Cross-domain KMS redirection system, method and apparatus based on quantum key distribution

Abstract

The application discloses a cross-domain KMS redirection system, method, device, equipment and medium based on quantum key distribution, and relates to the technical field of key management systems. The system comprises a central management platform, a first key management system and a second key management system. The central management platform is used for sending a quantum migration key acquisition instruction and a to-be-migrated equipment list to the first key management system, sending the quantum migration key acquisition instruction to the second key management system, and sending a quantum migration key verification instruction to the first key management system. The mapping relationship between each equipment and the key management system is updated. The first key management system is used for applying for a quantum migration key from a quantum key distribution network. The first key management system is used for sending a preset pre-priming quantum key to the second key management system. The second key management system is used for applying for a quantum migration key from a quantum key distribution network. The second key management system is used for receiving a preset pre-priming quantum key. Therefore, the application helps to relieve the security and accuracy problems in the key migration process and reduce the service interruption risk.

Description

Technical Field

[0001] This invention belongs to the field of quantum key management, specifically relating to a cross-domain KMS redirection system, method, apparatus, device, and medium based on quantum key distribution. Background Technology

[0002] In the application of quantum key management systems (KMS), a major technical challenge is ensuring the secure and accurate transfer of pre-charged quantum keys stored in the original KMS to the new KMS, and synchronously updating the association between the device and the new KMS, when migrating a device from one KMS to another. Inconsistent keys, insecure transmission, or untimely device configuration updates during the migration process could lead to key service interruptions or key information leaks. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a cross-domain KMS redirection system, method, apparatus, device and medium based on quantum key distribution to overcome or at least partially solve the problem of how to ensure that the pre-charged quantum key pre-stored in the original KMS can be securely and accurately transferred to the new KMS and synchronously update the association between the device and the new KMS.

[0004] In a first aspect, embodiments of the present invention provide a cross-domain KMS redirection system based on quantum key distribution, the system comprising: a central management platform, a first key management system, and a second key management system; The central management platform is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system; upon receiving a first response information, it sends the quantum migration key acquisition instruction to the second key management system; upon receiving a second response information, it sends a quantum migration key verification instruction to the first key management system; it receives a preset pre-charged quantum key migration completion notification from the first key management system; and according to the preset pre-charged quantum key migration completion notification, it updates the mapping relationship between each device in the list of devices to be migrated and the second key management system. The first key management system is configured to: apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction; after obtaining the quantum migration key, send a first response message to the central management platform; generate verification information based on the quantum migration key in response to the quantum migration key verification instruction sent by the central management platform; send the verification information to the second key management system; encrypt a preset pre-charged quantum key to be migrated based on the quantum migration key in response to a third response message sent by the second key management system; send the encrypted preset pre-charged quantum key to the second key management system; and, in response to a fourth response message, notify each device in the list of devices to be migrated through a preset device management interface, update the binding relationship of the key management system, and send a preset pre-charged quantum key migration completion notification to the central management platform. The second key management system is configured to, in response to the quantum migration key acquisition instruction, apply to the quantum key distribution network for a quantum migration key; after acquiring the quantum migration key, send a second response message to the central management platform; receive verification information sent by the first key management system; complete the consistency verification of the quantum migration key based on the verification information, and return a third response message to the first key management system; receive an encrypted preset pre-charged quantum key sent by the first key management system; decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; and send a fourth response message to the first key management system.

[0005] Optionally, the quantum migration key verification instruction includes a national cryptographic algorithm verification instruction, the verification information includes the first hash value of the quantum migration key, and the central management platform is used to send the national cryptographic algorithm verification instruction to the first key management system; The first key management system is used to respond to the national cryptographic algorithm verification command, determine the first hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and send the hash value to the second key management system; The second key management system is used to receive the first hash value of the quantum migration key sent by the first key management system; determine the second hash value of the quantum migration key based on the national cryptographic SM3 algorithm; perform consistency verification on the first hash value and the second hash value; and complete the consistency verification of the quantum migration key after the consistency verification is passed.

[0006] Optionally, the first key management system is used to encrypt the preset pre-charged quantum key based on the national cryptographic SM4 algorithm and the quantum migration key; The second key management system is used to decrypt the encrypted preset pre-charged quantum key using the quantum migration key based on the national cryptographic SM4 algorithm, and obtain the preset pre-charged quantum key.

[0007] Secondly, embodiments of the present invention provide a cross-domain KMS redirection method based on quantum key distribution, applied to a central management platform, the method comprising: Send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system, so that the first key management system can apply for a quantum migration key from the quantum key distribution network according to the first quantum migration key acquisition instruction and return a first response information after successful acquisition; Upon receiving the first response information, the quantum migration key acquisition instruction is sent to the second key management system, so that the second key management system applies for a quantum migration key from the quantum key distribution network according to the quantum migration key acquisition instruction, and returns the second response information after successful acquisition; Upon receiving the second response information, a quantum migration key verification instruction is sent to the first key management system, so that the first key management system generates verification information based on the quantum migration key and sends it to the second key management system for quantum migration key consistency verification. Receive a notification from the first key management system that the pre-charged quantum key migration is complete; Based on the migration completion notification, update the mapping relationship between each device in the list of devices to be migrated and the second key management system.

[0008] Optionally, the quantum migration key verification instruction includes a national cryptographic algorithm verification instruction, and sending the quantum migration key verification instruction to the first key management system includes: The first key management system sends the national cryptographic algorithm verification command to the first key management system, so that the first key management system determines the hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and sends the hash value to the second key management system for quantum migration key consistency verification.

[0009] Thirdly, embodiments of the present invention provide a cross-domain KMS redirection method based on quantum key distribution, applied to a first key management system, the method comprising: Receive the quantum migration key acquisition instruction and the list of devices to be migrated sent by the central management platform; In response to the quantum transfer key acquisition instruction, a quantum transfer key is requested from the quantum key distribution network; After obtaining the quantum migration key, a first response message is sent to the central management platform, so that after receiving the first response message, the central management platform sends the quantum migration key acquisition instruction to the second key management platform. In response to the quantum migration key verification command sent by the central management platform, verification information is generated based on the quantum migration key; The verification information is sent to the second key management system, so that the second key management system can complete the consistency verification of the quantum transfer key based on the verification information and return the third response information; In response to the third response information sent by the second key management system, the preset pre-charged quantum key to be migrated is encrypted based on the quantum migration key; The encrypted preset pre-charged quantum key is sent to the second key management system, so that the second key management system decrypts the encrypted preset pre-charged quantum key, obtains the preset pre-charged quantum key, completes the preset pre-charged quantum key migration, and returns the fourth response information; In response to the fourth response information, each device in the list of devices to be migrated is notified through a preset device management interface to update the binding relationship of the key management system, and a preset pre-charged quantum key migration completion notification is sent to the central management platform so that the central management platform updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

[0010] Optionally, the quantum migration key verification instruction includes a national cryptographic algorithm verification instruction, and the step of generating verification information based on the quantum migration key in response to the quantum migration key verification instruction sent by the central management platform includes: In response to the national cryptographic algorithm verification command, the first hash value of the quantum migration key is determined based on the national cryptographic SM3 algorithm, and the hash value is sent to the second key management system so that the second key management system performs quantum migration key consistency verification based on the hash value.

[0011] Optionally, the step of encrypting the preset pre-charged quantum key to be migrated based on the quantum migration key in response to the third response information sent by the second key management system includes: The preset pre-charged quantum key is encrypted using the national cryptographic SM4 algorithm and the quantum migration key.

[0012] Fourthly, embodiments of the present invention provide a cross-domain KMS redirection method based on quantum key distribution, applied to a second key management system, the method comprising: Receive the quantum migration key acquisition instruction sent by the central management platform; In response to the quantum transfer key acquisition instruction, a quantum transfer key is requested from the quantum key distribution network; After obtaining the quantum migration key, a second response message is sent to the central management platform, so that the central management platform sends a quantum migration key verification instruction to the first key management system after receiving the second response message. Receive verification information sent by the first key management system; Based on the verification information, the consistency verification of the quantum migration key is completed, and a third response information is returned to the first key management system, so that the first key management system responds to the third response information and performs encryption processing on the preset pre-charged quantum key to be migrated based on the quantum migration key; Receive the encrypted preset pre-charged quantum key sent by the first key management system; Decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; A fourth response message is sent to the first key management system, so that the first key management system responds to the fourth response message, notifies each device in the list of devices to be migrated through a preset device management interface, updates the binding relationship of the key management system, and sends a preset pre-charged quantum key migration completion notification to the central management platform.

[0013] Optionally, the verification information includes a first hash value of the quantum transfer key, and the process of verifying the consistency of the quantum transfer key based on the verification information includes: Receive the first hash value of the quantum migration key sent by the first key management system; The second hash value of the quantum migration key is determined based on the national cryptographic SM3 algorithm; The consistency verification of the first hash value and the second hash value is performed. After the consistency verification is passed, the consistency verification of the quantum migration key is completed.

[0014] Optionally, decrypting the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key includes: Based on the national cryptographic SM4 algorithm, the quantum migration key is used to decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key.

