Secure distributed data processing system and method for continuous-variable quantum key distribution

Abstract

This invention provides a secure distributed data processing system and method for continuous-variable quantum key distribution. The system includes a main data processing computing unit and at least one secondary data processing computing unit. The main data processing computing unit periodically monitors the quantum link state and the state information of the secondary data processing computing units, and dynamically allocates data processing tasks to each secondary data processing computing unit. The secondary data processing computing units execute data processing and send the processing results back to the main data processing computing unit. This invention differentiates processing based on the apparent signal-to-noise ratio and normalized total noise characteristics of the data processing tasks, assigning high-computing-power secondary data processing computing units to high-computing-power secondary data processing computing units and low-computing-power secondary data processing computing units to low-computing-power secondary data processing computing units, thus fully utilizing the computing resources of multiple computing units and improving data processing efficiency.

Description

Technical Field

[0001] This invention relates to the field of continuous variable quantum key distribution technology, and more specifically, to a secure distributed data processing system and method for continuous variable quantum key distribution. Background Technology

[0002] Continuous variable quantum key distribution (CVQKD) is a quantum cryptography technique that uses continuous variables (such as amplitude and phase) of an optical field to encode and distribute keys. Unlike discrete variable QKD, which uses single-photon counters, CVQKD uses standard coherent detection techniques, making it highly compatible with existing telecommunications infrastructure and considered one of the key technologies for realizing large-scale quantum secure networks. The existing data processing methods in CVQKD systems have the following technical problems: 1. Single-point data processing bottleneck: Traditional methods use a single data processing computing unit, which can easily become a data processing bottleneck in high-speed quantum key distribution scenarios. 2. Low resource utilization: It cannot fully utilize the computing resources of multiple computing units, resulting in limited data processing efficiency. 3. Lack of heterogeneous scheduling optimization: Data processing tasks are not differentiated based on their apparent signal-to-noise ratio and noise characteristics. 4. Insufficient reliability: A single point of failure may cause the entire data processing process to be interrupted. 5. Lack of adaptive capability: Unable to dynamically optimize scheduling parameters based on real-time performance feedback. 6. Lagging response to link changes: Unable to detect changes in quantum channel quality in real time, scheduling strategies lack dynamic adaptability. 7. Lack of integration between key quantity requirements and computing resource allocation: The actual key quantity requirements are not included in the task allocation decision, resulting in resource waste or insufficient supply. 8. Distributed security risks: In the process of collaborative data processing by multiple computing units, the lack of unified security domain management poses risks of data leakage and tampering. Patent document CN106850057A discloses a continuous-variable quantum key distribution (CVQKD) detection system without a polarization controller, which simplifies the physical structure of the detector end in a CVQKD system. It includes the following steps: 1. Measurement of polarization change-related parameters; 2. Data measurement at the detector end of the CVQKD system; 3. Correction of the reliable noise model based on the polarization change-related parameters. However, this patent document only focuses on the physical layer polarization compensation at the receiver end of the CVQKD system, without addressing the distributed computing architecture and secure collaboration of the data processing layer. Therefore, it cannot solve the post-processing bottlenecks and security risks associated with multiple computing units in high-speed scenarios. Summary of the Invention To address the shortcomings of existing technologies, the purpose of this invention is to provide a secure distributed data processing method and system for continuous variable quantum key distribution.

[0003] A secure distributed data processing system for continuous variable quantum key distribution according to the present invention includes: A main data processing computing unit and at least one secondary data processing computing unit; The main data processing computing unit is used to periodically monitor the state of the quantum link and the state information of the sub-data processing computing units, and dynamically allocate data processing tasks to each sub-data processing computing unit. The secondary data processing unit is used to perform data processing and send the processing results back to the primary data processing unit.

