discloses an OpenVPN network system based on quantum key negotiation and a communication method. According to the OpenVPN network system based on quantum key negotiation, an OpenVPN client is installed on user equipment and used for initiating a VPN connection request; the OpenVPN server is deployed in a network center and is used for receiving the connection request and establishing a quantum channel; the quantum key distribution device comprises a quantum key management terminal and a quantum key generation device. The quantum key management terminal is used for responding to a quantum key service request of the OpenVPN client and returning the quantum key obtained from the quantum key generation device to the OpenVPN client; and the quantum key generation equipment is used for negotiating and generating a quantum key through a random number generator by using a quantum key distribution technology, and transmitting the quantum key to the quantum key management terminal through a quantum channel. The security of the quantum key is ensured, the transmission flexibility of the quantum key is improved, and the cost of hardware equipment is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of quantum key, and particularly relates to an OpenVPN network system, a communication method and a storage medium based on quantum key negotiation. Background Art

[0002] Quantum communication is a technology that uses the basic principles of quantum mechanics to achieve information transmission. Quantum communication uses quantum states (such as photons) to encode information and realizes the secure transmission of data through technologies such as quantum entanglement states and quantum key distribution. In order to improve the security of communication and resist quantum computing attacks, in a virtual private network (VPN), it is also possible to consider using quantum key encryption methods to encrypt data.

[0003] Currently, in the process of quantum key communication for the OpenVPN network, the generation of quantum keys depends on the built-in functions of hardware devices, that is, the quantum keys are stored in a key card, and the quantum keys stored in the key card are read to encrypt communication data. Considering the limitations of hardware devices, both the capacity of the key card and the flexibility of quantum key transmission are limited, and the replacement and upgrade costs of hardware devices are relatively high. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide an OpenVPN network system, a communication method and a storage medium based on quantum key negotiation, which use a high-strength random number generator to ensure the unpredictability and uniqueness of the key, reduce the demand for hardware devices while ensuring the security of quantum keys, improve the flexibility of quantum key transmission, and reduce the cost of hardware devices.

[0005] To solve the above technical problems, the embodiments of the present invention provide an OpenVPN network system based on quantum key negotiation, including: an OpenVPN server, a quantum key distribution device, and an OpenVPN client; the OpenVPN client is installed on a user device and is used to initiate a VPN connection request; the OpenVPN server is deployed in a network center and is used to receive the connection request and establish a quantum channel; the quantum key distribution device at least includes: a quantum key management terminal and a quantum key generation device deployed in a quantum key distribution network; the quantum key management terminal is used to respond to the quantum key service request of the OpenVPN client and return the quantum key obtained from the quantum key generation device to the OpenVPN client through the quantum channel; the quantum key generation device is used to negotiate and generate a quantum key by using a random number generator and quantum key distribution technology, and transmit the quantum key to the quantum key management terminal through the quantum channel.

[0006] An embodiment of the present invention further provides a communication method for an OpenVPN network, which is applied to the above-mentioned OpenVPN network system based on quantum key negotiation. The communication method includes: the OpenVPN server sends the encrypted data packet to the OpenVPN client through a quantum channel; wherein, the data packet is encrypted based on the quantum communication encryption protocol using a quantum key; after receiving the data packet, the OpenVPN client decrypts and reads the data packet using the quantum key.

[0007] An embodiment of the present invention further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned communication method for the OpenVPN network when executed by a processor.