[0015] Fifthly, embodiments of the present invention provide a cross-domain KMS redirection device based on quantum key distribution, applied to a central management platform, the device comprising: The first acquisition instruction sending module is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system, so that the first key management system can apply for a quantum migration key from the quantum key distribution network according to the first quantum migration key acquisition instruction and return a first response information after successful acquisition. The second acquisition instruction sending module is used to send the quantum migration key acquisition instruction to the second key management system upon receiving the first response information, so that the second key management system can apply for a quantum migration key from the quantum key distribution network according to the quantum migration key acquisition instruction, and return the second response information after successful acquisition; The verification module is used to send a quantum migration key verification instruction to the first key management system after receiving the second response information, so that the first key management system generates verification information based on the quantum migration key and sends it to the second key management system for quantum migration key consistency verification. The notification receiving module is used to receive a preset pre-charged quantum key migration completion notification sent by the first key management system; The mapping update module is used to update the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

[0016] Optionally, the quantum transfer key verification instruction includes a national cryptographic algorithm verification instruction, and the verification module includes: The DM3 encryption submodule is used to send the national cryptographic algorithm verification instruction to the first key management system, so that the first key management system determines the hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and sends the hash value to the second key management system for quantum migration key consistency verification.

[0017] Sixthly, embodiments of the present invention provide a cross-domain KMS redirection device based on quantum key distribution, applied to a first key management system, the device comprising: The instruction acquisition module is used to receive the quantum migration key acquisition instruction and the list of devices to be migrated sent by the central management platform; The first key application module is used to apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction; The first response message sending module is used to send a first response message to the central management platform after obtaining the quantum migration key, so that after receiving the first response message, the central management platform sends the quantum migration key acquisition instruction to the second key management platform. The verification information generation module is used to generate verification information based on the quantum migration key in response to the quantum migration key verification command sent by the central management platform. The verification information sending module is used to send the verification information to the second key management system, so that the second key management system can complete the consistency verification of the quantum migration key based on the verification information and return the third response information; The key encryption module is used to encrypt the preset pre-charged quantum key to be migrated based on the quantum migration key in response to the third response information sent by the second key management system. The encryption key sending module is used to send the encrypted preset pre-charged quantum key to the second key management system, so that the second key management system can decrypt the encrypted preset pre-charged quantum key, obtain the preset pre-charged quantum key, complete the preset pre-charged quantum key migration, and return the fourth response information; The binding update module is used to respond to the fourth response information, notify each device in the list of devices to be migrated through a preset device management interface, update the binding relationship of the key management system, and send a preset pre-charged quantum key migration completion notification to the central management platform, so that the central management platform updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

[0018] Optionally, the quantum transfer key verification instruction includes a national cryptographic algorithm verification instruction, and the verification information generation module includes: The hash value determination submodule is used to respond to the national cryptographic algorithm verification command, determine the first hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and send the hash value to the second key management system so that the second key management system can perform quantum migration key consistency verification based on the hash value. Optionally, the key encryption module includes: The SM4 encryption submodule is used to encrypt the preset pre-charged quantum key based on the national cryptographic SM4 algorithm and the quantum migration key.

[0019] In a seventh aspect, embodiments of the present invention provide a cross-domain KMS redirection device based on quantum key distribution, applied to a second key management system, the device comprising: The key acquisition instruction acquisition module is used to receive the quantum migration key acquisition instruction sent by the central management platform; The second key application module is used to apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction. The second response message sending module is used to send a second response message to the central management platform after obtaining the quantum migration key, so that the central management platform sends a quantum migration key verification instruction to the first key management system after receiving the second response message. The verification message receiving module is used to receive verification information sent by the first key management system; The consistency verification module is used to complete the consistency verification of the quantum migration key according to the verification information, and return the third response information to the first key management system, so that the first key management system responds to the third response information and performs encryption processing on the preset pre-charged quantum key to be migrated based on the quantum migration key; A preset key receiving module is used to receive an encrypted preset pre-charged quantum key sent by the first key management system; A preset key decryption module is used to decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; The fourth response message sending module is used to send a fourth response information to the first key management system, so that the first key management system responds to the fourth response information, notifies each device in the list of devices to be migrated through a preset device management interface, updates the binding relationship of the key management system, and sends a preset pre-charged quantum key migration completion notification to the central management platform.

[0020] Optionally, the verification information includes the first hash value of the quantum transfer key, and the consistency verification module includes: The hash value receiving submodule is used to receive the first hash value of the quantum migration key sent by the first key management system; The second hash value determination submodule is used to determine the second hash value of the quantum migration key based on the national cryptographic SM3 algorithm. The hash value consistency verification module is used to verify the consistency of the first hash value and the second hash value, and after the consistency verification is passed, the consistency verification of the quantum migration key is completed.

[0021] Optionally, the preset key decryption module includes: The SM4 decryption submodule is used to decrypt the encrypted preset pre-charged quantum key using the quantum migration key based on the national cryptographic SM4 algorithm, and obtain the preset pre-charged quantum key.

[0022] Eighthly, embodiments of the present invention provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the second, third, or fourth aspects.

[0023] In a ninth aspect, embodiments of the present invention provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the second, third, or fourth aspect.

[0024] In this embodiment of the invention, a central management platform is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to a first key management system; upon receiving a first response message, it sends a quantum migration key acquisition instruction to a second key management system; upon receiving a second response message, it sends a quantum migration key verification instruction to the first key management system; and the first key management system, in response to the quantum migration key acquisition instruction, applies for a quantum migration key from a quantum key distribution network; in response to a third response message sent by the second key management system, it encrypts the preset pre-charged quantum key to be migrated based on the quantum migration key; and sends the encrypted preset pre-charged quantum key to the second key management system, and combines it with... The second key management system, in response to a quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network; receives an encrypted pre-charged quantum key sent by the first key management system; decrypts the encrypted pre-charged quantum key to obtain the pre-charged quantum key, and finally transmits it through the central management platform; and updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the pre-charged quantum key migration completion notification. This method helps ensure the consistency and transmission security of the pre-charged quantum key during the migration process, and can synchronously update the association relationship between the device and the new key management system, thereby helping to alleviate security and accuracy issues during the key migration process and reducing the risk of service interruption. Attached Figure Description

[0025] Figure 1 This is a structural block diagram of an embodiment of a cross-domain KMS redirection system based on quantum key distribution according to the present invention; Figure 2 This is a flowchart illustrating the steps of an embodiment of a cross-domain KMS redirection method based on quantum key distribution according to the present invention. Figure 3 This is a flowchart illustrating the steps of another embodiment of the cross-domain KMS redirection method based on quantum key distribution of the present invention; Figure 4This is a flowchart illustrating the steps of another embodiment of the cross-domain KMS redirection method based on quantum key distribution of the present invention; Figure 5 This is a flowchart illustrating the pre-charge of a quantum key in an embodiment of a cross-domain KMS redirection method based on quantum key distribution according to the present invention; Figure 6 This is a structural block diagram of an embodiment of a cross-domain KMS redirection device based on quantum key distribution according to the present invention; Figure 7 This is a block diagram of another embodiment of the cross-domain KMS redirection device based on quantum key distribution of the present invention; Figure 8 This is a block diagram of another embodiment of the cross-domain KMS redirection device based on quantum key distribution of the present invention. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] The terms "first," "second," etc., used in the specification and claims of this invention are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0028] The cross-domain KMS redirection method, apparatus, device, and medium based on quantum key distribution provided by the present invention will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.

[0029] Reference Figure 1 The diagram shows a structural block diagram of an embodiment of a cross-domain KMS redirection system based on quantum key distribution according to the present invention, which may specifically include the following modules: a central management platform 101, a first key management system 102, and a second key management system 103; The central management platform 101 is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system 102; upon receiving a first response information, it sends the quantum migration key acquisition instruction to the second key management system 103; upon receiving a second response information, it sends a quantum migration key verification instruction to the first key management system 102; it receives a preset pre-charged quantum key migration completion notification from the first key management system 102; and according to the preset pre-charged quantum key migration completion notification, it updates the mapping relationship between each device in the list of devices to be migrated and the second key management system 103. The first key management system 102 is configured to: apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction; after obtaining the quantum migration key, send a first response message to the central management platform 101; generate verification information based on the quantum migration key in response to the quantum migration key verification instruction sent by the central management platform 101; send the verification information to the second key management system 103; encrypt a preset pre-charged quantum key to be migrated based on the quantum migration key in response to a third response message sent by the second key management system 103; send the encrypted preset pre-charged quantum key to the second key management system 103; and, in response to a fourth response message, notify each device in the device list to be migrated through a preset device management interface, update the key management system binding relationship, and send a preset pre-charged quantum key migration completion notification to the central management platform 101. The second key management system 103, in response to the quantum migration key acquisition instruction, requests a quantum migration key from the quantum key distribution network; after obtaining the quantum migration key, it sends a second response message to the central management platform 101; receives verification information sent by the first key management system 102; completes the consistency verification of the quantum migration key according to the verification information, and returns a third response message to the first key management system 102; receives an encrypted preset pre-charged quantum key sent by the first key management system 102; decrypts the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; and sends a fourth response message to the first key management system 102.

