An open key distribution network based on physical system

Abstract

The present invention proposes an open key distribution network architecture based on a physical system, which is divided into a control plane and a business plane from a vertical perspective. The control plane does not involve keys, and the business plane does not involve control signaling. From a horizontal perspective, a three-layer architecture is adopted in which a key production layer, a key exchange layer, and a key service layer are separated. The key generation layer, the key exchange layer, and the key service layer respectively realize the key production, distribution, and output of adjacent nodes, cross-nodes, and end-to-end, thereby achieving a clearer logical segmentation.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to an open key distribution network architecture based on a physical system. Background Art

[0002] Quantum key distribution (QKD) uses quantum systems to prepare, transmit, receive and purify information to obtain secure symmetric keys that cannot be stolen by others in physical principles. This process ensures that the keys obtained by both parties in communication are completely consistent, and no third party can obtain any information about the keys. The sender of the optical fiber quantum key distribution system needs to send quantum light and synchronization light to the receiver, and both parties need to send data to each other for key negotiation.

[0003] Figure 1 The existing quantum secure communication network architecture is shown. Figure 1 As shown, the quantum secure communication network architecture includes two parts: quantum key distribution network and user network. The quantum key distribution network includes quantum layer, key management layer, QKDN control layer and QKDN network management layer, and the user network includes application layer and user network network management layer. In addition, in this network architecture, interfaces are set between the quantum layer and the key management layer, QKDN network management layer, and QKDN control layer. Interfaces are set between the key management layer and the quantum layer, QKD network management layer, QKDN control layer, and application layer. Interfaces are set between the QKDN control layer and the quantum layer, key management layer, and QKDN network management layer. It can be seen that there is a strong coupling relationship between the various functional layers in the network, and the entire network hierarchy is not clear, which will eventually lead to the following problems:

[0004] 1. Network upgrade and maintenance are difficult. Changes to any level module will affect the interfaces between many different levels of modules.

[0005] 2. Poor compatibility between different manufacturers. Each manufacturer has its own device control and key exchange system, and may have a distributed control system, but under the current network architecture, it can only be centrally controlled by the QKDN controller, which will make it difficult to connect different manufacturers.

[0006] 3. The security design of the classic IP bearer network is difficult and costly. Since the key distribution network hierarchy is not clear, the key and control information cannot be separated well, and the classic IP bearer network is also difficult to divide the security domain and provide targeted protection. After the attacker breaks through the classic IP network of the system at a single point, they often attack randomly between various layers. Moreover, the QKDN controller, as the brain of the network, can control the key management layer and the quantum layer at the same time, and is the focus of attack. Once attacked, the consequences are more serious.

[0007] In addition, the existing network architecture is designed based on quantum key distribution and does not incorporate other possible secure key distribution technologies such as WCKG technology. In particular, the key distribution networks based on QKD are designed and provide services for fixed nodes, which cannot meet the access requirements of mobile nodes, resulting in insufficient network application expansion capabilities. Moreover, in the existing network architecture, users and devices are bound to each other, that is, users can only communicate with designated devices to access the key distribution network, and key distribution and exchange are performed based on this device. However, real users or applications may change devices, access the network at different nodes and apply for keys. Therefore, the existing network architecture cannot actually meet the needs of real application scenarios. Summary of the invention

[0008] In view of the above problems, the present invention proposes an open key distribution network architecture based on a physical system, which is divided into a control plane and a business plane from a vertical perspective. The control plane does not involve keys, and the business plane does not involve control signaling. From a horizontal perspective, a three-layer architecture with separated key production layer, key exchange layer and key service layer is adopted. The key generation layer, key exchange layer and key service layer respectively realize the key production, distribution and output of adjacent nodes, cross-nodes and end-to-end, thereby achieving a clearer logical division.

[0009] Specifically, the present invention relates to an open key distribution network architecture based on a physical system, which is divided into a business plane, a control plane and a user plane, and includes a key production layer, a key exchange layer, a key service layer and a key application layer, wherein:

[0010] The key production layer is used to generate point-to-point keys;

[0011] The key exchange layer is used to realize network distribution of keys;

[0012] The key service layer is used to implement user authentication, authorization and policy management, and supply keys;

[0013] The key application layer includes user applications or devices that use keys;

[0014] The key production layer, key exchange layer and key service layer are all divided into the business plane and the control plane, wherein: the business plane is defined as assuming the key production, key exchange and key service functions, the control plane is defined as controlling the functional modules in the business plane but not involving the key itself; and the key application layer constitutes the user plane.