[0004] Preferably, the main data processing computing unit includes: The data receiving and processing task module is used to receive and cache data tasks to be processed; The state monitoring and sensing module is used to collect the state vector of the periodic quantum link and the periodic load state vector of each data processing and computing unit. The load balancing scheduling module is used to pre-allocate and dynamically adjust the data tasks to be processed based on the extended link quality indicators and the periodic load state vector. The data processing result aggregation module is used to receive and aggregate the processing results returned by each sub-data processing and computing unit. The low-complexity scenario data processing module is used to handle data processing tasks in scenarios with lower than the preset complexity.

[0005] Preferably, the secondary data processing and computing unit includes: The task receiving module is used to receive data processing tasks assigned by the main data processing and computing unit. The data processing module is used to process data according to the task type; The result sending module is used to send the data processing results back to the main data processing and computing unit; The status feedback module is used to generate and report the periodic load status vector.

[0006] Preferably, the main data processing computing unit and the secondary data processing computing unit establish a session key through the cryptographic algorithm interface provided by the security chip; the main data processing computing unit sends an authentication request message carrying a first random number to the secondary data processing computing unit; the secondary data processing computing unit calculates a message digest based on the session key derived from the security chip, the first random number, and a locally generated second random number, and responds by carrying the second random number and the message digest; after verifying the response, the main data processing computing unit calculates a response message digest based on the session key and the second random number and sends it back; after verifying the response message digest, the secondary data processing computing unit establishes a mutually authenticated communication connection.

[0007] A secure distributed data processing method for continuous variable quantum key distribution according to the present invention includes: Step S1: Within a unified security domain, the main data processing computing unit and multiple secondary data processing computing units complete identity authentication based on a security chip and establish a trusted communication connection. Step S2: The main data processing computing unit periodically monitors the state of the quantum link and the state information of the secondary data processing computing units, and dynamically allocates data processing tasks to each secondary data processing computing unit. Step S3: The secondary data processing unit performs data processing and sends the processing results back to the primary data processing unit.

[0008] Preferably, the communication between the main data processing computing unit and the secondary data processing computing unit is based on the authentication of identity through the periodic generation of session keys and challenge responses by the security chip, and the generated session keys are destroyed after the meeting ends.

[0009] Preferably, step S2 includes the following sub-steps: Step S2.1: Periodically acquire the quantum link state vector L(t), where L(t) includes the apparent signal-to-noise ratio (SNR) of each data unit within the sampling period t. meas,i (t) and normalized total noise ξ norm (t), and: ; Step S2.2: Calculate the extended link quality index and redistribute tasks based on its dynamic changes; Step S2.3: Perform multi-level complexity scenario mapping based on the extended link quality index to obtain scenario parameters R; Step S2.4: The main data processing computing unit pre-allocates data processing tasks in a distributed manner according to the scenario parameter R, and performs dynamic scheduling according to the load state vector Ai(t) of the main and secondary data processing computing units.

[0010] Preferably, the calculation formula for the extended link quality index includes:

[0011]

[0012] Among them, SNR meas,i (t) represents the apparent signal-to-noise ratio of the i-th data unit within period t, and is a linear scale; ξ norm (t) represents the total noise normalized to [0,1) within period t; ELQI(t) represents the extended link quality index; τ is the link quality mapping parameter; parameter N represents the number of samples collected within the current sampling period t; γ i (t) represents the link quality sample value corresponding to the i-th data unit within a period t, and its formula includes:

[0013] α is a configurable noise weighting parameter.

[0014] Preferably, the secondary data processing computing unit adopts a preset pipeline thread, including a receiving thread, a processing thread, a return thread, and a feedback thread; the secondary data processing computing units are prohibited from communicating with each other and only communicate with the main data processing computing unit.

[0015] Preferably, when the periodic load state vector of a certain sub-data processing computing unit exceeds a preset threshold, the distribution of new tasks to that sub-data processing computing unit is suspended and the tasks are transferred to other sub-data processing computing units.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention adopts a master-slave distributed architecture, with multiple computing units cooperating in data processing. Compared with a single data processing computing unit, parallel processing effectively reduces the overall data processing time and increases the data processing rate by more than 2 times, effectively breaking through the bottleneck of single-point data processing and meeting the requirements of high-speed CVQKD systems.