[0030] The central management platform 101 serves as the coordination and control center for the entire key migration process, responsible for sending instructions to each key management system, receiving responses, and updating device mapping relationships. The first key management system 102 and the second key management system 103 are systems responsible for generating, storing, distributing, and managing quantum keys. In this embodiment, the first key management system 102 can be understood as the system currently providing key services to the devices to be migrated (source key management system), while the second key management system 103 is the new system that will take over the key services (target key management system).

[0031] The central management platform 101 is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system 102. The quantum migration key acquisition instruction is issued by the central management platform 101 to the key management system, requesting it to apply for a temporary key to encrypt and protect the pre-charged quantum key during this key migration process. The list of devices to be migrated is a list of device identifiers, such as a set of device IDs, that need to be switched from the first key management system 102 to the second key management system 103 for key management. For example, when a batch of new devices joins the network or existing devices need to change key service providers, the central management platform 101 generates a list of devices to be migrated containing these device IDs and sends it to the first key management system 102 along with the quantum migration key acquisition instruction.

[0032] Upon receiving the first response message, the central management platform 101 sends the quantum migration key acquisition instruction to the second key management system 103. The first response message is a confirmation message returned by the first key management system 102 to the central management platform 101 after successfully obtaining the quantum migration key, indicating that it is ready to proceed with the subsequent migration steps. Upon receiving this message, the central management platform 101 knows that the first key management system 102 is ready and then sends the same quantum migration key acquisition instruction to the second key management system 103, ensuring that both parties participate in the quantum migration key application process.

[0033] After receiving the second response information, the central management platform 101 sends a quantum migration key verification command to the first key management system 102. The second response information is a confirmation message returned by the second key management system 103 to the central management platform 101 after successfully obtaining the quantum migration key. When the central management platform 101 receives response information from both the first and second key management systems simultaneously, it indicates that both have obtained the quantum migration key. At this point, it needs to verify whether the quantum migration keys obtained by both parties are consistent, therefore, it sends a quantum migration key verification command to the first key management system 102. The quantum migration key verification command is the instruction that triggers a quantum migration key consistency check between the first key management system 102 and the second key management system 103.

[0034] The central management platform 101 receives a notification from the first key management system 102 indicating that the migration of the pre-charged quantum key is complete. The pre-charged quantum key refers to a quantum key that has been pre-filled and stored in the first key management system 102 for use by devices for a period of time. The notification of completion of the pre-charged quantum key migration is a final confirmation message sent by the first key management system 102 to the central management platform 101 after completing the migration of all pre-charged quantum keys related to the devices to be migrated and updating the device binding relationships.

[0035] Based on the pre-charged quantum key migration completion notification, the central management platform 101 updates the mapping relationship between each device in the list of devices to be migrated and the second key management system 103. The mapping relationship between devices and key management systems records which key management system is responsible for providing key services to which device, and is typically stored in the database of the central management platform 101. For example, if devices A, B, and C were originally mapped to the first key management system 102, after receiving the migration completion notification, the central management platform 101 will modify these mapping relationships to be associated with the second key management system 103. Thereafter, key requests from these devices will be directly sent to the second key management system 103.

[0036] The first key management system 102 is used to request a quantum migration key from a quantum key distribution network in response to the quantum migration key acquisition instruction. A quantum key distribution network is a network infrastructure capable of generating and distributing secure keys based on quantum mechanics principles. Upon receiving the quantum migration key acquisition instruction, the first key management system 102 requests the quantum migration key through its interface connected to the quantum key distribution network, following the network's defined protocols and procedures. A quantum migration key is a temporary session key used to encrypt and protect a pre-charged quantum key during migration, preventing it from being stolen or tampered with during transmission. A simple implementation could be that the first key management system 102 sends a key request to a key generation node in the quantum key distribution network, containing identification information for this migration. The key generation node then generates a pair of identical quantum migration keys based on the request and sends one of them to the first key management system 102 via a secure channel.

[0037] After obtaining the quantum migration key, the first key management system 102 sends a first response message to the central management platform 101. For example, after successfully receiving the quantum migration key returned by the quantum key distribution network, the first key management system 102 will construct a first response message containing "Status: Success, Migration Key ID: XXX" and send it to the central management platform 101.

[0038] In response to the quantum migration key verification command sent by the central management platform 101, the first key management system 102 generates verification information based on the quantum migration key. The verification information is generated by the first key management system 102 using the acquired quantum migration key through a certain algorithm, and is used by the second key management system 103 to verify whether the quantum migration keys of both parties are consistent. A simple implementation could be that the first key management system 102 uses a hash algorithm (such as SHA256) to calculate a hash value for the quantum migration key, and uses this hash value as the verification information.

[0039] The first key management system 102 sends the verification information to the second key management system 103. For example, the transmission can be made via a dedicated communication link or encrypted channel between the first key management system 102 and the second key management system 103.

[0040] In response to the third response information sent by the second key management system 103, the first key management system 102 performs encryption processing on the preset pre-charged quantum key to be migrated based on the quantum migration key. The third response information is a confirmation message returned by the second key management system 103 to the first key management system 102 after successfully verifying the consistency of the quantum migration key. The preset pre-charged quantum key is a key that the first key management system 102 has pre-generated and stored for the device to be migrated. Encryption processing refers to using the quantum migration key to perform encryption operations on the preset pre-charged quantum key, for example, using a symmetric encryption algorithm (such as AES), using the quantum migration key as the encryption key to encrypt the plaintext of the preset pre-charged quantum key to obtain ciphertext.

[0041] The first key management system 102 sends the encrypted preset pre-charged quantum key to the second key management system 103. For example, the first key management system 102 extracts the preset pre-charged quantum key corresponding to all devices in the list of devices to be migrated from its storage unit, encrypts it with the quantum migration key, and sends it to the second key management system 103.

[0042] In response to the fourth response message, the first key management system 102 notifies each device in the list of devices to be migrated through a preset device management interface to update the key management system binding relationship and sends a preset pre-charged quantum key migration completion notification to the central management platform 101. The fourth response message is a confirmation message returned by the second key management system 103 to the first key management system 102 after successfully decrypting and receiving the preset pre-charged quantum key. The preset device management interface is the interface for management information exchange between the first key management system 102 and each device to be migrated, such as a dedicated management port based on the TCP / IP protocol. The notification to update the key management system binding relationship can be an instruction containing the address information of the second key management system 103 (such as IP address and port number). After receiving this notification, the device will change the target address of its key service request from the first key management system 102 to the second key management system 103. After all devices to be migrated have received the notification and completed their own configuration updates, the first key management system 102 sends a preset pre-charged quantum key migration completion notification to the central management platform 101.

[0043] The second key management system 103, in response to the quantum migration key acquisition instruction, requests a quantum migration key from the quantum key distribution network. Its request process is similar to that of the first key management system 102, also involving sending a request to the quantum key distribution network to obtain the quantum migration key for this migration. The quantum migration keys obtained by the first and second key management systems should be the same, which is guaranteed by the mechanism of the quantum key distribution network.

[0044] After obtaining the quantum migration key, the second key management system 103 sends a second response message to the central management platform 101. This second response message is similar to the first response message and is used to inform the central management platform 101 that it has successfully obtained the quantum migration key.

[0045] The second key management system 103 receives verification information sent by the first key management system 102. For example, the second key management system 103 may listen on a specific port to receive messages containing verification information sent by the first key management system 102.

[0046] The second key management system 103 completes the consistency verification of the quantum migration key based on the verification information and returns a third response message to the first key management system 102. Consistency verification is a crucial step to ensure that the quantum migration keys possessed by the first key management system 102 and the second key management system 103 are the same. A simple implementation is that after receiving the verification information (i.e., the hash value calculated by the first key management system 102 for its quantum migration key), the second key management system 103 performs the same hash calculation using its own acquired quantum migration key, and then compares the calculation result with the received verification information. If they are the same, it means that the quantum migration keys of both parties are consistent, the verification passes, and the second key management system 103 returns a third response message containing "Verification result: Consistent" to the first key management system 102; if they are different, the verification fails, and a process of reapplying for a quantum migration key is triggered.

[0047] The second key management system 103 receives an encrypted preset pre-charged quantum key sent by the first key management system 102. This data is encrypted using a quantum transfer key, ensuring the confidentiality of the preset pre-charged quantum key during transmission from the first key management system 102 to the second key management system 103.

[0048] The second key management system 103 decrypts the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key. Since the second key management system 103 possesses the same quantum transfer key as the first key management system 102, it can use this quantum transfer key as the decryption key to decrypt the received encrypted data, thereby recovering the plaintext of the preset pre-charged quantum key. For example, using the AES decryption algorithm, inputting the quantum transfer key and the encrypted preset pre-charged quantum key, the original preset pre-charged quantum key is obtained.

[0049] The second key management system 103 sends a fourth response message to the first key management system 102. After successfully decrypting and storing the preset pre-charged quantum key, the second key management system 103 will send a fourth response message to the first key management system 102, such as "Status: Preset pre-charged key received successfully, quantity: XXX", to inform the first key management system 102 that the migrated preset pre-charged quantum key has arrived safely and is available.

