Protection method, device and electronic device based on quantum key distribution network

Abstract

The present application provides a protection method, device and electronic device based on a quantum key distribution network; the method includes: performing network topology abstraction, obtaining a virtual topology map, and determining key resource information in the virtual topology map; parsing a service request, obtaining a service path and key requirements of the service request, and calculating the key resources of each hop link; implementing a preset working path algorithm according to the key resources and in combination with the key requirements, and screening out a target working path from the service path; based on the screening of the target working path, screening out at least one candidate protection path from the remaining service paths, and determining the order of the candidate protection paths; constructing a protection threshold based on the number of hops of the candidate protection path and using the key resources, combining the key resources and the key requirements, and implementing a preset protection path algorithm in order to determine the target protection path for the service request, and recording and updating it in the virtual topology map.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network communication technology, and in particular to a protection method, device and electronic device based on a quantum key distribution network. Background Art

[0002] In the existing protection schemes for quantum key distribution networks, only the protection and recovery of quantum key distribution networks based on trusted relays are often considered. There is a lack of effective protection schemes for quantum key distribution networks that are a mixture of trusted relays and untrusted relays.

[0003] Based on this, a solution is needed to provide protection for a quantum key distribution network that is a mixture of trusted relays and untrusted relays. Summary of the invention

[0004] In view of this, the purpose of this application is to propose a protection method, device and electronic device based on a quantum key distribution network.

[0005] Based on the above purpose, the present application provides a protection method based on a quantum key distribution network, wherein the quantum key distribution network includes: a trusted node and an untrusted node;

[0006] The method is applied to a trusted node in the quantum key distribution network, comprising:

[0007] The trusted node records the physical position relationship between other trusted nodes and untrusted nodes to obtain a physical map of the quantum key distribution network;

[0008] In response to determining that any two of the trusted nodes are physically connected only through one of the untrusted nodes, the untrusted node is virtually removed from the physical map, and the two trusted nodes are directly connected via a virtual link;

[0009] In response to determining that a physical direct link is formed between any two of the untrusted nodes, the physical direct link between the two untrusted nodes is virtually disconnected in the physical map to obtain a virtual topology map;

[0010] And also includes:

[0011] Parse the received service request, determine all service paths of the service request in the virtual topology map, and calculate the key requirement of each link of the service request and the key resource of each link in the service path; select the service path with the least number of hops and the key resource of each link greater than or equal to the key requirement as the target working path, and virtualize and disconnect the link that does not meet the key requirement in the virtual topology map;

[0012] In the virtual topology map, the service path that does not contain a virtualized disconnected link is selected as a candidate protection path, the total key requirement of the entire candidate protection path is calculated, and a protection threshold that is lower than the total key requirement is constructed; within the protection threshold range, the candidate protection path with the least number of hops and the key resources of each hop of the link are greater than or equal to the key requirement is selected as the target protection path;

[0013] In response to determining that the target working path and the target protection path are screened out, the current occupancy status of the service path and the occupancy status of the key resource are updated in the virtual topology map.

[0014] Based on the same inventive concept, the present application also provides a protection device based on a quantum key distribution network, wherein the quantum key distribution network includes: a trusted node and an untrusted node;

[0015] The device is applied to a trusted node in the quantum key distribution network, including: a topology module, a target working path module, a target protection path module and an update module;

[0016] Wherein, the topology module is configured to record the physical position relationship between other trusted nodes and untrusted nodes to obtain a physical map of the quantum key distribution network; in response to determining that any two of the trusted nodes are physically connected only through one of the untrusted nodes, the untrusted node is virtually removed from the physical map, and the two trusted nodes are directly connected with a virtual link; in response to determining that a physical direct link is formed between any two of the untrusted nodes, the physical direct link between the two untrusted nodes is virtually disconnected in the physical map to obtain a virtual topology map;

[0017] The target working path module is configured to parse the received service request, determine all service paths of the service request in the virtual topology map, and calculate the key requirement of each link of the service request and the key resource of each link in the service path; select the service path with the least number of hops and the key resource of each link greater than or equal to the key requirement as the target working path, and virtualize and disconnect the link that does not meet the key requirement in the virtual topology map;

[0018] The target protection path module is configured to select the service path without virtualized disconnected links as a candidate protection path in the virtual topology map, calculate the total key requirement of the entire candidate protection path, and construct a protection threshold lower than the total key requirement; within the protection threshold range, select the candidate protection path with the least number of hops and the key resources of each hop of the link greater than or equal to the key requirement as the target protection path;

[0019] The updating module is configured to update the current occupancy status of the service path and the occupancy status of the key resource in the topology network in response to determining that the target working path and the target protection path are screened out.

[0020] Based on the same inventive concept, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the protection method based on the quantum key distribution network as described in any one of the above items is implemented.

[0021] From the above, it can be seen that the protection method, device and electronic device based on the quantum key distribution network provided by the present application are based on network topology abstraction, abstract non-trusted nodes as virtual links, and comprehensively consider trusted relay nodes and untrusted relay nodes to select the target working path and target protection path in the network, so that the target working path and the target protection path are both in the network where trusted relay nodes and untrusted relay nodes are mixed, which not only meets the key requirements of the business request, but also meets the maximum full load value that can be provided, thereby providing stable and reliable protection for the quantum key distribution network. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1A A flowchart for constructing a virtual topology map based on a quantum key distribution network according to an embodiment of the present application;

[0024] Figure 1B This is a flow chart of path allocation based on a quantum key distribution network according to an embodiment of the present application;

[0025] Figure 2 This is a module schematic diagram of a protection device based on a quantum key distribution network according to an embodiment of the present application;

[0026] Figure 3 This is a schematic diagram of the architecture of a quantum key distribution network based on an embodiment of the present application;

[0027] Figure 4 A schematic diagram of a virtual topology map according to an embodiment of the present application;

[0028] Figure 5 A schematic diagram of a process for allocating a target working path according to an embodiment of the present application;

[0029] Figure 6 A schematic diagram of a process for allocating a target protection path according to an embodiment of the present application;

[0030] Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0032] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0033] As described in the background technology section, the relevant protection methods based on quantum key distribution networks are still difficult to meet the needs of actual communications.

[0034] In the process of implementing this application, the applicant discovered that the main problem with the relevant protection method based on quantum key distribution network is that the relevant technical solutions mainly focus on solving problems such as the protection and recovery scheme of quantum key distribution network based on trusted relays, but do not consider the problem of quantum key distribution protection strategy in the mixed relay scenario of trusted relays and untrusted relays.