[0017] 2. This invention differentiates data processing scenarios based on the apparent signal-to-noise ratio and normalized total noise characteristics of the data processing tasks. High-complexity tasks are assigned to high-computing-power secondary data processing units, and low-complexity tasks are assigned to low-computing-power secondary data processing units. This fully utilizes the computing resources of multiple computing units and improves data processing efficiency.

[0018] 3. This invention constructs a periodic quantum link state vector by real-time monitoring of quantum channel quality, and dynamically adjusts the task allocation strategy according to link changes to achieve closed-loop scheduling of link awareness, task reallocation, and resource coordination; at the same time, all computing nodes perform identity authentication, encrypted communication, and isolated operation based on security chips within the trusted boundary to ensure the security of the distributed computing process. Attached Figure Description

[0019] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a timing diagram for the identity authentication of the main and secondary data processing and computing units of this invention.

[0020] Figure 2 This is a flowchart of the calculation and scheduling process for the extended link quality index ELQI of this invention.

[0021] Figure 3 This is a diagram of the distributed post-processing architecture of the present invention.

[0022] Figure 4 This is a flowchart of the scene complexity identification and task allocation process in this invention. Detailed Implementation

[0023] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0024] The contents proposed in this invention include: 1. Unified Security Domain Architecture: All computing nodes perform authentication, encrypted communication, and isolated operation within a trusted boundary, ensuring the security of the distributed computing process. Authentication is based on session keys derived from a secure chip.

[0025] 2. Adaptive Link Awareness Mechanism: Real-time monitoring of quantum channel quality, construction of periodic quantum link state vectors, and dynamic adjustment of task allocation strategies based on link changes.

[0026] 3. Multi-dimensional Fusion Scheduling: Taking into account multiple factors such as link status, key quantity requirements, computing unit power, computing resources, and current load, the system dynamically optimizes task allocation, achieving closed-loop scheduling with link awareness, task reallocation, and resource coordination, intelligently balancing high performance and low power consumption. Distributed Pipeline Parallelism: In a master-slave architecture, multiple computing units collaborate on data processing, including one master data processing unit and n slave data processing units (n≥1). Each slave data processing unit employs h-level (h≥4) pipeline threads (receiving, processing, transmission, and feedback) to form a continuous data processing flow. Through the above mechanisms, the system achieves a distributed optimization scheduling method with high bit rate, low latency, adaptability, and a unified security domain while ensuring security. Because forward negotiation has a 3dB limit problem, most current CVQKD systems use reverse negotiation for post-processing; this invention also uses reverse negotiation as an example for illustration.

[0027] A secure distributed data processing system for continuous variable quantum key distribution includes a main data processing computing unit and at least one secondary data processing computing unit. The main data processing computing unit is used to periodically monitor the state of the quantum link and the state information of the sub-data processing computing units, and dynamically allocate data processing tasks to each sub-data processing computing unit. The secondary data processing unit is used to perform data processing and send the processing results back to the primary data processing unit.

[0028] The data processing scheme of this invention in the CVQKD system adopts a master-slave distributed architecture, including: a master data processing computing unit and n slave data processing computing units, designed under a unified security domain architecture.

[0029] Security domain definition and boundaries: All primary and secondary data processing computing units involved in data processing must be deployed within the security domain of the same physical chassis.

[0030] A security domain has the following characteristics: Network isolation: The internal network of the security domain is physically isolated from the external network, and is an independent network composed of a dedicated bus inside the chassis.

[0031] Access control: Only authorized computing units can be added to the security domain, and access is controlled through a whitelist mechanism.

[0032] Unified authentication: All primary and secondary computing units must undergo identity authentication based on the security chip.