[0008] Compared with the prior art, an embodiment of the present invention combines OpenVPN with quantum encryption technology. The OpenVPN client is installed on the user device and is used to initiate a VPN connection request; the OpenVPN server is deployed in the network center and is used to receive the connection request and establish a quantum channel; the quantum key distribution device is used to generate and distribute quantum keys. The quantum key distribution device is divided into two modules. One is the quantum key management terminal, which is used to respond to the quantum key service request of the OpenVPN client and return the quantum key obtained from the quantum key generation device to the OpenVPN client; the other is the quantum key generation device, which is used to negotiate and generate quantum keys using the quantum key distribution technology through a random number generator and transmit the quantum keys to the quantum key management terminal through a quantum channel. Through the mutual cooperation of the above-mentioned OpenVPN server, quantum key distribution device, and OpenVPN client, quantum key negotiation is completed in a communication manner in OpenVPN, and the generation of quantum keys uses a high-strength random number generator to ensure the unpredictability and uniqueness of the keys, ensuring the security of quantum keys while reducing the demand for hardware devices, improving the flexibility of quantum key transmission, and reducing the cost of hardware devices.

[0009] In addition, the quantum key management terminal stores the quantum keys in a combined manner of hierarchical storage and encrypted storage.

[0010] In addition, the quantum key management terminal is further used to authenticate the identity of the OpenVPN client before returning the quantum key to the OpenVPN client, and return the quantum key to the OpenVPN client after confirming that the OpenVPN client is authorized.

[0011] In addition, both the OpenVPN client and the OpenVPN server are integrated with standardized interfaces, and quantum keys are transmitted and updated through the standardized interfaces.

[0012] In addition, the quantum key generation device is further configured to, when detecting that there is a risk of leakage or expiration of the quantum key, regenerate the quantum key and send the regenerated quantum key to the quantum key management terminal; the quantum key management terminal is configured to, after receiving the regenerated quantum key, perform an update operation on the stored quantum key.

[0013] In addition, the encryption process is as follows: encrypt the data packet according to the encryption algorithm and key length recorded in the OpenVPN configuration file.

[0014] In addition, when detecting that there is a risk of leakage or expiration of the quantum key, update the quantum keys stored in the OpenVPN client and the OpenVPN server based on the updated quantum key in the quantum key management terminal.

[0015] In addition, the encryption process and decryption process using the quantum key occur at the application layer. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] One or more embodiments are exemplarily illustrated by the pictures in the corresponding drawings, and these exemplary illustrations do not constitute a limitation on the embodiments.

[0017] Figure 1 is a schematic structural diagram of an OpenVPN network system based on quantum key negotiation according to an embodiment of the present invention;

[0018] Figure 2 is a schematic structural diagram of an OpenVPN network system based on quantum key negotiation according to another embodiment of the present invention;

[0019] Figure 3 is a flowchart of a communication method for an OpenVPN network according to an embodiment of the present invention;

[0020] Figure 4 is an overall flowchart of a communication method for an OpenVPN network according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. However, those of ordinary skill in the art can understand that in the embodiments of the present invention, many technical details are provided to help readers better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical solutions required to be protected by the present application can still be implemented.

[0022] The division of the following embodiments is for convenience of description and should not constitute any limitation on the specific implementation manners of the present invention. The various embodiments may be combined and cross-referenced with each other on the premise of no contradiction.

[0023] An embodiment of the present invention relates to an OpenVPN network system based on quantum key negotiation. As Figure 1 shown, it includes: an OpenVPN server, a quantum key distribution device, and an OpenVPN client; the OpenVPN client is installed on a user device and is used to initiate a VPN connection request; the OpenVPN server is deployed in a network center and is used to receive the connection request and establish a quantum channel; the quantum key distribution device at least includes: a quantum key management terminal and a quantum key generation device deployed in a quantum key distribution network; the quantum key management terminal is used to respond to the quantum key service request of the OpenVPN client and return the quantum key obtained from the quantum key generation device to the OpenVPN client; the quantum key generation device is used to negotiate and generate a quantum key by using a random number generator and quantum key distribution technology, and transmit the quantum key to the quantum key management terminal through the quantum channel.