[0035] It can be understood that the method can be executed by any device, equipment, platform, or device cluster having computing and processing capabilities.

[0036] The technical method of the present application is described in detail below through specific embodiments.

[0037] refer to Figure 1A and Figure 1B , a protection method based on a quantum key distribution network according to an embodiment of the present application comprises the following steps:

[0038] Step S101: The trusted node records the physical location relationship between other trusted nodes and untrusted nodes to obtain a physical map of the quantum key distribution network.

[0039] In this application, Figure 3 The architecture of the quantum key distribution network shown is used as an example. Figure 3As shown, the QKD (quantum key distribution) network includes trusted relay nodes, also known as trusted nodes in this application, and untrusted relay nodes, also known as untrusted nodes in this application.

[0040] In the key transmission, each trusted node has the function of being a source node and a destination node, that is, the starting node and the ending node in the path.

[0041] In this embodiment, the network topology abstraction is first performed on the network mixed with trusted nodes and untrusted nodes. Each trusted node needs to perform network topology abstraction on the entire network and save the result of the network topology abstraction, that is, the virtual topology map.

[0042] Specifically, each trusted node traverses the entire QKD network, distinguishes between other trusted nodes and untrusted nodes except the trusted node, records the locations of all other trusted nodes and untrusted nodes, and the connections between them, and updates this record to the routing table of the trusted node to obtain a physical map of the QKD network.

[0043] Step S102: In response to determining that any two of the trusted nodes are physically connected only through one of the untrusted nodes, the untrusted node is virtually removed from the physical map, and the two trusted nodes are directly connected via a virtual link.

[0044] In this embodiment, based on the obtained physical map, the non-trusted nodes therein may be further virtualized. "Virtualization" may also be referred to as "abstraction" in this embodiment.

[0045] Specifically, for any two trusted nodes, if the physical link between them is only connected by one untrusted node and there are no trusted nodes, then in the physical map of the QKD network, the untrusted node is virtualized and removed, and the two trusted nodes are directly connected via a virtual link.

[0046] Step S103: in response to determining that a physical direct link is formed between any two of the untrusted nodes, the physical direct link between the two untrusted nodes is virtually disconnected in the physical map to obtain a virtual topology map.

[0047] In this embodiment, for at least two non-trusted nodes that are directly connected by physical links, the physical direct link between them is virtually disconnected in the physical map of the QKD network, and the physical map that completes the above-mentioned network topology abstraction operation is used as the virtual topology map.

[0048] by Figure 3 Taking the QKD network structure shown in FIG. 1 as an example, when executing step S101 and step S102, Figure 3The connection between the untrusted node 7 and the untrusted node 8 is virtually disconnected, and the untrusted node 7 and the untrusted node 8 are abstracted and removed; further, the trusted node 2 is directly connected to the trusted node 4 through virtualization, and the trusted node 3 is directly connected to the trusted node 6 through virtualization, so as to obtain the following: Figure 4 The virtual topology map shown in FIG. 1 shows a virtualized direct connection represented by a dotted line and a solid line represents a physical direct connection link.

[0049] Furthermore, based on the virtual topology map obtained in step S101, step S102 and step S103, it is necessary to confirm the key resource information in the virtual topology map.

[0050] Specifically, the key resource information includes: the number of wavelength channel time slots of the link between nodes, and the key generation rate of each time slot.

[0051] exist Figure 4 In the example, the number of wavelength channel time slots of the direct link between the two nodes is 5 time slots, denoted as: m = 5; the key generation rate is 1 key per time slot, denoted as: V p =1unit / s.

[0052] Step S104, parse the received service request, determine all service paths of the service request in the virtual topology map, and calculate the key requirement of the service request for each link and the key resource of each link in the service path; select the service path with the least hops and the key resource of each link greater than or equal to the key requirement as the target working path, and in the virtual topology map, virtualize and disconnect the link that does not meet the key requirement.

[0053] In the embodiments of the present application, Figure 5 The flowchart of target working path allocation is shown to explain the process of this step in detail.

[0054] Specifically, step S104 may include the following steps:

[0055] Step S501, network topology abstraction, which is the network topology abstraction process performed on the physical network in the above steps S101, S102 and S103, and a corresponding virtual topology map is obtained.

[0056] Step S502: Receive a service request.

[0057] That is, after receiving the service request, step S104 is executed, that is, the following process of S503-S507.

[0058] Step S503: parse the service request, determine all service paths of the service request in the virtual topology map, and calculate the key requirement of the service request for each hop link and the key resource of each hop link in the service path.

[0059] The parsing process specifically includes: the trusted node that receives the service request parses the service request to obtain service attributes related to the service request.

[0060] The service attributes may include: the source node, the destination node, the service start time T of the service request s , Business duration T h , Business end time T end and the required key amount per unit time V r .

[0061] Furthermore, the trusted node uses the source node and the sink node to determine all service paths that can execute the service request in the virtual topology map, and calculates the specific number of hops for each service path.

[0062] In this embodiment, the number of hops of each service path is defined as: the number of trusted nodes included in the service path.

[0063] The process of calculating the key requirement includes: calculating the key requirement of each hop link using the following formula.

[0064] Key requirement of link = V r ×T h

[0065] Among them, when the same service request is executed under different service paths, the total key requirement of the service request under the service path is different. The key requirement calculated above is only used as the key requirement when the service request is executed under a single link in the service path, and in this embodiment, the key requirement of each hop link is the same. Furthermore, the sum of the key requirements of all links in a path can be used as the total key requirement of the path.

[0066] The process of calculating the key resource includes: using the following formula to calculate the key resource of each hop link, and using it as the maximum full load value of the key resource in the link.

[0067] Key resource of link = V p ×m×T h

[0068] Among them, since different service paths have different hop numbers and different numbers of links, different service paths have different total resources. The key resources calculated above are only used as the key resources of a single link in the service path, and in this embodiment, the key resources of each hop link are the same.

[0069] Furthermore, when the hop link is occupied by the service request being executed, when considering the unoccupied key resources, the amount of key resources occupied by the hop link should be subtracted from the maximum full load value of the key resources calculated above.

[0070] Step S504: Determine candidate working paths.

[0071] Specifically, the method includes: arranging all the service paths in order of the number of hops from small to large according to the number of hops of the service paths, and first selecting the service path with the least number of hops as the candidate working path.

[0072] When there are multiple service paths with the same number of hops and the least number of hops, one of the service paths with the least number of hops can be randomly selected as a candidate working path.

[0073] Step S505: Determine whether the candidate working path can meet the key requirement within the service duration.