[0033] The principle of least privilege: Sub-data processing computing units can only access the task data assigned to them by the main data processing computing unit.

[0034] Horizontal communication is prohibited: direct communication between secondary data processing computing units is prohibited; all secondary data processing computing units communicate only with the primary data processing computing unit.

[0035] Identity authentication process as follows Figure 1 As shown, it includes: 1. Establishing a session: The main data processing computing unit (main unit) and the secondary data processing computing unit (secondary unit) establish a session key through the security chip derived key interface.

[0036] 2. The master unit initiates authentication, generates a random number nonceA, and sends an MSG_HELLO message containing nonceA to the slave unit.

[0037] 3. The secondary unit responds by generating a random number, nonceB. HMAC is calculated using the sessionKey and the random numbers from both sides (nonceA and nonceB), i.e., hmac1 = HMAC_SM3(sessionKey, nonceA || nonceB). The secondary unit sends an MSG_CHALL_RESP message to the primary unit, containing nonceB and hmac1.

[0038] 4. The master unit verifies and responds, verifying the HMAC: The master unit uses hmac1 = HMAC_SM3(sessionKey, nonceA || nonceB) to verify the slave unit's identity. If the master unit fails to verify the slave unit's identity, it exits. If the master unit successfully verifies the slave unit's identity, it calculates hmac2 = HMAC_SM3(sessionKey, nonceB || nonceA) and sends an MSG_AUTH_RESP message containing hmac2 to the slave unit.

[0039] 5. Final verification by the secondary unit: The secondary unit uses `hmac2 = HMAC_SM3(sessionKey, nonceB || nonceA)` to verify the identity of the primary unit. If the secondary unit fails to verify the primary unit's identity, it exits; if the secondary unit successfully verifies the primary unit's identity, it sends an acknowledgment message `MSG_AUTH_OK`. The authentication process between the two parties is complete, and a mutually trusted communication connection is established.

[0040] In one embodiment, the above system includes: Main data processing and computing unit: As the scheduling center, it includes a data processing task receiving module, a status monitoring and sensing module, a load balancing scheduling module, a data processing result aggregation module, and a low-complexity scenario data processing module.

[0041] The data processing task module is responsible for receiving cached data tasks to be processed.

[0042] The state monitoring and sensing module is responsible for monitoring the state changes of the quantum link in real time, collecting state information of all data processing and computing units, and providing data support for adaptive scheduling.

[0043] Specifically, it includes: 1. Real-time acquisition of attenuation Att and noise; calculation of apparent signal-to-noise ratio (SNR) meas,i and normalized total noise quantum link state information for each data unit; construction of periodic quantum link state vector: L(t), where L(t) is defined as the apparent signal-to-noise ratio of the first n data units and the normalized total noise. .

[0044] 2. Real-time acquisition of current queue length, processor load utilization, temperature, memory, power consumption and other status information of the main and secondary data processing computing units, and construction of periodic load status vectors for each distributed secondary data processing computing unit: Ai(t).

[0045] The load balancing scheduling module is responsible for retrieving data processing tasks from the buffer queue of the receiving data processing task module, identifying the complexity based on the current periodic quantum link state vector L(t), and pre-allocating tasks according to the complexity scenario (multiple secondary data processing computing units are computing units for different scenarios, and different computing power and optimization strategies are configured according to different complexity scenarios). Then, it combines the input main data processing computing unit and the periodic load state vector Ai(t) of each secondary data processing computing unit to perform actual task allocation and data transmission. For example, when a secondary data processing computing unit is under high load, the task output can be transferred to other secondary data processing computing units, or when the key quantity meets the requirements, the transmission of new data processing tasks can be paused to save energy.

[0046] The data processing results aggregation module is responsible for placing the data processing results received from each sub-data processing and computing unit into the data processing results cache queue.

[0047] The low-complexity scenario data processing module is responsible for processing low-complexity tasks.