[0024] Compared with the prior art, in the embodiment of the present invention, OpenVPN is combined with quantum encryption technology. The OpenVPN client is installed on a user device and is used to initiate a VPN connection request; the OpenVPN server is deployed in a network center and is used to receive the connection request and establish a quantum channel; the quantum key distribution device is used to generate a quantum key and complete the distribution of the quantum key. The quantum key distribution device is divided into two modules. One is the quantum key management terminal, which is used to respond to the quantum key service request of the OpenVPN client and return the quantum key obtained from the quantum key generation device to the OpenVPN client; the other is the quantum key generation device, which is used to negotiate and generate a quantum key by using a random number generator and quantum key distribution technology, and transmit the quantum key to the quantum key management terminal through the quantum channel. Through the mutual cooperation of the above-mentioned OpenVPN server, quantum key distribution device, and OpenVPN client, quantum key negotiation is completed in a communication manner in OpenVPN, and the generation of the quantum key adopts a high-strength random number generator to ensure the unpredictability and uniqueness of the key, guarantee the security of the quantum key while reducing the demand for hardware devices, improve the flexibility of quantum key transmission, and reduce the cost of hardware devices.

[0025] The quantum key management terminal is a key component integrated into the OpenVPN server or deployed as an independent service device. In addition to responding to the quantum key service requests of the OpenVPN client and providing quantum keys accordingly, the quantum key management terminal is also responsible for the storage and management of quantum keys. Among them, the quantum key management terminal stores quantum keys in a combined way of hierarchical storage and encrypted storage. Such a storage method not only improves the storage efficiency but also ensures the security of the keys. The hierarchical structure of the quantum key management terminal can be divided into a generation layer, a storage layer, and an application layer. Encrypted storage means that the quantum keys generated by the quantum key generation device are dynamically stored in the quantum key pool. Further, a redundant storage and backup mechanism is also adopted when storing quantum keys. In the case where the quantum key storage fails and cannot be read, the redundant storage and backup mechanism is used to recover the quantum keys, avoiding the problem that the communication data cannot be normally transmitted or read due to the loss of quantum keys, and enhancing the reliability of storage.

[0026] In addition, the quantum key management terminal is also used to authenticate the identity of the OpenVPN client before returning the quantum key to the OpenVPN client, and return the quantum key to the OpenVPN client after confirming that the OpenVPN client is authorized. Thus, it is ensured that only authorized users can obtain the key, effectively preventing the illegal acquisition and use of quantum keys. The methods of identity authentication at least include: embedding a quantum digital signature (QDS) in the photon transmission stage, and verifying the validity of the signature to confirm the legality of both communication parties.

[0027] The specific method of identity authentication is as follows:

[0028] Initialization stage: Key pre-distribution: The OpenVPN server sends an initial request message to the OpenVPN client, triggering the key initialization of the quantum key distribution device, clearing the keys in the OpenVPN client quantum key pool in the historical state, obtaining quantum key shards through the quantum network or physical interface, and the key management server on the OpenVPN server side synchronously stores the corresponding keys. Identity identification binding: The quantum key of the OpenVPN client and the quantum device on the OpenVPN server side complete two-way authentication, exchange device IDs (such as the quantum key management server ID, quantum terminal ID) and establish an association.

[0029] Handshake Authentication Phase: Two-way Challenge-Response Protocol: The OpenVPN client requests to establish an extension: The OpenVPN client sends a handshake message containing a quantum random number randc (32 bytes, consisting of GMT time + 28-byte quantum random number). Quantum Key Dynamic Generation: The requester (OpenVPN client) and the authenticator (OpenVPN server) respectively generate the first quantum random number and the second quantum random number (R1, R2). The quantum devices of both parties use the stored quantum key and random numbers to generate an authentication password: Authentication Password = HMAC(Quantum Key, R1||R2). Cross-Verification: The OpenVPN server verifies whether the authentication password sent by the OpenVPN client is consistent with the locally calculated result, and the OpenVPN client reversely verifies the authentication password returned by the OpenVPN server to achieve two-way authentication.

[0030] Key Negotiation Phase: Dynamic Key Group Negotiation: Based on the quantum key, an ephemeral session key is generated, supporting 100,000 key updates per second to prevent replay attacks. The TLS / SSL protocol is extended to embed the hash value of the handshake message encrypted with the quantum key in the Finished message to ensure the integrity of key negotiation.