[0074] Specifically, it includes: comparing the key requirement and the unoccupied key resources along each hop link in the candidate working path to make further judgment on the candidate working path.

[0075] In this embodiment, the calculation of key resources and key requirements is only exemplary in order. The key resources and key requirements of each hop link can be calculated first in the above manner, and the above calculation results can be called for the candidate working path. The key resources and key requirements can also be calculated here.

[0076] Furthermore, when the unoccupied key resources of each hop link are less than the key requirements, it indicates that the available key resources of the link cannot meet the key requirements for executing the service request, and the candidate working path is not suitable as the target working path. The judgment result of step S505 is no, and step S506 is selected to be executed, and further, step S504 and step S505 are executed again.

[0077] Furthermore, when the unoccupied key resources of any link are greater than or equal to the key requirements, indicating that the available key resources of the candidate working path can meet the key requirements for executing the service request, the judgment result of step S505 is yes, and step S507 is selected for execution.

[0078] Among them, step S506, abstractly disconnecting the link, may specifically include: abstractly disconnecting the link whose key resources do not meet the requirements for executing the service in the virtual topology map, and then the path is also abstractly disconnected.

[0079] Furthermore, among the remaining other service paths, the next service path, that is, the service path with the least hops, is selected in a pre-arranged order as a new candidate working path.

[0080] Step S507: The candidate working path whose key resources of each hop link satisfy the requirements for executing the service request is taken as the target working path.

[0081] Furthermore, resources of the target working path are allocated to the service path.

[0082] In this embodiment, according to the above target working path allocation method, Figure 4 The specific virtual topology map example is shown to illustrate the execution process of step S104.

[0083] When the service request R1 arrives at QKD, by parsing R1, the service attributes of R1 are obtained: source node: trusted node 1; sink node: trusted node 6; service start time T s : 20th second; service duration T h :30s; Business end time T end : 50th second; and the required key amount per unit time V r :2unit / s.

[0084] Based on the source node being the trusted node 1 and the sink node being the trusted node 6, 6 service paths are obtained: P 1-4-2-3-6 ;P 1-2-4-5-6 ;P 1-4-5-6 ;P 1-4-2-6 ;P 1-2-3-6 ; and P 1-2-6 .

[0085] Furthermore, the ranking of the six service paths is: 1-2-6 >P 1-2-3-6 =P 1-4-2-6 =P 1-4-5-6 >P 1-2-4-5-6 =P 1-4-2-3-6

[0086] Furthermore, the service path P is calculated 1-2-6 When executing R1, the key requirement for each link is:

[0087] V r ×T h =2×30=0 units

[0088] Calculate the service path P 1-2-6 Key resources in the middle link:

[0089] V p ×m×T h×=1×5×30=150units

[0090] Furthermore, in this embodiment, the service path P 1-2-6 No key resources are occupied, and its key resources are greater than the key requirements, so the service path P 1-2-6 as the target work path.

[0091] Step S105: In the virtual topology map, select the service path that does not contain a virtualized disconnected link as a candidate protection path, calculate the total key requirement of the entire candidate protection path, and construct a protection threshold that is lower than the total key requirement; within the protection threshold range, select the candidate protection path with the least number of hops and the key resources of each hop of the link being greater than or equal to the key requirement as the target protection path.

[0092] In the embodiments of the present application, Figure 6 The flowchart of target protection path allocation is shown to explain the process of this step in detail.

[0093] Specifically, step S105 may include the following steps:

[0094] Step S601: complete the target work path allocation, which is based on the above Figure 5 The steps shown in the figure are used to obtain the target working path.

[0095] Step S602: Remove the target working path and the candidate working paths that are abstractly disconnected.

[0096] Specifically, according to the above step S601, in the service path of the above service request, the selected target working path is removed, and the candidate working paths that are abstracted and disconnected are removed to obtain the remaining service paths.

[0097] Step S603: Determine and sort candidate protection paths.

[0098] Specifically, the remaining service paths are used as candidate protection paths.

[0099] Furthermore, all candidate protection paths are arranged in order of the number of hops from small to large using the number of hops of the candidate protection paths.

[0100] Furthermore, when the hop counts of multiple candidate protection paths are equal, the order of the candidate protection paths with the equal hop counts is randomly arranged.

[0101] In this embodiment, according to Figure 4 Example, except for the selected target working path P 1-2-6 , the remaining service path P 1-4-2-3-6 ;P 1-2-4-5-6 ;P1-4-5-6 ;P 1-4-2-6 and P 1-2-3-6 All of them are used as candidate protection paths.

[0102] Furthermore, the order of the candidate protection paths is still maintained according to the number of hops: 1-2-3-6 =P 1-4-2-6 =P 1-4-5-6 >P 1-2-4-5-6 =P 1-4-2-3-6 .

[0103] Step S604: determine whether the key requirement is greater than the protection threshold.

[0104] In this embodiment, since it is not recommended to fully load the protection path to carry the total key demand of the business request, a protection threshold for executing the business request can be constructed for each candidate protection path, and the protection threshold can be used to determine whether the candidate protection path is suitable for executing the business request.

[0105] Specifically, based on the number of hops of the candidate protection path, the protection threshold of the candidate protection path is established according to the following protection threshold formula:

[0106] Protection threshold = V p ×m×T h ×(number of service path hops - 1) × Y

[0107] Wherein, Y is a preset threshold parameter, and the range of the protection threshold can be adjusted according to the threshold parameter.

[0108] In this embodiment, the calculation sequence of the protection threshold is only exemplary, and the calculation may be performed only on the candidate protection paths involved in the above manner, or the protection threshold of each service path may be calculated first, and the pre-calculated result may be called here for the candidate protection path.

[0109] exist Figure 4 In the example shown, the threshold parameter is set to 0.8. Therefore, according to the order of candidate protection paths, 1-2-3-6 and P 1-4-2-6 A candidate protection path is randomly selected and its protection threshold is calculated.

[0110] Specifically, P 1-2-3-6 For example, the protection threshold is:

[0111] V p ×m×T h ×(number of service path hops - 1) × Y = 1 × 5 × 30 × (4-1) × 0.8 = 360 units

[0112] Furthermore, the total key requirement of the candidate protection path is calculated:

[0113] V r ×T h ×(number of service path hops - 1) = 2 × 30 × 3 = 180 units

[0114] Furthermore, based on the obtained protection threshold and total key requirement, a candidate protection path is selected according to the above ranking, and its total key requirement is compared with the protection threshold to determine whether the total key requirement is greater than the protection threshold.