[0015] Furthermore, in the key production layer, the service plane is defined to implement physical signal reception and transmission, time synchronization, key data negotiation, key output, and link switching functions, and the control plane is defined to implement production control strategy, link switching strategy, and status monitoring functions;

[0016] In the key exchange layer, the business plane is defined to implement key input, key storage, key relay, key output, and routing addressing functions, and the control plane is defined to implement location services, routing control, and cross-domain settlement functions;

[0017] In the key service layer, the business plane is defined to implement user registration, key input, key storage, and key output functions, and the control plane is defined to implement user authorization and authentication, policy management, status monitoring, and billing management functions.

[0018] Furthermore, on the business plane, interfaces are only provided between the key production layer and the key exchange layer, between the key exchange layer and the key service layer, and between the key service layer and the key application layer to realize the transmission of the key;

[0019] On the control plane, interfaces are only provided between the key production layer and the key exchange layer, between the key exchange layer and the key service layer, and between the key service layer and the key application layer to realize the transmission of request and control information and data;

[0020] In each of the key production layer, the key exchange layer and the key service layer, an interface is provided between the business plane and the control plane to realize the interaction of data and control information; and

[0021] Interfaces for data interaction with adjacent nodes are respectively provided on the business planes of the key production layer and the key exchange layer.

[0022] Furthermore, the business plane of the key production layer is provided with a key production module and a physical layer link module, the control plane of the key production layer is provided with a production control module, the key production module is used to generate a key according to a key distribution protocol, and the production control module includes a production network element control module and a link network element control module;

[0023] The business plane of the key exchange layer is provided with a key exchange module, and the control plane of the key exchange layer is provided with an exchange management and control module, and the key exchange module is used to receive and manage the key generated by the key generation module and relay it;

[0024] The business plane of the key service layer is provided with a user service module, and the control plane of the key service layer is provided with a service management and control module. The user service module is used to receive and manage keys from the key exchange module and provide end-to-end key services for the key application layer.

[0025] Further, the key production module includes a signal preparation detection module, a time synchronization module, a data negotiation module, a key output module, a random number module, and a production network element management module;

[0026] The signal preparation and detection module is used to communicate with the signal preparation and detection modules of adjacent nodes to achieve preparation, transmission and detection of physical signals;

[0027] The time synchronization module is used to communicate with the signal preparation and detection modules of adjacent nodes to achieve time synchronization;

[0028] The data negotiation module is used to communicate with the signal preparation detection module of the adjacent node to achieve parameter evaluation, error correction and privacy amplification of the signal detection data;

[0029] The key output module is used to output the point-to-point key to the key exchange layer;

[0030] The random number module is used to generate random numbers and provide them to the signal preparation detection module and the data negotiation module;

[0031] The production network element management module is used to communicate with the production network element control module to monitor the device status, control the start and stop of the device, set device parameters, and perform authentication and network access for device initialization;

[0032] The physical layer link module includes a multiplexing module for wavelength division multiplexing of multiple quantum channels and classical channels, and a link switching module for optical path switching or branching of communication channels between multiple pairs of key generation modules;

[0033] The production network element control module is used to issue production instructions according to the requirements of the switching control module, and obtain and configure the configuration and status information of the production network element management module;

[0034] The link network element management and control module is used to issue link switching control instructions according to the requirements of the production network element management and control module, and obtain and configure the configuration and status information of the link network element management module.

[0035] Further, the key exchange module includes a key storage module, a key relay module, a key lifecycle management module, a key output module, a location query module, a routing query module, and a switching network element management module, and the switching control module includes a location service module, a routing control module, a switching network element control module, and a cross-domain settlement module;

[0036] The key storage module is used to receive the key from the key production module and store it;

[0037] The key relay module is used to communicate with other key exchange modules and relay keys using the communication links between the key exchange modules;

[0038] The key lifecycle management module is used to manage the whole lifecycle of the key of this layer, which includes the process from receiving the key to outputting the key to the user service module;

[0039] The key output module is used to output the key to the user service module;

[0040] The location query module is used to communicate with the location service module to obtain and report the key production network address so as to generate a key relay route;

[0041] The routing query module is used to communicate with the routing control module to generate the key relay route according to the network addresses of the local end and the opposite end;

[0042] The switching network element management module is used to communicate with the switching network element control module to monitor the device status, control the device start and stop, set device parameters, and perform device initialization authentication and network access;

[0043] The location service module is used to record the network location information of the user equipment and provide query services;

[0044] The routing control module is used to provide the key relay route for the key exchange module according to the link status or the key inventory;

[0045] The switching network element management and control module is used to issue key exchange instructions according to the requirements of the service management and control module, and obtain and configure the configuration and status information of the switching network element management module;

[0046] The cross-domain settlement module is used for traffic settlement and billing between different subnets.