[0031] In addition to identity authentication, permission restrictions can also be imposed on the users of quantum keys. For example, an administrator can execute the destruction of quantum keys, and ordinary users can only apply for the usage permission of quantum keys, etc.

[0032] The quantum key generation device is deployed in the quantum key distribution network and is the core device for generating quantum keys. The quantum key generation device communicates with adjacent quantum nodes through a quantum channel and negotiates to generate quantum keys using quantum key distribution (QKD) technology. The generated quantum keys are transmitted to the quantum key management terminal through the quantum channel for the quantum key management terminal to transmit the quantum keys to the OpenVPN client and the OpenVPN server, or to store the quantum keys for subsequent use.

[0033] The quantum key generation device is also used to regenerate quantum keys when it detects that there is a risk of quantum key leakage or expiration, and send the regenerated quantum keys to the quantum key management terminal; the quantum key management terminal is used to update the stored quantum keys after receiving the regenerated quantum keys. The automated and real-time update operation of quantum keys can effectively prevent the expansion of security vulnerabilities, and the detailed auditing and logging functions carried out in cooperation provide strong support for the tracking and troubleshooting of security issues.

[0034] To gain an overall understanding of the OpenVPN network system based on quantum key negotiation in the embodiments of the present invention, the functions of each module in the process of quantum key distribution of the system will be specifically described below:

[0035] As Figure 2 shown, in a quantum network, infrastructure such as quantum nodes and quantum optical fibers is established. Quantum nodes are used to generate quantum keys, and quantum optical fibers are used to construct quantum channels, providing a hardware foundation for quantum key distribution. When generating quantum keys, a quantum key generation device (such as the Alice side) uses a single-photon source or a weak coherent light source (such as a laser diode) to generate a quantum state (such as the polarization state or phase state of a photon). According to a protocol (such as BB84, E91), a basis vector (such as a horizontal / vertical polarization basis or a diagonal / circular polarization basis) is randomly selected, and the key information is encoded into the quantum state of the photon. The encoded photon is transmitted through a quantum channel (such as an optical fiber or free space) to an adjacent quantum node device (such as the Bob side). The Bob side randomly selects a measurement basis vector to measure the received photon. A single-photon detector (such as a superconducting nanowire detector SNSPD) in the quantum node records the measurement result, forming the raw key data. Throughout the process, based on the uncertainty principle and the no-cloning theorem of quantum mechanics, the security of the quantum key generation process is ensured, and the quantum key is prevented from being eavesdropped on or cloned.

[0036] The generated quantum key is transmitted through the quantum channel to the quantum key management terminal. During the transmission process, eavesdropping behavior is detected and blocked to ensure the security and reliability of the quantum key distribution process.

[0037] In addition, in order to enable the generated quantum key to be normally integrated into the OpenVPN system, the encryption and verification of the data packets transmitted by OpenVPN using the quantum key can be defined by modifying the configuration file of OpenVPN. The modification of the configuration file at least includes: storing the quantum key in the key storage and management modules of the OpenVPN client and server respectively, or using an independent key storage and management module in the OpenVPN system, so that the OpenVPN client and server can correctly identify and use the quantum key. In addition, the encryption parameters of the quantum key are also specified in the OpenVPN configuration file. The encryption parameters include encryption algorithms and key lengths, etc., and the encryption parameters can be reasonably configured according to actual needs.

[0038] OpenVPN realizes encryption through pure software, and the mainstream encryption algorithms can be natively provided by the OpenSSL library, reducing the deployment cost of the OpenVPN network system based on quantum key negotiation.