[0115] Furthermore, when the total key demand is greater than the preset protection threshold, the judgment result of step S604 is yes, indicating that when the candidate protection path executes the service request, it will run at a state close to the maximum full load value. Therefore, it is determined that the candidate protection path cannot be used as the target protection path, and you can choose to execute step S605.

[0116] Furthermore, when the total key demand is less than or equal to the preset protection threshold, the judgment result of step S604 is no, indicating that when the candidate protection path executes the service request, it will not run at a state close to the maximum full load value. Therefore, it is determined that the candidate protection path can be used as the target protection path, and step S606 can be selected to be executed.

[0117] Wherein, step S605, abstractly disconnecting the candidate protection path, specifically includes: abstractly disconnecting the candidate protection path in the virtual topology map to indicate that the path is not considered in the following steps.

[0118] Further, the candidate protection paths that have been abstracted and disconnected are removed, and the next candidate protection path is selected from the remaining candidate protection paths in a pre-arranged order, that is, the one with the least hops, and the protection threshold is determined again in step S604.

[0119] Step S606: Determine whether the link key resources meet the key requirements.

[0120] Specifically, the calculated key requirement and unoccupied key resources are called for the link in the candidate protection path, and the two are compared to determine whether the key resources meet the key requirement.

[0121] In this embodiment, the calculation of key resources and key requirements is only exemplary in order. The key resources and key requirements of each hop link can be calculated first in the above manner, and then the above calculation results are called for the candidate protection path. The key resources and key requirements can also be calculated here.

[0122] Furthermore, when the unoccupied key resources in each hop of the link are less than the key requirement, it means that the available key resources of the link in the candidate protection path cannot meet the key requirement for executing the service request, then the judgment result of step S606 is no, and step S605 is executed again, and then step S604 is further executed. Specifically, the candidate protection path that has been abstracted and disconnected is removed again, and among the remaining candidate protection paths, the next candidate protection path in the order is selected, that is, the candidate protection path with the least hops, and whether the key resources are sufficient is determined again.

[0123] Furthermore, when the unoccupied key resources of each hop link in the candidate protection path are greater than or equal to the key requirement, it means that the key resources of each hop link can meet the key requirement for executing the service request, then the judgment result of step S606 is yes, and step S607 is selected to be executed.

[0124] Step S607: Determine a candidate protection path whose link meets the key requirement and whose total key requirement is not greater than the protection threshold as a target protection path, and allocate the protection path as a protection resource to the service request.

[0125] Combination Figure 4 The example of the virtual topology map shown in FIG. 1-2-3-6 If the above judgment is met, it will be taken as the target protection path, and P 1-2-3-6 Assigned to service request R1.

[0126] In the present application, the above judgment on the protection threshold of the candidate protection path and the judgment on whether the key resources are sufficient are as follows: Figure 6 The execution order shown is only exemplary, and it is also possible to first determine whether the key resources of the candidate protection path are sufficient, and then determine its protection threshold; it is also possible to determine the key resources and the protection threshold simultaneously.

[0127] Step S106: in response to determining that the target working path and the target protection path are screened out, the current occupancy status of the service path and the occupancy status of the key resource are updated in the virtual topology map.

[0128] In an embodiment of the present application, based on the determination of the above-mentioned target working path and the determination of the target protection path, the key resources occupied in the target working path and the occupied path are recorded; similarly, the key resources occupied in the target protection path and the occupied path are recorded, and the available resources of the corresponding path are updated in the stored virtual topology map.

[0129] In another embodiment of the present application, the virtual topology map and key resource information in the previous embodiment are used as basic conditions, the service request R1 is still being executed, and when other conditions remain unchanged, the second service request R2 is received by the same QKD network.

[0130] The trusted node is asked to parse R2 and obtain the business attributes of R2, including:

[0131] Source node: trusted node 2; Destination node: trusted node 5; Service start time T s2 : 30s; service duration T h2 :20s; Business end time T end2 : 50th second; and the required key amount per unit time V r2 :4unit / s.

[0132] Among them, based on the source node and the sink node, four service paths with increasing hop counts can be obtained: 2-6-5 ;P 2-4-5 ;P 2-1-4-5 ; and P 2-3-6-5 .

[0133] In the P with the least hops 2-6-5 and P 2-4-5 In the random selection, P 2-6-5 As a candidate working path, according to the above update of the relevant path information when executing R1, P 2-6-5 The link between trusted node 2 and trusted node 6 is already executing R1, so P 2-6-5 The unoccupied key resources cannot meet the key requirements for executing R2, and the service path is virtually disconnected.

[0134] Furthermore, at this time, P 2-4-5 The path with the least hops in the virtual topology map is selected as the new candidate working path, and P 2-4-5 The key resources of P satisfy the key resources required to execute R2. 2-4-5 as the target work path.

[0135] Furthermore, in the service path, remove the virtualized disconnected P 2-6-5 , and P which has been taken as the target working path 2-4-5 , the remaining P 2-1-4-5 ; and P 2-3-6-5 as a candidate protection path.

[0136] Furthermore, since both have the same number of hops, they have the same order and can be randomly selected. 2-1-4-5 Determine the protection threshold and key resources.

[0137] Specifically, calculate P 2-1-4-5 The key requirement for executing R2 is: 240 units, and based on the same threshold parameters as above, calculate P 2-1-4-5 The protection threshold is: 240 units.

[0138] Because P 2-1-4-5 If the key requirement for executing R2 is not greater than the protection threshold, then P 2-1-4-5 will not be running at near full load, so P 2-1-4-5 The key resources are sufficient to determine whether the

[0139] Furthermore, according to the above update of the relevant path information when executing R1, P 2-1-4-5 Link P in 2-1 Due to the execution of service request R1, two time slots of the wavelength channel are occupied, so the unoccupied key resources in this hop link do not meet the key requirements required for executing R2.

[0140] Furthermore, P 2-1-4-5 Abstraction is broken.

[0141] Furthermore, remove the virtualized disconnected P 2-6-5 and P 2-1-4-5 , and P which has been taken as the target working path 2-4-5 , the remaining candidate protection paths are: P 2-3-6-5 .

[0142] Furthermore, P is calculated 2-3-6-5 The key requirement for executing R2 is: 240 units, and based on the same threshold parameters as above, calculate P 2-3-6-5 The protection threshold is: 240 units.

[0143] Because P 2-3-6-5 If the key requirement for executing R2 is not greater than the protection threshold, then P 2-3-6-5 will not be running at near full load, so P 2-3-6-5 The key resources are sufficient to determine whether the

[0144] Furthermore, P 2-3-6-5 The key resource is: 300 units, which is greater than the key requirement for executing R2. 2-3-6-5 As the target protection path, the protection resource is allocated in the network.