[0050] In one embodiment, the quantum migration key verification instruction includes a national cryptographic algorithm verification instruction, the verification information includes the first hash value of the quantum migration key, and the central management platform 101 is used to send the national cryptographic algorithm verification instruction to the first key management system 102. The first key management system 102 is used to respond to the national cryptographic algorithm verification command, determine the first hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and send the hash value to the second key management system 103; The second key management system 103 is used to receive the first hash value of the quantum migration key sent by the first key management system 102; determine the second hash value of the quantum migration key based on the national cryptographic SM3 algorithm; perform consistency verification on the first hash value and the second hash value; and complete the consistency verification of the quantum migration key after the consistency verification is passed.

[0051] The national cryptographic algorithm verification instruction is sent by the central management platform 101 to the first key management system 102, instructing it to use the cryptographic algorithm promulgated by the State Cryptography Administration of China (i.e., the national cryptographic algorithm) to verify the consistency of the quantum migration key. The verification information includes the first hash value of the quantum migration key. The first hash value is a numerical result calculated by the first key management system 102 using a specific hash algorithm on the quantum migration key it has acquired. This hash value characterizes the uniqueness of the quantum migration key and can be used to verify the consistency of keys held by different systems.

[0052] The central management platform 101 sends a national cryptographic algorithm verification instruction to the first key management system 102, explicitly requiring the use of the national cryptographic algorithm to verify the quantum migration key.

[0053] Upon receiving the national cryptographic algorithm verification command, the first key management system 102 uses the national cryptographic algorithm SM3 to process the quantum migration key. The national cryptographic algorithm SM3 is a cryptographic hash algorithm issued by the State Cryptography Administration of China, specifically used in security fields such as data integrity verification. The first key management system 102 uses its held quantum migration key as input and calculates according to the steps specified in the national cryptographic algorithm SM3 to obtain a fixed-length value uniquely corresponding to the quantum migration key, i.e., the first hash value. Subsequently, the first key management system 102 sends this calculated first hash value to the second key management system 103.

[0054] The second key management system 103 first receives the first hash value sent by the first key management system 102. Next, the second key management system 103 calculates a second hash value for its acquired quantum transfer key using the same national cryptographic SM3 algorithm. Then, the second key management system 103 compares the received first hash value with its calculated second hash value to check if they are identical. If the first hash value and the second hash value are completely identical, it indicates that the quantum transfer keys possessed by the first key management system 102 and the second key management system 103 are the same, and the consistency verification of the quantum transfer key is successful. Only after the consistency verification is successful can the security and correctness of the pre-charged quantum key used for subsequent encrypted transmission using the quantum transfer key be ensured.

[0055] In one embodiment, the first key management system 102 is used to encrypt the preset pre-charged quantum key based on the national cryptographic SM4 algorithm and the quantum migration key; The second key management system 103 is used to decrypt the encrypted preset pre-charged quantum key using the quantum migration key based on the national cryptographic SM4 algorithm, and obtain the preset pre-charged quantum key.

[0056] Among them, the SM4 algorithm, a block cipher algorithm issued by the State Cryptography Administration of China, is suitable for encrypting and protecting sensitive information. When the first key management system 102 needs to securely transmit a pre-charged quantum key to the second key management system 103, it will use the SM4 algorithm. Specifically, the first key management system 102 will use the quantum transfer key as the encryption key for the SM4 algorithm, and the pre-charged quantum key to be transferred as plaintext data. It will then perform calculations according to the encryption process and block method specified by the SM4 algorithm, thereby converting the pre-charged quantum key into a ciphertext form that cannot be directly read, i.e., encrypting the pre-charged quantum key.

[0057] The second key management system 103 is used to decrypt the encrypted pre-charged quantum key using the quantum transfer key based on the national cryptographic SM4 algorithm to obtain the preset pre-charged quantum key. Since the second key management system 103 has passed the previous consistency verification and holds the same quantum transfer key as the first key management system 102, when the second key management system 103 receives the encrypted preset pre-charged quantum key sent by the first key management system 102, it uses the national cryptographic SM4 algorithm and the same quantum transfer key as the decryption key to perform operations on the received ciphertext data according to the decryption process specified by the SM4 algorithm, restoring the ciphertext form of the preset pre-charged quantum key to its original plaintext form, thus obtaining the preset pre-charged quantum key and completing the secure transfer of the preset pre-charged quantum key.

[0058] The central management platform sends a quantum migration key acquisition command and a list of devices to be migrated to the first key management system. Upon receiving a first response, it sends a quantum migration key acquisition command to the second key management system. Upon receiving a second response, it sends a quantum migration key verification command to the first key management system. The first key management system, in response to the quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network. In response to a third response from the second key management system, it encrypts the preset pre-charged quantum key to be migrated based on the quantum migration key. The encrypted preset pre-charged quantum key is then sent to the second key management system and combined with the second key... The management system, in response to a quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network; receives an encrypted preset pre-charged quantum key sent by the first key management system; decrypts the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key, and finally transmits it through the central management platform; and updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the preset pre-charged quantum key migration completion notification. This method helps ensure the consistency and transmission security of the pre-charged quantum key during the migration process, and can synchronously update the association relationship between the device and the new key management system, thereby helping to alleviate security and accuracy issues during the key migration process and reducing the risk of service interruption.

[0059] Reference Figure 2 The diagram illustrates a step flowchart of an embodiment of a cross-domain KMS redirection method based on quantum key distribution according to the present invention, which may specifically include the following steps: Step 201: Send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system, so that the first key management system can apply for a quantum migration key from the quantum key distribution network according to the first quantum migration key acquisition instruction and return a first response information after successful acquisition; Here, the quantum migration key acquisition instruction is a triggering instruction used to instruct the first key management system (i.e., the source key management system currently providing key services to the devices) to initiate the process of applying for a temporary key for subsequent key migration encryption. The list of devices to be migrated is a list containing the identifiers of all devices that need to be switched from the first key management system to the second key management system, such as a set of unique device IDs. The entity sending this instruction and list is typically the central management platform. Upon receiving this instruction, the first key management system, through its interface with the quantum key distribution network (QKD), initiates a quantum migration key application to the QKD according to the network protocol. The QKD, an infrastructure for generating and distributing secure keys based on quantum mechanics principles, generates the quantum migration key for this application. When the first key management system successfully receives the quantum migration key returned by the QKD, it returns a first response message to the entity that sent the instruction (the central management platform), informing the central management platform that it has successfully acquired the quantum migration key.

[0060] Step 202: Upon receiving the first response information, send the quantum migration key acquisition instruction to the second key management system, so that the second key management system can apply for a quantum migration key from the quantum key distribution network according to the quantum migration key acquisition instruction, and return the second response information after successful acquisition; After confirming that the first key management system has successfully acquired the quantum migration key (i.e., received the first response message), the central management platform sends the same quantum migration key acquisition instruction to the second key management system (the target key management system that will take over the key services). Upon receiving this instruction, the second key management system also requests a quantum migration key from the quantum key distribution network. Ideally, due to the mechanism of the quantum key distribution network, the quantum migration key obtained by the second key management system is the same as that obtained by the first key management system. After successfully acquiring the quantum migration key, the second key management system returns a second response message to the central management platform, informing it that it is ready.

[0061] Step 203: After receiving the second response information, a quantum migration key verification instruction is sent to the first key management system, so that the first key management system generates verification information based on the quantum migration key and sends it to the second key management system for quantum migration key consistency verification. When the central management platform receives the second response from the second key management system, indicating that both the first and second key management systems have acquired the quantum migration key, it sends a quantum migration key verification command to the first key management system to ensure that the acquired quantum migration keys are consistent (this is the basis for subsequent encrypted transmission). This command triggers the first key management system to generate verification information to verify key consistency. For example, the first key management system can perform a hash operation on its held quantum migration key to obtain a hash value as verification information. The first key management system sends this verification information to the second key management system. The second key management system then performs the same operation using its own held quantum migration key to generate verification information and compares the two, thereby completing the quantum migration key consistency verification.

[0062] Step 204: Receive a notification from the first key management system that the pre-charged quantum key migration is complete; Pre-loaded quantum keys refer to quantum keys that are pre-stored in the first key management system for future use by the devices to be migrated. After the quantum migration key consistency verification is successful, the first key management system uses the quantum migration key to encrypt these pre-loaded quantum keys and sends the encrypted keys to the second key management system. The second key management system decrypts and stores these keys. After completion, the first key management system notifies each device in the list of devices to be migrated to update its bound key management system to the second key management system. When all these migration-related operations (key encryption transmission, device notification) are completed, the first key management system sends a pre-loaded quantum key migration completion notification to the central management platform.

[0063] Step 205: Update the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

[0064] Upon receiving the notification from the first key management system that the pre-charged quantum key migration is complete, the central management platform knows that the key services for all devices to be migrated have been successfully switched. At this point, the central management platform updates its internal records of the mapping between devices and key management systems, changing the original mapping between all devices in the list of devices to be migrated and the first key management system to a mapping between them and the second key management system. In this way, subsequent key requests or related management operations for these devices will be directly directed by the central management platform to the second key management system.