[0048] Sub-data processing units i, i∈[1,n] receive data processing tasks assigned by the main data processing unit, corresponding to different complexity scenarios. High-computing-power sub-data processing units are used to perform calculations on high-complexity data processing tasks, while low-computing-power sub-data processing units are used to perform calculations on low-complexity data processing tasks. The sub-data processing units communicate with the main data processing unit through an independent network formed by an internal bus. The sub-data processing units can be deployed on various heterogeneous processors such as CPUs / GPUs / TPUs / APUs for data processing. Each sub-data processing unit specifically includes a task receiving module, a data processing module, a result sending module, and a status feedback module.

[0049] The receiving task module is responsible for receiving data processing tasks sent from the main data processing unit.

[0050] The data processing module is responsible for retrieving data from the task queue of the current data processing and computing unit, processing the data, and placing the data processing results into the data processing result cache queue.

[0051] The result sending module is responsible for sending the data processing results to the main data processing module.

[0052] The status feedback module is responsible for feeding back the current periodic load status vector Ai(t) of the data processing computing unit to the status monitoring and sensing module of the main data processing computing unit.

[0053] The load balancing scheduling module in the main data processing computing unit performs complexity identification and task allocation based on the current key demand, the periodic quantum link state vector, the periodic load state vector of each data processing computing unit, and the currently retrieved data processing tasks. When the key demand exceeds a certain threshold of user requirements, the data processing tasks can be slowed down or paused to save energy. The complexity identification and task allocation steps are as follows: This invention calculates the Extended Link Quality Indicator (ELQI) by fusing the apparent signal-to-noise ratio (SNR) of each data unit in the periodic link state vector with the normalized total noise. Based on the ELQI, the scenario parameter R is selected.

[0054] like Figure 2 As shown, the specific calculation steps are as follows: Step 1: First, calculate the Extended Link Quality Index (ELQI) and then convert the link state vector...

[0055] The apparent signal-to-noise ratio and the normalized total noise information are combined to form the extended link quality index, and the calculation formula is as follows: (1) Calculate the link quality sample value corresponding to each data unit within time t:

[0056] (2) Calculate the extended link quality metric within time t:

[0057] Where: SNR meas,i (t) is the apparent signal-to-noise ratio corresponding to the i-th data unit within the cycle time t, in linear scale; ξ norm (t) is the total noise normalized to the range [0, 1) within the cycle time t, reflecting the impact of noise on signal quality, including but not limited to channel noise caused by fiber scattering, phase jitter, etc., detector electronic noise, and other noises measured and calibrated locally; γ i (t) is the link quality sample value corresponding to the i-th data unit within the cycle time t, used to characterize the processability or reliability of the data unit in subsequent processing stages. It should be noted that the link quality sample value is a quality scoring quantity jointly constructed by multiple link observation features, used to characterize the processability of the corresponding data unit in the post-processing stage, and can be selected but not limited to the following formula

[0058] ELQI(t) comprehensively reflects the system-level quality of the link in the post-processing stage and is used for complexity identification and task scheduling decisions.

[0059] τ is the link quality mapping parameter, used to adjust the influence weight of low-quality samples on ELQI, and its value can be obtained through experiment or historical data calibration; α is a configurable noise weight parameter, used to adjust the influence degree of noise on the identification of the extended link quality metric, and its value can be adaptively adjusted according to different SNR meas,i intervals, historical link states, or data processing success rates.

[0060] For example: When SNR meas,i > S1,

[0061] When S2 ≤ SNR meas,i ≤ S1,

[0062] When SNR meas,i < S2,

[0063] Step 2: Define the mapping function SEARCH(ELQI(t)) → (R) Establish a threshold grading table for extended link quality indicators: {[ELQI1, ELQI2), [ELQI2, ELQI3), ...,[ELQIn-1, ELQIn]} Given the extended link quality index ELQI(t), different parameters R can be selected. Where: R represents the scenario parameter, corresponding to different data processing and computation units.