[0047] Further, the user service module includes a key storage module, a key lifecycle management module, a key output module, a user authentication module, and a service network element management module, and the service control module includes a user authentication and authorization module, a policy management module, and a service network element control module;

[0048] The key storage module is used to receive the key from the key exchange module and store it;

[0049] The key lifecycle management module is used to manage the whole lifecycle of the key of this layer, which includes the process from receiving the key to outputting the key to the key application layer;

[0050] The key output module is used to output the key to the key application layer;

[0051] The user authentication module is used for user authentication;

[0052] The service network element management module is used to communicate with the service network element control module to monitor the device status, control the device start and stop, set device parameters, and initialize the device authentication and network access;

[0053] The user authentication and authorization module is used for user identity authentication, authorization and access control;

[0054] The policy management module is used to control the network resources obtained by users according to service quality management and billing policies;

[0055] The service network element management and control module is used to issue key service instructions according to the requirements of the key application layer, obtain and configure the configuration and status information of the service network element management module, and provide status data for the key application layer.

[0056] Furthermore, the business plane is provided with a first business interface, a second business interface and a third business interface;

[0057] The first service interface is used to connect the reference point of the key production module and the key exchange module, and the key production module transmits the point-to-point key to the key exchange module;

[0058] The second service interface is used to connect the reference point of the key exchange module and the user service module, and the key exchange module transmits the key to the user service module;

[0059] The third service interface is used to connect the reference point of the user service module and the key application layer, and the key is transmitted from the user service module to the key application layer.

[0060] Furthermore, the control plane is provided with a first control interface, a second control interface and a third control interface;

[0061] The first control interface is used to connect the reference points of the production control module and the exchange control module, and transmit requests and control information and data for the key production layer, so as to dynamically adjust the production status of the key production module and the connection status of the physical layer link module;

[0062] The second control interface is used to connect the reference points of the exchange control module and the service control module, and transmit the request and control information and data for the key exchange layer, so as to dynamically adjust the key relay state of the key exchange module;

[0063] The third control interface is used to connect the reference point of the service management and control module and the key application layer to transmit key service data of user applications or devices.

[0064] Further, the key service layer is provided with a first and a second key service layer interface, wherein: the first key service layer interface is used to connect the reference point of the link network element control module and the link switching module to transmit network management information and control signaling; the second key service layer interface is used to connect the reference point of the production network element control module and the production network element management module to transmit network management information and control signaling;

[0065] The key exchange layer is provided with a first, a second and a third key exchange layer interface, wherein: the first key exchange layer interface is used to connect the reference point of the switching network element control module and the switching network element management module to transmit network management information and control signaling; the second key exchange layer interface is used to connect the reference point of the routing control module and the routing query module to transmit key routing information; the third key exchange layer interface is used to connect the reference point of the location service module and the location query module to transmit location information;

[0066] The key service layer is provided with a first and a second key service layer interface, wherein: the first key service layer interface is used to connect the reference points of the service network element control module and the service network element management module to transmit network management information and control signaling; the second key service layer interface is used to connect the reference points of the user authentication and authorization module and the user authentication module to facilitate identity authentication and credential update of the user service module.

[0067] Furthermore, the key service layer is provided with a third, fourth and fifth key service layer interfaces, wherein: the third key service layer interface is used to connect the reference points of two adjacent signal preparation detection modules and transmit the physical signal used for the key distribution protocol; the fourth key service layer interface is used to connect the reference points of two adjacent time synchronization modules to provide time synchronization for signal preparation detection; the fifth key service layer interface is used to connect the reference points of two adjacent data negotiation modules and transmit basis vector matching, parameter estimation, error correction and privacy amplification parameters and data used for key distillation operations;

[0068] The key exchange layer is provided with a fourth key exchange layer interface for connecting the reference points of two adjacent key exchange modules and transmitting information and data related to key relay, key synchronization, key authentication and mutual identity authentication of key exchange modules. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] The specific implementation modes of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0070] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. It is obvious that the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0071] Figure 1 The existing general quantum secure communication network architecture is shown;

[0072] Figure 2 Schematically illustrates the functional plane division of the physical system-based open key distribution network architecture according to the present invention;

[0073] Figure 3 The functional layer settings of the physical system-based open key distribution network architecture according to the present invention are exemplarily shown. DETAILED DESCRIPTION

[0074] Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments are provided by way of example so as to fully convey the spirit of the present invention to those skilled in the art to which the present invention belongs. Therefore, the present invention is not limited to the embodiments disclosed herein.