[0145] Furthermore, the target working path and the target protection path for executing the R2 service request are recorded in the network, and the relevant resource occupancy status is updated.

[0146] It can be seen that the protection method based on the quantum key distribution network of the embodiment of the present application is based on network topology abstraction, abstracts the non-trusted nodes into virtual links, and comprehensively considers the trusted relay nodes and the non-trusted relay nodes to select the target working path and the target protection path in the network, so that the target working path and the target protection path are both in the network where the trusted relay nodes and the non-trusted relay nodes are mixed, which not only meets the key requirements of the business requests, but also meets the maximum full load value that can be provided, thereby providing stable and reliable protection for the quantum key distribution network.

[0147] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0148] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0149] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, an embodiment of the present application also provides a protection device based on a quantum key distribution network.

[0150] refer to Figure 2 , the protection device based on quantum key distribution network, wherein the quantum key distribution network includes: trusted nodes and untrusted nodes.

[0151] The device is applied to a trusted node in the quantum key distribution network, and specifically includes: a topology module, a target working path module, a target protection path module and an update module.

[0152] The topology module 201 is configured to: record the physical position relationship between other trusted nodes and untrusted nodes to obtain a physical map of the quantum key distribution network; in response to determining that any two of the trusted nodes are physically connected only through one untrusted node, virtually remove the untrusted node in the physical map, and directly connect the two trusted nodes with a virtual link; in response to determining that a physical direct link is formed between any two of the untrusted nodes, virtually disconnect the physical direct link between the two untrusted nodes in the physical map to obtain a virtual topology map;

[0153] The target working path module 202 is configured to: parse the received service request, determine all service paths of the service request in the virtual topology map, and calculate the key requirement of the service request and the key resource of the service path; select the service path with the key resource greater than or equal to the key requirement and the least number of hops as the target working path, and virtualize and disconnect the service path with the key resource less than the key requirement and the number of hops less than or equal to the target working path in the virtual topology map;

[0154] The target protection path module 203 is configured to: take the service path that is not virtualized and disconnected in the virtual topology map as a candidate protection path, and construct a protection threshold lower than the key resource based on the key resource of the candidate protection path; within the protection threshold range, select the candidate protection path with a key resource greater than or equal to the key requirement and the least number of hops as the target protection path;

[0155] The updating module 204 is configured to: in response to determining that the target working path and the target protection path are screened out, update the current occupancy status of the service path and the occupancy status of the key resource in the topology network.

[0156] As an optional embodiment, the topology module 201 is specifically configured as a relevant module for generating a virtual topology map, and is set in each trusted node and run by each trusted node.

[0157] In this application, Figure 3 The architecture of the quantum key distribution network shown is used as an example. Figure 3 As shown, the QKD (quantum key distribution) network includes trusted relay nodes, also known as trusted nodes in this application, and untrusted relay nodes, also known as untrusted nodes in this application.

[0158] In the key transmission, each trusted node has the function of being a source node and a destination node, that is, the starting node and the ending node in the path.

[0159] In this embodiment, the network topology abstraction is first performed on the network mixed with trusted nodes and untrusted nodes. Each trusted node needs to perform network topology abstraction on the entire network and save the result of the network topology abstraction, that is, the virtual topology map.

[0160] Specifically, each trusted node traverses the entire QKD network, distinguishes between other trusted nodes and untrusted nodes except the trusted node, records the locations of all other trusted nodes and untrusted nodes, and the connections between them, and updates this record to the routing table of the trusted node to obtain a physical map of the QKD network.

[0161] In this embodiment, based on the obtained physical map, the non-trusted nodes therein may be further virtualized. "Virtualization" may also be referred to as "abstraction" in this embodiment.

[0162] Specifically, for any two trusted nodes, if the physical link between them is only connected by one untrusted node and there are no trusted nodes, then in the physical map of the QKD network, the untrusted node is virtualized and removed, and the two trusted nodes are directly connected via a virtual link.

[0163] In this embodiment, for at least two non-trusted nodes that are directly connected by physical links, the physical direct link between them is virtually disconnected in the physical map of the QKD network, and the physical map that completes the above-mentioned network topology abstraction operation is used as the virtual topology map.

[0164] by Figure 3 Taking the QKD network structure shown as an example, Figure 3 The connection between the untrusted node 7 and the untrusted node 8 is virtually disconnected, and the untrusted node 7 and the untrusted node 8 are abstracted and removed; further, the trusted node 2 is directly connected to the trusted node 4 through virtualization, and the trusted node 3 is directly connected to the trusted node 6 through virtualization, so as to obtain the following: Figure 4 The virtual topology map shown in FIG. 1 shows a virtualized direct connection represented by a dotted line and a solid line represents a physical direct connection link.

[0165] Furthermore, based on the obtained virtual topology map, it is necessary to confirm the key resource information in the virtual topology map.

[0166] Specifically, the key resource information includes: the number of wavelength channel time slots of the link between nodes, and the key generation rate of each time slot.

[0167] exist Figure 4 In the example, the number of wavelength channel time slots of the direct link between the two nodes is 5 time slots, denoted as: m = 5; the key generation rate is 1 key per time slot, denoted as: Vp =1unit / s.

[0168] As an optional embodiment, the target work path module 202 is specifically configured as a module related to the target work path of the execution service request, and is set in each trusted node and executed by the trusted node.

[0169] In the embodiments of the present application, Figure 5 A flowchart of target working path allocation is shown for detailed explanation.

[0170] Specifically, after receiving the service request, the service request is parsed, all service paths of the service request in the virtual topology map are determined, and the key requirements of the service request for each hop link and the key resources of each hop link in the service path are calculated.

[0171] The parsing process specifically includes: the trusted node that receives the service request parses the service request to obtain service attributes related to the service request.

[0172] The service attributes may include: the source node, the destination node, the service start time T of the service request s , Business duration T h , Business end time T end and the required key amount per unit time V r .

[0173] Furthermore, the trusted node uses the source node and the sink node to determine all service paths that can execute the service request in the virtual topology map, and calculates the specific number of hops for each service path.

[0174] In this embodiment, the number of hops of each service path is defined as: the number of trusted nodes included in the service path.

[0175] The process of calculating the key requirement includes: calculating the key requirement of each hop link using the following formula.