[0065] In one embodiment, the quantum transfer key verification instruction includes a national cryptographic algorithm verification instruction, and step 203 may include the following sub-steps: Sub-step S11: Send the national cryptographic algorithm verification instruction to the first key management system, so that the first key management system determines the hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and sends the hash value to the second key management system for quantum migration key consistency verification.

[0066] The national cryptographic algorithm verification instruction is a specific type of quantum transfer key verification instruction. It explicitly instructs the first key management system to use the national cryptographic algorithm promulgated by the State Cryptography Administration of China (specifically, the national cryptographic SM3 algorithm mentioned below) to verify the consistency of the quantum transfer key.

[0067] Here, the SM3 algorithm, a cryptographic hash algorithm released by the State Cryptography Administration of China, is primarily used for data integrity verification. When the first key management system receives the verification command, it uses the SM3 algorithm to hash its held quantum migration key, generating a fixed-length hash value that uniquely corresponds to that quantum migration key. The first key management system then sends this hash value to the second key management system. Upon receiving this hash value, the second key management system uses the same SM3 algorithm to hash its own quantum migration key, obtaining another hash value, and compares the two hash values. If the two hash values ​​are completely identical, it indicates that both systems hold the same quantum migration key, and the consistency verification passes; otherwise, the verification fails. This method ensures the consistency of the quantum migration keys used by the first and second key management systems, providing a secure foundation for the subsequent encrypted transmission of pre-loaded quantum keys.

[0068] The central management platform sends a quantum migration key acquisition command and a list of devices to be migrated to the first key management system. Upon receiving a first response, it sends a quantum migration key acquisition command to the second key management system. Upon receiving a second response, it sends a quantum migration key verification command to the first key management system. The first key management system, in response to the quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network. In response to a third response from the second key management system, it encrypts the preset pre-charged quantum key to be migrated based on the quantum migration key. The encrypted preset pre-charged quantum key is then sent to the second key management system and combined with the second key... The management system, in response to a quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network; receives an encrypted preset pre-charged quantum key sent by the first key management system; decrypts the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key, and finally transmits it through the central management platform; and updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the preset pre-charged quantum key migration completion notification. This method helps ensure the consistency and transmission security of the pre-charged quantum key during the migration process, and can synchronously update the association relationship between the device and the new key management system, thereby helping to alleviate security and accuracy issues during the key migration process and reducing the risk of service interruption.

[0069] Reference Figure 3 The diagram illustrates a flowchart of another embodiment of the cross-domain KMS redirection method based on quantum key distribution of the present invention, which may specifically include the following steps: Step 301: Receive the quantum migration key acquisition instruction and the list of devices to be migrated sent by the central management platform; The primary entity executing this step is the First Key Management System. The quantum migration key acquisition instruction is issued by the central management platform, requesting the First Key Management System to apply for temporary keys for subsequent key migration encryption. The list of devices to be migrated is a list containing the identifiers of all devices that need to be switched from the First Key Management System to the Second Key Management System for key management, such as a set of unique device IDs. The First Key Management System receives this information through its communication interface with the central management platform.

[0070] Step 302: In response to the quantum transfer key acquisition instruction, request a quantum transfer key from the quantum key distribution network; A quantum key distribution network (QKD) is a network infrastructure capable of generating and distributing highly secure keys based on quantum mechanics principles. Upon receiving a quantum migration key retrieval instruction, the first key management system initiates a key application process. Through its specific interface and protocol for accessing the QKD, it sends an application request to the key generation or management nodes within the QKD to obtain the quantum migration key required for this key migration process. The quantum migration key is a temporary session key used for cryptographic protection during the migration of a pre-charged quantum key from the first key management system to the second key management system.

[0071] Step 303: After obtaining the quantum migration key, a first response message is sent to the central management platform so that after receiving the first response message, the central management platform sends the quantum migration key acquisition instruction to the second key management platform. The first response message is a confirmation message returned by the first key management system to the central management platform after successfully obtaining the quantum migration key from the quantum key distribution network. This message typically includes a status indication of successful operation. Upon receiving this first response message, the central management platform knows that the first key management system has prepared the quantum migration key and will then send the same quantum migration key acquisition command to the second key management system (target key management system) to ensure that the second key management system also obtains the same quantum migration key.

[0072] Step 304: In response to the quantum migration key verification command sent by the central management platform, generate verification information based on the quantum migration key; The quantum migration key verification command is sent by the central management platform to the first key management system after confirming that both the first and second key management systems have acquired the quantum migration key. This command triggers a key consistency check. The verification information is data generated by the first key management system using its held quantum migration key and a specific algorithm (such as a hash algorithm) to prove its key holding status. For example, a hash operation can be performed on the quantum migration key to generate a hash value as verification information.

[0073] Step 305: Send the verification information to the second key management system so that the second key management system can complete the consistency verification of the quantum migration key based on the verification information and return the third response information; The first key management system sends the generated verification information to the second key management system via a communication link. Upon receiving the verification information, the second key management system uses its own quantum transfer key to perform the same algorithm processing to generate its own verification information, which it then compares with the received verification information. If they match, it indicates that both systems hold the same quantum transfer key, and the consistency verification passes. The second key management system then returns a third response message to the first key management system, which confirms the successful verification.

[0074] Step 306: In response to the third response information sent by the second key management system, the preset pre-charged quantum key to be migrated is encrypted based on the quantum migration key; The pre-loaded quantum key refers to the quantum key resource pre-stored in the first key management system for use by devices in the device list to be migrated for a period of time in the future. After receiving the third response information (i.e., verification passed) from the second key management system, the first key management system begins to prepare for key migration. To ensure the confidentiality and integrity of the pre-loaded quantum key during transmission, the first key management system uses the quantum migration key as the encryption key and employs a symmetric encryption algorithm (such as the Chinese national standard SM4 algorithm) to encrypt the pre-loaded quantum key, converting it into ciphertext form.

[0075] Step 307: Send the encrypted preset pre-charged quantum key to the second key management system so that the second key management system can decrypt the encrypted preset pre-charged quantum key, obtain the preset pre-charged quantum key, complete the preset pre-charged quantum key migration, and return the fourth response information; The first key management system transmits the encrypted, pre-charged quantum key (ciphertext) to the second key management system via a secure communication channel. Upon receiving the encrypted data, the second key management system, possessing the same quantum transfer key, can use that key to decrypt the ciphertext, thus recovering the original pre-charged quantum key plaintext. After successfully decrypting and storing the pre-charged quantum key, the second key management system returns a fourth response message to the first key management system, informing it that the pre-charged quantum key has been successfully received and decrypted.

[0076] Step 308: In response to the fourth response information, notify each device in the list of devices to be migrated through the preset device management interface, update the binding relationship of the key management system, and send a preset pre-charged quantum key migration completion notification to the central management platform, so that the central management platform updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

[0077] The preset device management interface is a standardized interface for management information exchange between the first key management system and the devices to be migrated, such as a network management interface based on the TCP / IP protocol. After receiving the fourth response information from the second key management system, confirming the successful migration of the preset pre-charged quantum key, the first key management system sends a configuration update notification to each device in the list of devices to be migrated through the preset device management interface. This notification contains the address information of the second key management system (such as IP address and port number), instructing the device to update its key service request target from the first key management system to the second key management system. After notifying all devices to be migrated, the first key management system sends a preset pre-charged quantum key migration completion notification to the central management platform. Upon receiving this notification, the central management platform updates its internally maintained mapping table between devices and key management systems, associating the devices in the list of devices to be migrated with the second key management system. At this point, the entire key migration process is complete.

[0078] In one embodiment, the quantum transfer key verification instruction includes a national cryptographic algorithm verification instruction, and step 304 may include the following sub-steps: Sub-step S21: In response to the national cryptographic algorithm verification command, the first hash value of the quantum migration key is determined based on the national cryptographic SM3 algorithm, and the hash value is sent to the second key management system so that the second key management system performs quantum migration key consistency verification based on the hash value.

[0079] The SM3 algorithm, a cryptographic hash algorithm released by the State Cryptography Administration of China, is suitable for data integrity verification. Upon receiving a verification command, the first key management system uses the SM3 algorithm to perform a hash operation on its held quantum migration keys. Specifically, the binary data of the quantum migration key is used as input to the SM3 algorithm. The algorithm is calculated according to the compression function and iterative process defined by the SM3 algorithm, ultimately generating a fixed-length (usually 256-bit) hash value, which is called the first hash value. The first hash value is the unique digital fingerprint of the quantum migration key. If the quantum migration keys are the same, the hash values ​​calculated using the same algorithm will be completely identical. The first key management system then sends the generated first hash value to the second key management system. Upon receiving the first hash value, the second key management system uses its own quantum migration key and calculates a second hash value based on the SM3 algorithm, comparing the first hash value with the second hash value. If they are completely identical, the verification passes, indicating that both systems hold the same quantum migration keys.

[0080] In one embodiment, step 306 may include the following sub-steps: Sub-step S31: Encrypt the preset pre-charged quantum key based on the national cryptographic SM4 algorithm and the quantum migration key.