[0075] Figure 2 The functional plane division of the open key distribution network architecture based on the physical system according to the present invention is shown. Figure 2 As shown, the open key distribution network architecture is divided into a service plane (ie, a key service plane), a control plane and a user plane.

[0076] The business plane is defined to undertake key generation, key exchange and key service functions.

[0077] The control plane is defined as controlling the functional modules in the business plane, such as starting, stopping, switching, routing and other functions, but does not involve the key itself.

[0078] The user plane is defined as various user applications or user devices that use keys, such as cloud cryptographic platforms, link cryptographic machines, server cryptographic machines, and mobile applications (APP applications).

[0079] Figure 3 The functional layer settings of the physical system-based open key distribution network architecture according to the present invention are exemplarily shown.

[0080] like Figure 3 As shown, the physical system-based open key distribution network architecture of the present invention includes a key production layer, a key exchange layer, a key service layer and a key application layer.

[0081] The key production layer is used to generate point-to-point keys (random number sequences), which mainly includes various types of devices used to generate point-to-point keys, such as quantum key distribution (QKD) devices or wireless channel key generation (WCKG) devices.

[0082] The key exchange layer is used to achieve network distribution of keys.

[0083] The key service layer is used to implement user authentication, authorization and policy management, as well as to supply keys according to user needs.

[0084] The key application layer mainly includes user applications or user devices that use keys.

[0085] Continue to see Figure 3 In the key distribution network architecture of the present invention, the key production layer, the key exchange layer and the key service layer are all divided into a business plane and a control plane.

[0086] The business plane of the key production layer is defined to implement physical signal reception and transmission, time synchronization, key data negotiation, key output, and link switching functions, and the control plane is defined to implement production control strategies, link switching strategies, status monitoring functions, etc.

[0087] The business plane of the key exchange layer is defined to implement key input, key storage, key relay, key output, routing addressing functions, etc., and the control plane is defined to implement location services, routing control, cross-domain settlement functions, etc.

[0088] The business plane of the key service layer is defined to implement user registration, key input, key storage, key output functions, etc. The control plane is defined to implement user authorization and authentication, policy management, status monitoring, billing management functions, etc.

[0089] Those skilled in the art will understand that the above-mentioned functional layers and plane divisions only represent logical module divisions, and do not represent the actual physical form, logical module and physical form are independent of each other. For example, the routing control module used to implement the routing control function can be distributedly deployed in each key exchange device; or the key service and key exchange functions can be deployed in the same physical device at the same time.

[0090] Accordingly, an optimized interface configuration is also proposed in the key distribution network architecture of the present invention, namely: in the vertical direction, interfaces are set in series on the functional layers on the same plane; in the horizontal direction, interfaces are set between two planes of the functional layers. Thus, a clearer logical segmentation and a determined interface configuration can be achieved in the key distribution network architecture, which is particularly beneficial for upgrade maintenance and compatibility between different manufacturers.

[0091] Specifically, on the business plane, interfaces may be set only between the key production layer and the key exchange layer, between the key exchange layer and the key service layer, and between the key service layer and the key application layer to realize the transmission of keys; on the control plane, interfaces may be set only between the key production layer and the key exchange layer, between the key exchange layer and the key service layer, and between the key service layer and the key application layer to realize the transmission of requests and control information and data corresponding to user needs; within each functional layer, interfaces may be set only between the business plane and the control plane to realize the interaction of data and control information; and interfaces for data interaction with the outside are set on the business plane.

[0092] Continue to see Figure 3 As a preferred implementation, the business plane of the key production layer can be provided with a key production module and a physical layer link module; the control plane of the key production layer can be correspondingly provided with a production management and control module, which includes a production network element management and control module and a link network element management and control module.

[0093] The key generation module is used to generate a key according to a key distribution protocol. In the present invention, the key distribution protocol may include but is not limited to a QKD protocol, a WCKG protocol or other secure key distribution protocols.