[0176] Key requirement of link = V r ×T h

[0177] Among them, when the same service request is executed under different service paths, the total key requirement of the service request under the service path is different. The key requirement calculated above is only used as the key requirement when the service request is executed under a single link in the service path, and in this embodiment, the key requirement of each hop link is the same. Furthermore, the sum of the key requirements of all links in a path can be used as the total key requirement of the path.

[0178] The process of calculating the key resource includes: using the following formula to calculate the key resource of each hop link, and using it as the maximum full load value of the key resource in the link.

[0179] Key resource of link = V p ×m×T h

[0180] Among them, since different service paths have different hop numbers and different numbers of links, different service paths have different total resources. The key resources calculated above are only used as the key resources of a single link in the service path, and in this embodiment, the key resources of each hop link are the same.

[0181] Furthermore, when the hop link is occupied by the service request being executed, when considering the unoccupied key resources, the amount of key resources occupied by the hop link should be subtracted from the maximum full load value of the key resources calculated above.

[0182] Furthermore, according to the hop count of the service path, all service paths are arranged in order of the number of hops from small to large, and the service path with the least number of hops is first selected as the candidate working path.

[0183] When there are multiple service paths with the same number of hops and the least number of hops, one of the service paths with the least number of hops can be randomly selected as a candidate working path.

[0184] Further, it is determined whether the candidate working path can meet the key requirement within the service duration.

[0185] Specifically, it includes: comparing the key requirement and the unoccupied key resources along each hop link in the candidate working path to make further judgment on the candidate working path.

[0186] Furthermore, when the unoccupied key resources of each link are less than the key requirement, it indicates that the available key resources of the link cannot meet the key requirement for executing the service request, and the candidate working path is not suitable as the target working path.

[0187] Furthermore, when the unoccupied key resources of any link are greater than or equal to the key requirement, it indicates that the available key resources of the candidate working path can meet the key requirement for executing the service request.

[0188] Furthermore, the link whose key resources do not meet the requirements for executing the service is abstractly disconnected in the virtual topology map, and thus the path is also abstractly disconnected.

[0189] Furthermore, among the remaining other service paths, the next service path, that is, the service path with the least hops, is selected in a pre-arranged order as a new candidate working path.

[0190] Furthermore, a candidate working path whose key resources of each hop link satisfy the requirements for executing the service request is taken as a target working path.

[0191] Furthermore, resources of the target working path are allocated to the service path.

[0192] In this embodiment, according to the above target working path allocation method, Figure 4 The specific virtual topology map example is shown for illustration.

[0193] When the service request R1 arrives at QKD, by parsing R1, the service attributes of R1 are obtained: source node: trusted node 1; sink node: trusted node 6; service start time T s : 20th second; service duration T h :30s; Business end time T end : 50th second; and the required key amount per unit time V r :2unit / s.

[0194] Based on the source node being the trusted node 1 and the sink node being the trusted node 6, 6 service paths are obtained: P 1-4-2-3-6 ;P 1-2-4-5-6 ;P 1-4-5-6 ;P 1-4-2-6 ;P 1-2-3-6 ; and P 1-2-6 .

[0195] Furthermore, the ranking of the six service paths is: 1-2-6 >P 1-2-3-6 =P 1-4-2-6 =P 1-4-5-6 >P 1-2-4-5-6 =P 1-4-2-3-6

[0196] Furthermore, the service path P is calculated 1-2-6 When executing R1, the key requirement for each link is:

[0197] V r ×T h =2×30=0 units

[0198] Calculate the service path P 1-2-6 Key resources in the middle link:

[0199] V p ×m×T h ×=1×5×30=150units

[0200] Furthermore, in this embodiment, the service path P 1-2-6No key resources are occupied, and its key resources are greater than the key requirements, so the service path P 1-2-6 as the target work path.

[0201] As an optional embodiment, the target protection path module 203 is specifically configured to allocate relevant modules of the target protection path, and is set in each trusted node and run by the trusted node. The target protection path is used to provide another alternative path for the business request to be used when the target working path of the business request fails or is otherwise unavailable.

[0202] In the embodiment of the present application, the target working path and the abstractly disconnected candidate working paths are firstly removed.

[0203] Specifically, in the service path of the service request, the selected target working path is removed, and the candidate working paths that are abstracted and disconnected are removed to obtain the remaining service paths.

[0204] Furthermore, the remaining service paths are used as candidate protection paths.

[0205] Furthermore, all candidate protection paths are arranged in order of the number of hops from small to large using the number of hops of the candidate protection paths.

[0206] Furthermore, when the hop counts of multiple candidate protection paths are equal, the order of the candidate protection paths with the equal hop counts is randomly arranged.

[0207] Further, it is determined whether the key requirement is greater than a protection threshold.

[0208] In this embodiment, since it is not recommended to fully load the protection path to carry the total key demand of the business request, a protection threshold for executing the business request can be constructed for each candidate protection path, and the protection threshold can be used to determine whether the candidate protection path is suitable for executing the business request.

[0209] Specifically, based on the number of hops of the candidate protection path, the protection threshold of the candidate protection path is established according to the following protection threshold formula:

[0210] Protection threshold = V p ×m×T h ×(number of service path hops - 1) × Y

[0211] Wherein, Y is a preset threshold parameter, and the range of the protection threshold can be adjusted according to the threshold parameter.

[0212] In this embodiment, the calculation sequence of the protection threshold is only exemplary, and the calculation may be performed only on the candidate protection paths involved in the above manner, or the protection threshold of each service path may be calculated first, and the pre-calculated result may be called here for the candidate protection path.

[0213] exist Figure 4 In the example shown, the threshold parameter is set to 0.8. Therefore, according to the order of candidate protection paths, 1-2-3-6 and P 1-4-2-6 A candidate protection path is randomly selected and its protection threshold is calculated.

[0214] Specifically, P 1-2-3-6 For example, the protection threshold is:

[0215] V p ×m×T h ×(number of service path hops - 1) × Y = 1 × 5 × 30 × (4-1) × 0.8 = 360 units

[0216] Furthermore, the total key requirement of the candidate protection path is calculated:

[0217] V r ×T h ×(number of service path hops - 1) = 2 × 30 × 3 = 180 units

[0218] Furthermore, based on the obtained protection threshold and total key requirement, a candidate protection path is selected according to the above ranking, and its total key requirement is compared with the protection threshold to determine whether the total key requirement is greater than the protection threshold.

[0219] Furthermore, when the total key demand is greater than the preset protection threshold, it indicates that the candidate protection path will run at a state close to the maximum full load value when executing the service request, and therefore it is determined that the candidate protection path cannot be used as the target protection path.