[0064] Different ELQI ranges correspond to different scenario parameters R. Based on R, the optimal H matrix and decoding rate r are selected for that scenario, and different code rates and negotiation strategies are adopted accordingly.

[0065] Step 3: Based on the selected scenario parameter R, decide which computing units to use for data processing. Based on computing power, pre-allocate tasks for different scenarios to different computing units. The main data processing unit is also responsible for load balancing scheduling and aggregating data processing results; therefore, data processing tasks for low-complexity scenarios are pre-allocated to the main data processing unit. Data processing tasks for other high-complexity scenarios are pre-allocated to other different data processing computing units.

[0066] The scenario complexity is divided according to the interval corresponding to the extended link quality index ELQI(t).

[0067] A high ELQI(t) indicates good link quality, a low bit error rate, and fewer decoding iterations required, corresponding to a low-complexity scenario. Conversely, a low ELQI(t) indicates higher link noise, increased decoding difficulty, and the need for a lower code rate and more iterations for error correction, corresponding to a high-complexity scenario. Therefore, the scenario complexity level can be determined by the threshold range of ELQI(t), and the corresponding data processing unit can be selected for processing.

[0068] Step 4: Determine whether to actually send a task to the current sub-data processing computing unit based on the load state vector Ai(t) of each sub-data processing computing unit. When the current state vector Ai(t) of a sub-data processing computing unit exceeds the threshold, the data processing task pre-assigned by that sub-data processing computing unit can be transferred to other sub-data processing computing units for processing. The sub-data processing computing unit internally forms a pipeline through a four-thread architecture (receive, process, transmit, feedback).

[0069] Data processing results aggregation and output: After each secondary data processing unit completes data processing, it sends the data processing results and processing status information back to the main data processing unit. The main data processing unit aggregates the data processing results from multiple secondary data processing units and stores them in a cache queue, forming a continuous data processing pipeline. It also updates the task completion statistics and system performance indicators.

[0070] This invention also provides a secure distributed data processing method for continuous variable quantum key distribution, comprising: Step S1: Within a unified security domain, the main data processing computing unit and multiple secondary data processing computing units complete identity authentication based on a security chip and establish a trusted communication connection. Step S2: The main data processing computing unit periodically monitors the state of the quantum link and the state information of the secondary data processing computing units, and dynamically allocates data processing tasks to each secondary data processing computing unit. Step S3: The secondary data processing unit performs data processing and sends the processing results back to the primary data processing unit.

[0071] Example 1 like Figure 3 As shown, the above scheme is adopted in the decoding process of the Alice post-processing computing unit. The designed secure distributed post-processing system includes a main Alice post-processing computing unit and five auxiliary Alice post-processing computing units. The main Alice post-processing computing unit is responsible for low-complexity decoding tasks, and the auxiliary Alice post-processing computing units are responsible for high-complexity decoding tasks.

[0072] The distributed data processing computing unit is equipped with a security chip, which periodically derives a security session key (SessionKey). All communication between computing units must be established based on HMAC-SM3 authentication using the session key derived from the security chip. The derived session key is destroyed when the connection ends.

[0073] The principle of least privilege applies: the secondary Alice post-processing unit can only access the task data assigned to it by the primary Alice post-processing unit.

[0074] Lateral communication is prohibited: direct communication between post-processing computing units is prohibited. All secondary Alice post-processing computing units communicate only with the primary Alice post-processing computing unit.