[0081] The SM4 algorithm, a block symmetric encryption algorithm released by the State Cryptography Administration of China, is characterized by high security and efficiency, making it suitable for encrypting and protecting sensitive data. In this step, the first key management system will use the SM4 algorithm and the previously acquired and verified quantum transfer key as the encryption key to encrypt the pre-loaded quantum key to be transferred. Specifically, the first key management system will divide the plaintext data of the pre-loaded quantum key into blocks according to the block size required by the SM4 algorithm (padding if necessary). Then, using the quantum transfer key, it will perform encryption operations on each block through the round function, nonlinear transformation, and key expansion steps specified by the SM4 algorithm, ultimately converting the plaintext of the pre-loaded quantum key into an unreadable ciphertext form. This ensures that even if the pre-loaded quantum key is intercepted during its transmission from the first key management system to the second key management system, a third party cannot know its true content, thus guaranteeing the confidentiality of the key transfer.

[0082] The central management platform sends a quantum migration key acquisition command and a list of devices to be migrated to the first key management system. Upon receiving a first response, it sends a quantum migration key acquisition command to the second key management system. Upon receiving a second response, it sends a quantum migration key verification command to the first key management system. The first key management system, in response to the quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network. In response to a third response from the second key management system, it encrypts the preset pre-charged quantum key to be migrated based on the quantum migration key. The encrypted preset pre-charged quantum key is then sent to the second key management system and combined with the second key... The management system, in response to a quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network; receives an encrypted preset pre-charged quantum key sent by the first key management system; decrypts the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key, and finally transmits it through the central management platform; and updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the preset pre-charged quantum key migration completion notification. This method helps ensure the consistency and transmission security of the pre-charged quantum key during the migration process, and can synchronously update the association relationship between the device and the new key management system, thereby helping to alleviate security and accuracy issues during the key migration process and reducing the risk of service interruption.

[0083] Reference Figure 4The diagram illustrates a flowchart of another embodiment of the cross-domain KMS redirection method based on quantum key distribution of the present invention, which may specifically include the following steps: Step 401: Receive the quantum migration key acquisition instruction sent by the central management platform; The entity executing this step is the second key management system, which receives instructions from the central management platform. The purpose of these instructions is to request the second key management system to obtain the quantum migration key for key migration.

[0084] Step 402: In response to the quantum transfer key acquisition instruction, request a quantum transfer key from the quantum key distribution network; Upon receiving the quantum migration key acquisition instruction, the second key management system, similar to the first key management system, requests a quantum migration key from the quantum key distribution network through its interface and protocol for accessing the network, in order to obtain the same temporary encryption key as the first key management system.

[0085] Step 403: After obtaining the quantum migration key, a second response message is sent to the central management platform so that the central management platform sends a quantum migration key verification instruction to the first key management system after receiving the second response message. The second response message is a confirmation message returned by the second key management system to the central management platform after successfully acquiring the quantum migration key. Upon receiving this message and confirming that both the first and second key management systems have acquired the key, the central management platform will trigger the subsequent key consistency verification process.

[0086] Step 404: Receive verification information sent by the first key management system; The verification information is generated by the first key management system based on the quantum migration key it holds, and is used to prove the consistency of the keys between the two parties; for example, it is a hash value.

[0087] Step 405: Based on the verification information, complete the consistency verification of the quantum migration key and return the third response information to the first key management system so that the first key management system responds to the third response information and performs encryption processing on the preset pre-charged quantum key to be migrated based on the quantum migration key; The second key management system uses its own quantum migration key and the same algorithm (e.g., the national standard SM3 algorithm) as the first key management system to generate verification information (such as a second hash value), and compares it with the received first hash value. If they match, the verification is successful, and a third response message containing the verification success status is returned to the first key management system, allowing it to begin encrypting the preset pre-charged quantum key to be migrated.

[0088] Step 406: Receive the encrypted preset pre-charged quantum key sent by the first key management system; The second key management system receives preset pre-charged quantum key data (ciphertext form) encrypted by the first key management system using a quantum migration key.

[0089] Step 407: Decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; Since the second key management system holds the same quantum migration key, it will use this key and the corresponding decryption algorithm (such as the national standard SM4 algorithm) to decrypt the received encrypted data and recover the plaintext of the preset pre-charged quantum key.

[0090] Step 408: Send a fourth response message to the first key management system so that the first key management system responds to the fourth response message by notifying each device in the list of devices to be migrated through a preset device management interface, updating the key management system binding relationship, and sending a preset pre-charged quantum key migration completion notification to the central management platform.

[0091] The fourth response message is an acknowledgment message returned by the second key management system to the first key management system after successfully decrypting and receiving the preset pre-charged quantum key. This message triggers the first key management system to notify the device to update its configuration, and ultimately, the first key management system reports the migration completion to the central management platform. Since this embodiment is related to the foregoing embodiments, only a brief explanation is provided here to avoid redundancy.

[0092] In one embodiment, the verification information includes a first hash value of the quantum transfer key, and step 405 may include the following sub-steps: Sub-step S41: Receive the first hash value of the quantum migration key sent by the first key management system; Here, the first hash value is the result obtained by the first key management system using the national cryptographic algorithm SM3 to perform a hash operation on the quantum migration key it holds. The second key management system receives this first hash value through the communication link with the first key management system.

[0093] Sub-step S42: Based on the national cryptographic SM3 algorithm, determine the second hash value of the quantum transfer key; The second key management system uses the same national cryptographic SM3 algorithm as the first key management system to perform a hash operation on the quantum migration key it obtains from the quantum key distribution network, thereby generating a corresponding second hash value.

[0094] Sub-step S43: Perform consistency verification on the first hash value and the second hash value. After the consistency verification is passed, complete the consistency verification of the quantum migration key.

[0095] The second key management system compares the received first hash value with its own calculated second hash value bit by bit. If every bit of the two hash values ​​is exactly the same, the consistency verification passes, indicating that the quantum transfer key held by the first and second key management systems is completely consistent. This completes the consistency verification process for the quantum transfer key.

[0096] In one embodiment, step 407 may include the following sub-steps: Sub-step S51: Based on the national cryptographic SM4 algorithm, the quantum migration key is used to decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key.

[0097] The SM4 algorithm, a national standard cryptographic algorithm, is a block symmetric encryption algorithm that uses the same key for both encryption and decryption. After receiving the pre-charged quantum key (i.e., ciphertext) from the first key management system, the second key management system uses its consensus-verified quantum transfer key as the decryption key and applies the decryption process of the SM4 algorithm. Specifically, the second key management system divides the ciphertext data containing the pre-charged quantum key into blocks according to the block size required by the SM4 algorithm. Then, using the quantum transfer key, it performs decryption operations on each block of ciphertext data through steps such as inverse round function transformation and nonlinear inverse transformation, restoring the ciphertext to the original plaintext form of the pre-charged quantum key, thus successfully obtaining the pre-charged quantum key.

[0098] Reference Figure 5 This paper illustrates the registration process of a preset charging key in an embodiment of a cross-domain KMS redirection device based on quantum key distribution according to the present invention. The specific content is as follows: The charging personnel initiate pre-charging by connecting to the device using charging software on their terminal. The device returns its local serial number (SN) to the charging software. The charging software generates an SPMID using a preset algorithm and requests a KMS1 with the SPMID. Upon receiving the request, KMS1 requests a pre-charged quantum key from the QKD network. After receiving the pre-charged quantum key, KMS1 stores a copy and returns it to the charging software. The charging software, upon receiving the pre-charged quantum key, returns it to the device. The device stores the pre-charged quantum key and returns a success response. After receiving the successful response from the device, KMS1 uploads the binding relationship between the SPMID and KMS1 to the CMSP. The CMSP stores the relationship between the device's SPMID and KMS1. After key pre-charging, both the device and KMS1 store a copy of the pre-charged key, and the device and CMSP store the relationship between the device and KMS1.

[0099] The central management platform sends a quantum migration key acquisition command and a list of devices to be migrated to the first key management system. Upon receiving a first response, it sends a quantum migration key acquisition command to the second key management system. Upon receiving a second response, it sends a quantum migration key verification command to the first key management system. The first key management system, in response to the quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network. In response to a third response from the second key management system, it encrypts the preset pre-charged quantum key to be migrated based on the quantum migration key. The encrypted preset pre-charged quantum key is then sent to the second key management system and combined with the second key... The management system, in response to a quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network; receives an encrypted preset pre-charged quantum key sent by the first key management system; decrypts the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key, and finally transmits it through the central management platform; and updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the preset pre-charged quantum key migration completion notification. This method helps ensure the consistency and transmission security of the pre-charged quantum key during the migration process, and can synchronously update the association relationship between the device and the new key management system, thereby helping to alleviate security and accuracy issues during the key migration process and reducing the risk of service interruption.