[0220] Furthermore, when the total key demand is less than or equal to the preset protection threshold, it indicates that the candidate protection path will not run at a state close to the maximum full load value when executing the service request, and therefore it is determined that the candidate protection path can be used as the target protection path 06.

[0221] Furthermore, the candidate protection path is abstractly disconnected in the virtual topology map to indicate that the path is not considered in the following steps.

[0222] Furthermore, excluding the candidate protection paths that have been abstracted and disconnected, the next candidate protection path is selected from the remaining candidate protection paths in a pre-arranged order, that is, the one with the least hops, and the protection threshold is determined again.

[0223] Furthermore, the calculated key requirements and unoccupied key resources are called for the links in the candidate protection path, and the two are compared to determine whether the key resources meet the key requirements.

[0224] Furthermore, when the unoccupied key resources in each hop link are less than the key requirement, it means that the available key resources of the link in the candidate protection path cannot meet the key requirement for executing the service request. The candidate protection path that has been abstracted and disconnected is removed again, and among the remaining candidate protection paths, the next candidate protection path in the sequence is selected, that is, the candidate protection path with the least hops, and it is determined again whether the key resources are sufficient.

[0225] Furthermore, when the unoccupied key resources of each hop link in the candidate protection path are greater than or equal to the key requirement, it means that the key resources of each hop link can meet the key requirement for executing the service request.

[0226] A candidate protection path whose link meets the key requirement and whose total key requirement is not greater than the protection threshold is determined as a target protection path, and the protection path is allocated to the service request as a protection resource.

[0227] Combination Figure 4 The example of the virtual topology map shown in FIG. 1-2-3-6 If the above judgment is met, it will be taken as the target protection path, and P 1-2-3-6 Assigned to service request R1.

[0228] As an optional embodiment, the updating module 204 is specifically configured to update the relevant module of the resource status in the virtual topology map, and is set in each trusted node and executed by the trusted node.

[0229] In this embodiment, based on the determination of the above-mentioned target working path and the determination of the target protection path, the key resources occupied in the target working path and the occupied path are recorded; similarly, the key resources occupied in the target protection path and the occupied path are recorded, and the available resources of the corresponding path are updated in the stored virtual topology map.

[0230] For the convenience of description, the above devices are described in terms of functions and are divided into various modules. Of course, when implementing the embodiments of the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0231] The device of the above embodiment is used to implement the corresponding protection method based on quantum key distribution network in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0232] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, an embodiment of the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the protection method based on the quantum key distribution network as described in any of the above embodiments is implemented.

[0233] Figure 7 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0234] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0235] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solution provided in the embodiment of the present application is implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0236] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0237] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0238] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0239] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiment of the present application, and does not necessarily include all the components shown in the figure.

[0240] The device of the above embodiment is used to implement the corresponding protection method based on quantum key distribution network in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0241] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0242] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present application will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0243] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0244] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the protection scope of the present application.

Claims

1. A protection method based on a quantum key distribution network, the quantum key distribution network comprising: Trusted nodes and untrusted nodes; The method is applied to a trusted node in the quantum key distribution network, comprising: The trusted node records the physical position relationship between other trusted nodes and untrusted nodes to obtain a physical map of the quantum key distribution network; In response to determining that any two of the trusted nodes are physically connected only through one of the untrusted nodes, the untrusted node is virtually removed from the physical map, and the two trusted nodes are directly connected via a virtual link; In response to determining that a physical direct link is formed between any two of the untrusted nodes, the physical direct link between the two untrusted nodes is virtually disconnected in the physical map to obtain a virtual topology map; And also includes: Parse the received service request, determine all service paths of the service request in the virtual topology map, and calculate the key requirement of each link of the service request and the key resource of each link in the service path; select the service path with the least number of hops and the key resource of each link greater than or equal to the key requirement as the target working path, and virtualize and disconnect the link that does not meet the key requirement in the virtual topology map; In the virtual topology map, the service path that does not contain a virtualized disconnected link is selected as a candidate protection path, the total key requirement of the entire candidate protection path is calculated, and a protection threshold that is lower than the total key requirement is constructed; within the protection threshold range, the candidate protection path with the least number of hops and the key resources of each hop of the link are greater than or equal to the key requirement is selected as the target protection path; The calculating the total key requirement of the entire candidate protection path and constructing a protection threshold lower than the total key requirement includes: Calculate the total resource of the entire candidate protection path by using the key resource of the link and the number of hops of the candidate protection path, and use the total key demand as the maximum full load value of the entire candidate protection path; A threshold parameter less than 1 is preset, and based on the maximum full load value, the protection threshold when using the candidate protection path is calculated, wherein the protection threshold is expressed by a formula: Protection threshold = Vp × m × Th × (number of service path hops - 1) × Y; Among them, Vp×m×Th is the maximum full load value, Y is the threshold parameter, Vp is the key generation rate, m is the number of wavelength channel time slots of the direct link between two nodes, and Th is the service duration; The calculating the key requirement of the service request for each hop link and the key resource of each hop link in the service path includes: The key requirement of the service request for each link hop is calculated using the service duration and the key amount per unit time, wherein the key requirement is expressed using the formula: The key requirement of the link = Vr × Th; Among them, Vr is the key quantity per unit time, and Th is the service duration; Determining the number of wavelength channel time slots and the key generation rate of the virtual topology map; The key resource of each link is calculated using the number of wavelength channel time slots and the key generation rate, wherein the key resource is expressed using a formula: The key resource of the link = Vp × m × Th; Where Vp is the key generation rate, m is the number of wavelength channel time slots available in the direct link between two nodes, and Th is the duration of the service; The selecting, in the service path, a path with the least number of hops and a key resource of each link being greater than or equal to the key requirement as the target working path includes: Taking the service path with the least hops as a candidate working path; In response to determining that there are multiple service paths with an equal number of hops and a minimum number of hops, randomly selecting the candidate working path from the service paths with the minimum number of hops; Determining the sufficiency of key resources at each link hop along the candidate working path; In response to determining that the key resources that are not occupied by each hop of the link are greater than or equal to the key requirement of the service request for each hop of the link, determining that the key resources are sufficient, and using the candidate working path as the target working path; The virtualizing and disconnecting the link that does not meet the key requirement includes: In response to determining that the unoccupied key resource of the link is less than the key requirement of the service request for each link hop, abstractly disconnecting the link in the virtual topology map, and selecting a new candidate working path from the remaining service paths; The selecting, within the protection threshold range, the candidate protection path with the least number of hops and the key resource of each link hop being greater than or equal to the key requirement as the target protection path comprises: Arranging the order of the candidate protection paths; Comparing the total key requirement of the candidate protection path with the protection threshold in the order; In response to determining that the total key demand is greater than the preset protection threshold, virtualizing and disconnecting the candidate protection path; In response to determining that the total key demand is less than or equal to the preset protection threshold, determining key resource sufficiency at each link hop along the candidate protection path; In response to the fact that the unoccupied key resources of each link hop are greater than or equal to the key requirement of each link hop of the service request, determining that the key resources are sufficient, and using the candidate protection path as the target protection path; In response to determining that the unoccupied key resource of the link is less than the key requirement of the service request for each link hop, abstractly disconnecting the link in the virtual topology map, and determining the protection threshold and key resource sufficiency of the next candidate protection path in the sequence; The arranging the order of the candidate protection paths includes: Determining the number of hops of each of the candidate protection paths; The candidate protection paths are arranged in order from small to large hop counts.