[0039] In addition, the OpenVPN network system based on quantum key negotiation adopts a modular design, and each component can be independently upgraded and maintained, enabling the system to have good scalability, supporting complex application scenarios such as multi-tenants and multi-platforms, and meeting the diverse needs of different users. At the same time, the system realizes the compatibility of quantum key distribution and OpenVPN, and can flexibly add or delete function modules in the system or expand existing functions according to actual needs without changing the existing network architecture and configuration. For example, both the OpenVPN client and the OpenVPN server are integrated with standardized interfaces, and quantum keys are transmitted and updated through the standardized interfaces to ensure that users can easily use the quantum encryption function.

[0040] Compared with the prior art, the embodiment of the present invention combines quantum keys with OpenVPN to provide a higher communication security environment for scenarios such as civilian low-cost office environments. For example, when a user accesses the company's internal network in a public environment, they can use the OpenVPN network combined with quantum keys. The communication environment does not depend on hardware devices and is deployed quickly and simply. Moreover, OpenVPN works at the transport layer and only needs to open specific tcp / udp ports to penetrate the network, and the communication method is simple and easy to implement.

[0041] It is worth mentioning that each module involved in this embodiment is a logical module. In practical applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. In addition, in order to highlight the innovative part of the present invention, units that are not closely related to solving the technical problems proposed by the present invention are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.

[0042] The embodiment of the present invention also relates to a communication method for an OpenVPN network, which is applied to the above-mentioned OpenVPN network system based on quantum key negotiation. The communication method is as Figure 3 shown and includes:

[0043] Step 301: The OpenVPN server sends the encrypted data packet to the OpenVPN client through a quantum channel;

[0044] Among them, the data packet is encrypted based on the quantum communication encryption protocol using quantum keys.

[0045] Step 302: After receiving the data packet, the OpenVPN client decrypts and reads the data packet using the quantum key.

[0046] Specifically, before conducting encrypted communication, the OpenVPN client and server have already integrated and configured quantum keys in advance through the above-mentioned OpenVPN network system based on quantum key negotiation, as well as relevant parameters for encryption and decryption using quantum keys. When the OpenVPN client and server communicate, the data sender encrypts the data packet using the quantum key. The encryption process follows the quantum communication encryption protocol and performs symmetric encryption on the data packet using the quantum key. The encrypted data packet is unreadable and cannot be easily decrypted even if intercepted by an eavesdropper. The encrypted data packet is transmitted through the public network to the target address. At the target address, the receiver uses the corresponding quantum key to decrypt the received data packet. The decryption process is the opposite of the encryption process, and the original data is restored through reverse operations. The decrypted data can be normally read and processed by the receiver. The encryption and decryption processes using quantum keys occur at the application layer.

[0047] In addition, to improve the security of quantum keys, quantum keys usually have a time limit, and need to be updated in a timely manner after detecting that the quantum key has expired. The update mechanism can be: regularly generate new quantum keys through the quantum key distribution system and automatically replace the old quantum keys. In addition to the above-mentioned regular update mechanism, when the system detects potential risks (such as key leakage, expiration, etc.), the key update mechanism is immediately automatically started. The key update process is automatically completed through the quantum channel without manual intervention. The new quantum key is generated and distributed to the quantum key management terminal through the quantum key distribution network to replace the risky quantum key.

[0048] In practical applications, the overall process of conducting encrypted communication is as Figure 4 shown:

[0049] ① Establish a classical OpenVPN communication tunnel between the OpenVPN client and the OpenVPN server;

[0050] ② Establish a quantum channel;

[0051] ③ The quantum key distribution device generates and distributes quantum keys;

[0052] ④ The sender calls the quantum key to encrypt the data packet and sends the encrypted data packet to the receiver;

[0053] ⑤ The receiver calls the quantum key to decrypt the data packet;

[0054] ⑥ The quantum key management terminal regularly manages the key update of the stored quantum keys;

[0055] ⑦ Establish secure communication between the OpenVPN client and the OpenVPN server.

[0056] The step division of the above various methods is only for clear description. When implemented, they can be combined into one step or some steps can be split into multiple steps. As long as the same logical relationship is included, they are all within the protection scope of this patent; adding insignificant modifications or introducing insignificant designs to the algorithm or process, but without changing the core design of the algorithm and process, are all within the protection scope of this patent.