[0075] like Figure 4 As shown, the scene complexity identification and task allocation process is as follows, with the complexity identification steps performed in the main Alice post-processing calculation unit: Step 1: Calculate the extended link quality index. The main Alice post-processing unit retrieves data and the current link state vector from the queue to be post-processed. The apparent signal-to-noise ratio and normalized total noise information in the data form the extended link quality index;

[0076]

[0077] Step 2: Select parameter R based on the extended link quality index When ELQI ∈ [θ1, θ0), choose R = 1. (Corresponding to a code rate of 0.9, low complexity, and an estimated number of iterations of approximately 10) When ELQI ∈ [θ2, θ1), choose R = 2. (Corresponding to a code rate of 0.8, medium to low complexity, and an estimated number of iterations of approximately 20) When ELQI ∈ [θ3, θ2), choose R = 3. (Corresponding to a code rate of 0.7, medium complexity, and an estimated number of iterations of approximately 30) When ELQI ∈ [θ4, θ3), choose R = 4. (Corresponding to a code rate of 0.5, medium to high complexity, and an estimated number of iterations of approximately 40) When ELQI ∈ [θ5, θ4), choose R = 5. (Corresponding to a code rate of 0.3, high complexity, and an estimated number of iterations of approximately 50) When ELQI < θ5, choose R = 6. (Corresponding to a code rate of 0.1, extremely high complexity, and an estimated number of iterations of approximately 60) Among them, the threshold parameters θ0, θ1, ..., θ5 are positive numbers, satisfying θ0>θ1>θ2>θ3>θ4>θ5≥ 0. Their specific values ​​can be calibrated offline or online according to the actual link statistical characteristics of the system, the mapping parameter τ, and the post-processing performance requirements.

[0078] For example: θ0=0.025 θ1=0.020 θ2=0.017 θ3=0.015 θ4=0.013 θ5=0.011 Step 3: Select the main Alice post-processing unit or the secondary Alice based on the selected scene parameter R. iPost-processing computation units, i∈[1,5], perform post-processing. The main Alice post-processing computation unit uses the CPU to perform post-processing, while the secondary Alice1 post-processing computation unit uses the GPU. Tasks for different scenarios are pre-assigned to different computation units based on computing power. The main Alice post-processing computation unit is also responsible for load balancing scheduling and aggregating post-processing results; therefore, post-processing tasks for low-complexity scenarios are pre-assigned to the main Alice post-processing computation unit. Post-processing tasks for other high-complexity scenarios are pre-assigned to other different secondary Alice post-processing computation units.

[0079] Step 4: Determine whether to actually send a task to the current Alice post-processing unit based on its queue length, processor load, and temperature. When the current post-processing queue length, processor load, or temperature of a certain Alice post-processing unit exceeds a threshold, the pre-allocated post-processing tasks for that unit can be transferred to other Alice post-processing units for processing. The n secondary Alice post-processing units internally utilize h-level (h≥4) pipelined threads (receive, process, transmit, feedback) to form continuous data processing. The decoding results from the main Alice post-processing unit and the secondary Alice post-processing units are uniformly transmitted back to the main Alice post-processing unit, cached in the result queue, and then enter the privacy amplification queue. This method achieves asynchronous collaboration between the main Alice post-processing unit and multiple secondary Alice post-processing units.

[0080] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0081] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A secure distributed data processing system for continuous variable quantum key distribution, characterized in that, Comprise: a main data processing computing unit and at least one secondary data processing computing unit; the main data processing computing unit is used for periodically monitoring the state information of the quantum link and the secondary data processing computing unit, and dynamically allocating data processing tasks to each secondary data processing computing unit; the secondary data processing computing unit is used for executing data processing and returning the processing result to the main data processing computing unit.

2. The secure distributed data processing system for continuous variable quantum key distribution of claim 1, wherein, The main data processing computing unit comprises: a receiving data processing task module for receiving and buffering data tasks to be processed; a state monitoring and perception module for collecting periodic quantum link state vectors and periodic load state vectors of each data processing computing unit; a load balancing scheduling module for pre-distributing and dynamically adjusting the data tasks to be processed according to the extended link quality index and the periodic load state vector; a converged data processing result module for receiving the processing results returned by each secondary data processing computing unit and converging them; a low complexity scenario data processing module for processing data processing tasks below a preset complexity scenario.