2. The method according to claim 1, further comprising: In response to determining that the target working path and the target protection path are screened out, the current occupancy status of the service path and the occupancy status of the key resource are updated in the virtual topology map.

3. The method according to claim 1, characterized in that The obtaining of the physical map of the quantum key distribution network comprises: Each of the trusted nodes performs the following operations: The entire network is traversed to distinguish other trusted nodes from the untrusted nodes, and the physical locations of other trusted nodes and the untrusted nodes are recorded in the routing table of the trusted node.

4. The method according to claim 1, characterized in that: The determining of all service paths of the service request in the virtual topology map includes: Obtaining a source node and a destination node of the service request by parsing the service request; and determining all the service paths related to the service request according to the source node and the sink node; The service duration and the key quantity per unit time of the service request are obtained by parsing.

5. A protection device based on a quantum key distribution network, the quantum key distribution network comprising: Trusted nodes and untrusted nodes; The device is applied to a trusted node in the quantum key distribution network, including: a topology module, a target working path module, a target protection path module and an update module; Wherein, the topology module is configured to record the physical position relationship between other trusted nodes and untrusted nodes to obtain a physical map of the quantum key distribution network; in response to determining that any two of the trusted nodes are physically connected only through one of the untrusted nodes, the untrusted node is virtually removed from the physical map, and the two trusted nodes are directly connected with a virtual link; in response to determining that a physical direct link is formed between any two of the untrusted nodes, the physical direct link between the two untrusted nodes is virtually disconnected in the physical map to obtain a virtual topology map; The target working path module is configured to parse the received service request, determine all service paths of the service request in the virtual topology map, and calculate the key requirement of each link of the service request and the key resource of each link in the service path; select the service path with the least number of hops and the key resource of each link greater than or equal to the key requirement as the target working path, and virtualize and disconnect the link that does not meet the key requirement in the virtual topology map; The target protection path module is configured to select the service path that does not contain a virtualized disconnected link as a candidate protection path in the virtual topology map, calculate the total key requirement of the entire candidate protection path, and construct a protection threshold lower than the total key requirement; within the protection threshold range, select the candidate protection path with the least number of hops and the key resources of each hop of the link greater than or equal to the key requirement as the target protection path, wherein the calculating the total key requirement of the entire candidate protection path and constructing the protection threshold lower than the total key requirement includes: Calculate the total resource of the entire candidate protection path by using the key resource of the link and the number of hops of the candidate protection path, and use the total key demand as the maximum full load value of the entire candidate protection path; A threshold parameter less than 1 is preset, and based on the maximum full load value, the protection threshold when using the candidate protection path is calculated, wherein the protection threshold is expressed by a formula: Protection threshold = Vp × m × Th × (number of service path hops - 1) × Y; Among them, Vp×m×Th is the maximum full load value, Y is the threshold parameter, Vp is the key generation rate, m is the number of wavelength channel time slots of the direct link between two nodes, and Th is the service duration; The calculating the key requirement of the service request for each hop link and the key resource of each hop link in the service path includes: The key requirement of the service request for each link hop is calculated using the service duration and the key amount per unit time, wherein the key requirement is expressed using the formula: The key requirement of the link = Vr × Th; Among them, Vr is the key quantity per unit time, and Th is the service duration; Determining the number of wavelength channel time slots and the key generation rate of the virtual topology map; The key resource of each link is calculated using the number of wavelength channel time slots and the key generation rate, wherein the key resource is expressed using a formula: The key resource of the link = Vp × m × Th; Where Vp is the key generation rate, m is the number of wavelength channel time slots available in the direct link between two nodes, and Th is the duration of the service; The selecting, in the service path, a path with the least number of hops and a key resource of each link being greater than or equal to the key requirement as the target working path includes: Taking the service path with the least hops as a candidate working path; In response to determining that there are multiple service paths with an equal number of hops and a minimum number of hops, randomly selecting the candidate working path from the service paths with the minimum number of hops; Determining the sufficiency of key resources at each link hop along the candidate working path; In response to determining that the key resources that are not occupied by each hop of the link are greater than or equal to the key requirement of the service request for each hop of the link, determining that the key resources are sufficient, and using the candidate working path as the target working path; The virtualizing and disconnecting the link that does not meet the key requirement includes: In response to determining that the unoccupied key resource of the link is less than the key requirement of the service request for each link hop, abstractly disconnecting the link in the virtual topology map, and selecting a new candidate working path from the remaining service paths; The selecting, within the protection threshold range, the candidate protection path with the least number of hops and the key resource of each link hop being greater than or equal to the key requirement as the target protection path comprises: Arranging the order of the candidate protection paths; Comparing the total key requirement of the candidate protection path with the protection threshold in the order; In response to determining that the total key demand is greater than the preset protection threshold, virtualizing and disconnecting the candidate protection path; In response to determining that the total key demand is less than or equal to the preset protection threshold, determining key resource sufficiency at each link hop along the candidate protection path; In response to the fact that the unoccupied key resources of each link hop are greater than or equal to the key requirement of each link hop of the service request, determining that the key resources are sufficient, and using the candidate protection path as the target protection path; In response to determining that the unoccupied key resource of the link is less than the key requirement of the service request for each link hop, abstractly disconnecting the link in the virtual topology map, and determining the protection threshold and key resource sufficiency of the next candidate protection path in the sequence; The arranging the order of the candidate protection paths includes: Determining the number of hops of each of the candidate protection paths; Arrange the candidate protection paths in order from small to large hop counts; The updating module is configured to update the current occupancy status of the service path and the occupancy status of the key resource in the topology network in response to determining that the target working path and the target protection path are screened out.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.

Images