[0057] It is not difficult to find that this embodiment is a method embodiment corresponding to the above system embodiment, and this embodiment can be implemented in cooperation with the system embodiment. The relevant technical details mentioned in the system embodiment are still valid in this embodiment. To avoid repetition, they will not be elaborated here. Correspondingly, the relevant technical details mentioned in this embodiment can also be applied to the method embodiment.

[0058] An embodiment of the present invention also relates to a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0059] That is, those skilled in the art can understand that all or part of the steps of implementing the above embodiment methods can be completed by instructing relevant hardware through a program. This program is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, a chip, etc.) or a processor to execute all or part of the steps of the methods described in various embodiments of the present application. And the aforementioned storage medium includes: USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs and other various media that can store program codes.

[0060] Those of ordinary skill in the art can understand that the above embodiments are specific embodiments for implementing the present invention. In actual applications, various changes can be made to them in form and details without departing from the spirit and scope of the present invention.

Claims

1. An OpenVPN network system based on quantum key negotiation, characterized in that: include: OpenVPN server, quantum key distribution device, OpenVPN client; The OpenVPN client is installed on the user equipment and is used to initiate a VPN connection request; The OpenVPN server is deployed in the network center to receive the connection request and establish a quantum channel; The quantum key distribution device at least includes: a quantum key management terminal and a quantum key generation device deployed in a quantum key distribution network; The quantum key management terminal is used to respond to the quantum key service request of the OpenVPN client and return the quantum key obtained from the quantum key generation device to the OpenVPN client through the quantum channel; The quantum key generation device is used to negotiate and generate a quantum key using a random number generator and a quantum key distribution technology, and transmit the quantum key to the quantum key management terminal through the quantum channel.

2. According to the OpenVPN network system based on quantum key agreement in claim 1, it is characterized in that: The quantum key management terminal stores the quantum key in a manner combining hierarchical storage and encrypted storage.

3. According to the OpenVPN network system based on quantum key agreement in claim 1, it is characterized in that: The quantum key management terminal is also used to authenticate the identity of the OpenVPN client before returning the quantum key to the OpenVPN client, and return the quantum key to the OpenVPN client after confirming that the OpenVPN client is authorized.

4. The OpenVPN network system based on quantum key agreement according to claim 1, characterized in that: The OpenVPN client and the OpenVPN server are both integrated with a standardized interface, and the quantum key is transmitted and updated through the standardized interface.

5. The OpenVPN network system based on quantum key agreement according to any one of claims 1 to 4, characterized in that: The quantum key generation device is also used to regenerate the quantum key when it is detected that the quantum key is at risk of leakage or expired, and send the regenerated quantum key to the quantum key management terminal; The quantum key management terminal is used to update the stored quantum key after receiving the regenerated quantum key.

6. A communication method for an OpenVPN network, characterized in that: Applied to the OpenVPN network system based on quantum key agreement as claimed in any one of claims 1 to 5, the method comprising: The OpenVPN server sends the encrypted data packet to the OpenVPN client through the quantum channel; wherein the data packet is encrypted using the quantum key based on the quantum communication encryption protocol; After receiving the data packet, the OpenVPN client uses the quantum key to decrypt and read the data packet.

7. The communication method of the OpenVPN network according to claim 6, characterized in that: The encryption processing method is: encrypting the data packet according to the encryption algorithm and key length recorded in the OpenVPN configuration file.

8. The communication method of the OpenVPN network according to claim 6, characterized in that: Also includes: When it is detected that the quantum key is at risk of leakage or expiration, the quantum key stored in the OpenVPN client and OpenVPN server is updated based on the updated quantum key in the quantum key management terminal.

9. The communication method of the OpenVPN network according to claim 6, characterized in that: The encryption and decryption processing using quantum keys occurs at the application layer.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the communication method of the OpenVPN network according to any one of claims 6 to 9 is implemented.

Images