[0100] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0101] Reference Figure 6 The diagram shows a structural block diagram of an embodiment of a cross-domain KMS redirection device based on quantum key distribution according to the present invention. The specific details are as follows: The first acquisition instruction sending module is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system, so that the first key management system can apply for a quantum migration key from the quantum key distribution network according to the first quantum migration key acquisition instruction and return a first response information after successful acquisition. The second acquisition instruction sending module is used to send the quantum migration key acquisition instruction to the second key management system upon receiving the first response information, so that the second key management system can apply for a quantum migration key from the quantum key distribution network according to the quantum migration key acquisition instruction, and return the second response information after successful acquisition; The verification module is used to send a quantum migration key verification instruction to the first key management system after receiving the second response information, so that the first key management system generates verification information based on the quantum migration key and sends it to the second key management system for quantum migration key consistency verification. The notification receiving module is used to receive a preset pre-charged quantum key migration completion notification sent by the first key management system; The mapping update module is used to update the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

[0102] In one embodiment, the quantum transfer key verification instruction includes a national cryptographic algorithm verification instruction, and the verification module includes: The DM3 encryption submodule is used to send the national cryptographic algorithm verification instruction to the first key management system, so that the first key management system determines the hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and sends the hash value to the second key management system for quantum migration key consistency verification.

[0103] Reference Figure 7 The diagram illustrates a structural block diagram of another embodiment of the cross-domain KMS redirection device based on quantum key distribution according to the present invention, the details of which are as follows: The instruction acquisition module is used to receive the quantum migration key acquisition instruction and the list of devices to be migrated sent by the central management platform; The first key application module is used to apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction; The first response message sending module is used to send a first response message to the central management platform after obtaining the quantum migration key, so that after receiving the first response message, the central management platform sends the quantum migration key acquisition instruction to the second key management platform. The verification information generation module is used to generate verification information based on the quantum migration key in response to the quantum migration key verification command sent by the central management platform. The verification information sending module is used to send the verification information to the second key management system, so that the second key management system can complete the consistency verification of the quantum migration key based on the verification information and return the third response information; The key encryption module is used to encrypt the preset pre-charged quantum key to be migrated based on the quantum migration key in response to the third response information sent by the second key management system. The encryption key sending module is used to send the encrypted preset pre-charged quantum key to the second key management system, so that the second key management system can decrypt the encrypted preset pre-charged quantum key, obtain the preset pre-charged quantum key, complete the preset pre-charged quantum key migration, and return the fourth response information; The binding update module is used to respond to the fourth response information, notify each device in the list of devices to be migrated through a preset device management interface, update the binding relationship of the key management system, and send a preset pre-charged quantum key migration completion notification to the central management platform, so that the central management platform updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

[0104] In one embodiment, the quantum transfer key verification instruction includes a national cryptographic algorithm verification instruction, and the verification information generation module includes: The hash value determination submodule is used to respond to the national cryptographic algorithm verification command, determine the first hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and send the hash value to the second key management system so that the second key management system can perform quantum migration key consistency verification based on the hash value. In one embodiment, the key encryption module includes: The SM4 encryption submodule is used to encrypt the preset pre-charged quantum key based on the national cryptographic SM4 algorithm and the quantum migration key.

[0105] Reference Figure 8 The diagram illustrates a structural block diagram of another embodiment of the cross-domain KMS redirection device based on quantum key distribution according to the present invention, the details of which are as follows: The key acquisition instruction acquisition module is used to receive the quantum migration key acquisition instruction sent by the central management platform; The second key application module is used to apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction. The second response message sending module is used to send a second response message to the central management platform after obtaining the quantum migration key, so that the central management platform sends a quantum migration key verification instruction to the first key management system after receiving the second response message. The verification message receiving module is used to receive verification information sent by the first key management system; The consistency verification module is used to complete the consistency verification of the quantum migration key according to the verification information, and return the third response information to the first key management system, so that the first key management system responds to the third response information and performs encryption processing on the preset pre-charged quantum key to be migrated based on the quantum migration key; A preset key receiving module is used to receive an encrypted preset pre-charged quantum key sent by the first key management system; A preset key decryption module is used to decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; The fourth response message sending module is used to send a fourth response information to the first key management system, so that the first key management system responds to the fourth response information, notifies each device in the list of devices to be migrated through a preset device management interface, updates the binding relationship of the key management system, and sends a preset pre-charged quantum key migration completion notification to the central management platform.

[0106] In one embodiment, the verification information includes a first hash value of the quantum transfer key, and the consistency verification module includes: The hash value receiving submodule is used to receive the first hash value of the quantum migration key sent by the first key management system; The second hash value determination submodule is used to determine the second hash value of the quantum migration key based on the national cryptographic SM3 algorithm. The hash value consistency verification module is used to verify the consistency of the first hash value and the second hash value, and after the consistency verification is passed, the consistency verification of the quantum migration key is completed.

[0107] In one embodiment, the preset key decryption module includes: The SM4 decryption submodule is used to decrypt the encrypted preset pre-charged quantum key using the quantum migration key based on the national cryptographic SM4 algorithm, and obtain the preset pre-charged quantum key.

[0108] The cross-domain KMS redirection device based on quantum key distribution in this embodiment of the invention can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), televisions (TVs), ATMs, or self-service machines, etc. This embodiment of the invention does not impose specific limitations.

[0109] The cross-domain KMS redirection device based on quantum key distribution in this embodiment of the invention can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this embodiment of the invention does not impose specific limitations.

[0110] The cross-domain KMS redirection device based on quantum key distribution provided in this embodiment of the invention can achieve... Figures 2 to 5 The various processes implemented by the cross-domain KMS redirection device based on quantum key distribution in the method embodiments will not be described again here to avoid repetition.

[0111] The central management platform sends a quantum migration key acquisition command and a list of devices to be migrated to the first key management system. Upon receiving a first response, it sends a quantum migration key acquisition command to the second key management system. Upon receiving a second response, it sends a quantum migration key verification command to the first key management system. The first key management system, in response to the quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network. In response to a third response from the second key management system, it encrypts the preset pre-charged quantum key to be migrated based on the quantum migration key. The encrypted preset pre-charged quantum key is then sent to the second key management system and combined with the second key... The management system, in response to a quantum migration key acquisition command, requests a quantum migration key from the quantum key distribution network; receives an encrypted preset pre-charged quantum key sent by the first key management system; decrypts the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key, and finally transmits it through the central management platform; and updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the preset pre-charged quantum key migration completion notification. This method helps ensure the consistency and transmission security of the pre-charged quantum key during the migration process, and can synchronously update the association relationship between the device and the new key management system, thereby helping to alleviate security and accuracy issues during the key migration process and reducing the risk of service interruption.

[0112] This invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described embodiment of a cross-domain KMS redirection method based on quantum key distribution and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0113] This invention also provides a readable storage medium on which a computer program is stored. When the computer program is executed by a processor, it implements the various processes of the above-described embodiment of a cross-domain KMS redirection method based on quantum key distribution and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0114] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0115] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of the present invention is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0117] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

Claims

1. A cross-domain KMS redirection system based on quantum key distribution, characterized in that, include: Central management platform, first key management system, and second key management system; The central management platform is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system; upon receiving a first response information, it sends the quantum migration key acquisition instruction to the second key management system; upon receiving a second response information, it sends a quantum migration key verification instruction to the first key management system; it receives a preset pre-charged quantum key migration completion notification from the first key management system; and according to the preset pre-charged quantum key migration completion notification, it updates the mapping relationship between each device in the list of devices to be migrated and the second key management system. The first key management system is configured to, in response to the quantum migration key acquisition instruction, apply to the quantum key distribution network for a quantum migration key; after acquiring the quantum migration key, send a first response message to the central management platform; in response to the quantum migration key verification instruction sent by the central management platform, generate verification information based on the quantum migration key; and send the verification information to the second key management system. In response to the third response information sent by the second key management system, the preset pre-charged quantum key to be migrated is encrypted based on the quantum migration key; the encrypted preset pre-charged quantum key is then sent to the second key management system. In response to the fourth response information, each device in the list of devices to be migrated is notified through the preset device management interface to update the binding relationship of the key management system, and a preset pre-charged quantum key migration completion notification is sent to the central management platform. The second key management system is configured to, in response to the quantum migration key acquisition instruction, apply to the quantum key distribution network for a quantum migration key; after acquiring the quantum migration key, send a second response message to the central management platform; receive verification information sent by the first key management system; complete the consistency verification of the quantum migration key based on the verification information, and return a third response message to the first key management system; receive an encrypted preset pre-charged quantum key sent by the first key management system; and decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key. Send a fourth response message to the first key management system.

2. The cross-domain KMS redirection system based on quantum key distribution according to claim 1, characterized in that, The quantum migration key verification instruction includes a national cryptographic algorithm verification instruction, the verification information includes the first hash value of the quantum migration key, and the central management platform is used to send the national cryptographic algorithm verification instruction to the first key management system. The first key management system is used to respond to the national cryptographic algorithm verification command, determine the first hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and send the hash value to the second key management system; The second key management system is configured to receive the first hash value of the quantum migration key sent by the first key management system; Based on the national cryptographic SM3 algorithm, the second hash value of the quantum migration key is determined; the consistency verification of the first hash value and the second hash value is performed, and the consistency verification of the quantum migration key is completed after the consistency verification is passed.