3. The secure distributed data processing system for continuous variable quantum key distribution of claim 1, wherein, The secondary data processing computing unit comprises: a receiving task module for receiving data processing tasks allocated by the main data processing computing unit; a data processing module for processing data according to the task type; a sending result module for returning the data processing result to the main data processing computing unit; a state feedback module for generating and reporting periodic load state vectors.

4. The secure distributed data processing system for continuous variable quantum key distribution of claim 1, wherein, The main data processing computing unit and the secondary data processing computing unit establish a session key through the cryptographic algorithm interface provided by the security chip; the main data processing computing unit sends an authentication request message carrying a first random number to the secondary data processing computing unit; the secondary data processing computing unit calculates a message digest based on the session key derived by the security chip and the first random number and a second random number generated locally, and carries the second random number and the message digest to respond; the main data processing computing unit verifies the response, calculates a response message digest based on the session key and the second random number, and returns it; the secondary data processing computing unit verifies the response message digest, and establishes a mutually authenticated communication connection after the verification is passed.

5. A secure distributed data processing method for continuous variable quantum key distribution, based on the secure distributed data processing system for continuous variable quantum key distribution according to any one of claims 1 to 4, characterized in that, Comprise: Step S1: In a unified security domain, the main data processing computing unit and the plurality of secondary data processing computing units complete identity authentication based on the security chip, and establish a trusted communication connection; Step S2: The main data processing computing unit periodically monitors the state information of the quantum link and the secondary data processing computing unit, and dynamically allocates data processing tasks to each secondary data processing computing unit; Step S3: The secondary data processing computing unit executes data processing, and returns the processing result to the main data processing computing unit.

6. The secure distributed data processing method of continuous variable quantum key distribution according to claim 5, wherein, The communication between the main data processing computing unit and the secondary data processing computing unit is based on the security chip to periodically derive a session key and challenge-response for identity authentication, and the derived session key is destroyed after the meeting ends.

7. The secure distributed data processing method of continuous variable quantum key distribution according to claim 5, wherein, The step S2 comprises the following sub-steps: Step S2.1: periodically collect quantum link state vector L(t), L(t) includes the apparent signal-to-noise ratio SNR of each data unit within the sampling period t meas,i (t) and the normalized total noise ξ norm (t), and: ； Step S2.2: Calculate the extended link quality index, and perform task redistribution based on its dynamic change; Step S2.3: Perform multi-level complexity scenario mapping based on the extended link quality index to obtain a scenario parameter R; Step S2.4: The main data processing computing unit pre-allocates data processing tasks in a distributed manner according to the scenario parameter R, and performs dynamic scheduling according to the load state vector Ai(t) of the main and secondary data processing computing units.

8. The secure distributed data processing method of continuous variable quantum key distribution according to claim 7, wherein, The calculation formula for the extended link quality index includes: wherein SNR meas,i (t) is the apparent signal-to-noise ratio corresponding to the i-th data unit in period t, on a linear scale; ξ norm (t) is the total noise normalized to [0, 1) in period t; ELQI(t) represents the extended link quality indicator; τ is a link quality mapping parameter; and parameter N represents the number of samples counted in the current sampling period t. gamma i (t) is the link quality sample value corresponding to the ith data unit in period t, and its formula includes: α is a configurable noise weighting parameter.

9. The secure distributed data processing method of continuous variable quantum key distribution according to claim 5, wherein, The secondary data processing computing unit adopts a preset pipeline thread, including a receiving thread, a processing thread, a return thread, and a feedback thread; the secondary data processing computing units are prohibited from communicating with each other and only communicate with the main data processing computing unit.

10. The secure distributed data processing method of continuous variable quantum key distribution according to claim 5, wherein, When the periodic load state vector of a certain data processing computing unit exceeds a preset threshold, the distribution of new tasks to that data processing computing unit is suspended and the tasks are transferred to other data processing computing units.

Images