3. The cross-domain KMS redirection system based on quantum key distribution according to claim 1, characterized in that, The first key management system is used to encrypt the preset pre-charged quantum key based on the national cryptographic SM4 algorithm and the quantum migration key; The second key management system is used to decrypt the encrypted preset pre-charged quantum key using the quantum migration key based on the national cryptographic SM4 algorithm, and obtain the preset pre-charged quantum key.

4. A cross-domain KMS redirection method based on quantum key distribution, characterized in that, Applied to a central management platform, the method includes: Send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system, so that the first key management system can apply for a quantum migration key from the quantum key distribution network according to the first quantum migration key acquisition instruction and return a first response information after successful acquisition; Upon receiving the first response information, the quantum migration key acquisition instruction is sent to the second key management system, so that the second key management system applies for a quantum migration key from the quantum key distribution network according to the quantum migration key acquisition instruction, and returns the second response information after successful acquisition; Upon receiving the second response information, a quantum migration key verification instruction is sent to the first key management system, so that the first key management system generates verification information based on the quantum migration key and sends it to the second key management system for quantum migration key consistency verification. Receive a notification from the first key management system that the pre-charged quantum key migration is complete; Based on the migration completion notification, update the mapping relationship between each device in the list of devices to be migrated and the second key management system.

5. The method according to claim 4, characterized in that, The quantum migration key verification instruction includes a national cryptographic algorithm verification instruction. Sending the quantum migration key verification instruction to the first key management system includes: The first key management system sends the national cryptographic algorithm verification command to the first key management system, so that the first key management system determines the hash value of the quantum migration key based on the national cryptographic SM3 algorithm, and sends the hash value to the second key management system for quantum migration key consistency verification.

6. A cross-domain KMS redirection method based on quantum key distribution, characterized in that, Applied to a first key management system, the method includes: Receive the quantum migration key acquisition instruction and the list of devices to be migrated sent by the central management platform; In response to the quantum transfer key acquisition instruction, a quantum transfer key is requested from the quantum key distribution network; After obtaining the quantum migration key, a first response message is sent to the central management platform, so that after receiving the first response message, the central management platform sends the quantum migration key acquisition instruction to the second key management platform. In response to the quantum migration key verification command sent by the central management platform, verification information is generated based on the quantum migration key; The verification information is sent to the second key management system, so that the second key management system can complete the consistency verification of the quantum transfer key based on the verification information and return the third response information; In response to the third response information sent by the second key management system, the preset pre-charged quantum key to be migrated is encrypted based on the quantum migration key; The encrypted preset pre-charged quantum key is sent to the second key management system, so that the second key management system decrypts the encrypted preset pre-charged quantum key, obtains the preset pre-charged quantum key, completes the preset pre-charged quantum key migration, and returns the fourth response information; In response to the fourth response information, each device in the list of devices to be migrated is notified through a preset device management interface to update the binding relationship of the key management system, and a preset pre-charged quantum key migration completion notification is sent to the central management platform so that the central management platform updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

7. The method according to claim 6, characterized in that, The quantum migration key verification command includes a national cryptographic algorithm verification command. The process of generating verification information based on the quantum migration key in response to the quantum migration key verification command sent by the central management platform includes: In response to the national cryptographic algorithm verification command, the first hash value of the quantum migration key is determined based on the national cryptographic SM3 algorithm, and the hash value is sent to the second key management system so that the second key management system performs quantum migration key consistency verification based on the hash value.

8. The method according to claim 6, characterized in that, The response to the third response information sent by the second key management system, based on the quantum migration key, performs encryption processing on the preset pre-charged quantum key to be migrated, including: The preset pre-charged quantum key is encrypted using the national cryptographic SM4 algorithm and the quantum migration key.

9. A cross-domain KMS redirection method based on quantum key distribution, characterized in that, Applied to a second key management system, the method includes: Receive the quantum migration key acquisition instruction sent by the central management platform; In response to the quantum transfer key acquisition instruction, a quantum transfer key is requested from the quantum key distribution network; After obtaining the quantum migration key, a second response message is sent to the central management platform, so that the central management platform sends a quantum migration key verification instruction to the first key management system after receiving the second response message. Receive verification information sent by the first key management system; Based on the verification information, the consistency verification of the quantum migration key is completed, and a third response information is returned to the first key management system, so that the first key management system responds to the third response information and performs encryption processing on the preset pre-charged quantum key to be migrated based on the quantum migration key; Receive the encrypted preset pre-charged quantum key sent by the first key management system; Decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; A fourth response message is sent to the first key management system, so that the first key management system responds to the fourth response message, notifies each device in the list of devices to be migrated through a preset device management interface, updates the binding relationship of the key management system, and sends a preset pre-charged quantum key migration completion notification to the central management platform.

10. The method according to claim 9, characterized in that, The verification information includes the first hash value of the quantum transfer key, and the process of verifying the consistency of the quantum transfer key based on the verification information includes: Receive the first hash value of the quantum migration key sent by the first key management system; The second hash value of the quantum migration key is determined based on the national cryptographic SM3 algorithm; The consistency verification of the first hash value and the second hash value is performed. After the consistency verification is passed, the consistency verification of the quantum migration key is completed.

11. The method according to claim 9, characterized in that, Decrypting the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key includes: Based on the national cryptographic SM4 algorithm, the quantum migration key is used to decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key.

12. A cross-domain KMS redirection device based on quantum key distribution, characterized in that, The device, used in a central management platform, includes: The first acquisition instruction sending module is used to send a quantum migration key acquisition instruction and a list of devices to be migrated to the first key management system, so that the first key management system can apply for a quantum migration key from the quantum key distribution network according to the first quantum migration key acquisition instruction and return a first response information after successful acquisition. The second acquisition instruction sending module is used to send the quantum migration key acquisition instruction to the second key management system upon receiving the first response information, so that the second key management system can apply for a quantum migration key from the quantum key distribution network according to the quantum migration key acquisition instruction, and return the second response information after successful acquisition; The verification module is used to send a quantum migration key verification instruction to the first key management system after receiving the second response information, so that the first key management system generates verification information based on the quantum migration key and sends it to the second key management system for quantum migration key consistency verification. The notification receiving module is used to receive a preset pre-charged quantum key migration completion notification sent by the first key management system; The mapping update module is used to update the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

13. A cross-domain KMS redirection device based on quantum key distribution, characterized in that, Applied to a first key management system, the device includes: The instruction acquisition module is used to receive the quantum migration key acquisition instruction and the list of devices to be migrated sent by the central management platform; The first key application module is used to apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction; The first response message sending module is used to send a first response message to the central management platform after obtaining the quantum migration key, so that after receiving the first response message, the central management platform sends the quantum migration key acquisition instruction to the second key management platform. The verification information generation module is used to generate verification information based on the quantum migration key in response to the quantum migration key verification command sent by the central management platform. The verification information sending module is used to send the verification information to the second key management system, so that the second key management system can complete the consistency verification of the quantum migration key based on the verification information and return the third response information; The key encryption module is used to encrypt the preset pre-charged quantum key to be migrated based on the quantum migration key in response to the third response information sent by the second key management system. The encryption key sending module is used to send the encrypted preset pre-charged quantum key to the second key management system, so that the second key management system can decrypt the encrypted preset pre-charged quantum key, obtain the preset pre-charged quantum key, complete the preset pre-charged quantum key migration, and return the fourth response information; The binding update module is used to respond to the fourth response information, notify each device in the list of devices to be migrated through a preset device management interface, update the binding relationship of the key management system, and send a preset pre-charged quantum key migration completion notification to the central management platform, so that the central management platform updates the mapping relationship between each device in the list of devices to be migrated and the second key management system according to the migration completion notification.

14. A cross-domain KMS redirection device based on quantum key distribution, characterized in that, The device, used in a second key management system, includes: The key acquisition instruction acquisition module is used to receive the quantum migration key acquisition instruction sent by the central management platform; The second key application module is used to apply for a quantum migration key from the quantum key distribution network in response to the quantum migration key acquisition instruction. The second response message sending module is used to send a second response message to the central management platform after obtaining the quantum migration key, so that the central management platform sends a quantum migration key verification instruction to the first key management system after receiving the second response message. The verification message receiving module is used to receive verification information sent by the first key management system; The consistency verification module is used to complete the consistency verification of the quantum migration key according to the verification information, and return the third response information to the first key management system, so that the first key management system responds to the third response information and performs encryption processing on the preset pre-charged quantum key to be migrated based on the quantum migration key; A preset key receiving module is used to receive an encrypted preset pre-charged quantum key sent by the first key management system; A preset key decryption module is used to decrypt the encrypted preset pre-charged quantum key to obtain the preset pre-charged quantum key; The fourth response message sending module is used to send a fourth response information to the first key management system, so that the first key management system responds to the fourth response information, notifies each device in the list of devices to be migrated through a preset device management interface, updates the binding relationship of the key management system, and sends a preset pre-charged quantum key migration completion notification to the central management platform.

15. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the cross-domain KMS redirection method based on quantum key distribution as described in claims 4-5, 6-8, or 9-11.

16. A readable storage medium, characterized in that, The program or instructions are stored on the readable storage medium, and when executed by a processor, the program or instructions implement the steps of the cross-domain KMS redirection method based on quantum key distribution as described in claims 4-5, 6-8, or 9-11.

Images