[0094] exist Figure 3 In the example, the key production module may include a signal preparation detection module, a time synchronization module, a data negotiation module, a key output module, a random number module, and a production network element management module.

[0095] The signal preparation and detection module is used to communicate with the signal preparation and detection modules of adjacent nodes to realize the preparation, sending, transmission and detection of quantum signals or wireless signals.

[0096] The time synchronization module is used to communicate with the signal preparation and detection module of the adjacent node to achieve time synchronization between the two to support the preparation and detection of the physical layer key production signal.

[0097] The data negotiation module is used to communicate with the signal preparation and detection modules of adjacent nodes to implement parameter evaluation, error correction and privacy amplification of the classical data obtained after signal detection in order to establish a symmetric and secure key.

[0098] The key output module is used to securely output the produced point-to-point key to the key exchange layer (key exchange module) according to the requirements of the key exchange layer (key exchange module).

[0099] The random number module is used to generate random numbers and provide them to the signal preparation detection module and the data negotiation module for use.

[0100] The production network element management module is used to communicate with the I / O of the production network element control module, monitor the key status of the equipment, control the start and stop of the equipment, set key parameters, and is responsible for the authentication and network access of the equipment initialization. For example, the authentication of equipment initialization can be implemented offline, and after accessing the network, it can be authenticated online.

[0101] The physical layer link module may include a multiplexing module and a link switching module, wherein: the multiplexing module is used for wavelength division multiplexing of multiple quantum channels and classical channels; the link switching module is used to realize optical path switching or branching of communication channels between multiple pairs of key production modules, so as to establish key distribution links between different network users as needed.

[0102] On the control plane, the production network element management and control module is used to issue production instructions according to the requirements of the control plane of the key exchange layer (the switching network element management and control module of the switching management and control module), obtain and configure the configuration information and status information of the production network element management module, and obtain and process alarms about fault diagnosis results.

[0103] The link network element management and control module is used to issue link switching control instructions according to the requirements of the production network element management and control module, obtain and configure the configuration information and status information of the link network element management module, obtain alarms about fault diagnosis results and process them.

[0104] Continue to see Figure 3 As a preferred implementation, the business plane of the key exchange layer can be provided with a key exchange module, and the control plane of the key exchange layer can be correspondingly provided with an exchange management and control module.

[0105] The key exchange module is used to receive and manage the keys generated by the key production module, and to relay the keys.

[0106] exist Figure 3 In the example, the key exchange module may include a key storage module, a key relay module, a key lifecycle management module, a key output module, a location query module, a routing query module, and a switching network element management module.

[0107] The switching management and control module may include a location service module, a routing control module, a switching network element management and control module, and a cross-domain settlement module.

[0108] The key storage module is used to receive the key from the key production module, and store the key in a key pool according to the key information identifier according to preset rules.

[0109] The key relay module is used to communicate with other key exchange modules, and the communication link between the key exchange modules is used to relay the key to achieve end-to-end key distribution in the network. In the present invention, the key relay adopts an encryption method with information theoretical security (ITS) and a one-time password (OTP) scheme.

[0110] The key lifecycle management module is used for the full lifecycle management of the keys at this layer, which includes the entire process from receiving the keys from the key production module to delivering them to the business plane (user service module) of the key service layer.

[0111] Furthermore, the key lifecycle management module can also be used to manage according to specific policies and perform deletion or retention operations on the keys after they are used.

[0112] The key output module is used to securely output the end-to-end keys produced to the business plane (user service module) of the key service layer according to the requirements of the user service module.

[0113] The location query module is used to perform I / O communication with the location service module, obtain and report the key production network address, and generate the key relay route.

[0114] The route query module is used to perform I / O communication with the route control module and generate a key relay route according to the network addresses of the local end and the opposite end.

[0115] The switching network element management module is used to communicate with the switching network element control module for I / O, monitor the key status of the device, control the start and stop of the device, set the device parameters, and is responsible for the authentication and network access of the device initialization. For example, the authentication of device initialization can be implemented offline, and after network access, it can be authenticated online.

[0116] The location service module is used to record the network location information of the user equipment and provide query services. For example, the location service module can be provided with a home location registration module (HLR) and a visitor location registration module (VLR).

[0117] The routing control module is used to provide a key relay route for the key exchange module according to the link status or key inventory.

[0118] The switching network element management and control module is used to issue key exchange instructions according to the requirements of the control plane of the key service layer (service network element management and control module), obtain and configure the configuration information and status information of the switching network element management module, and obtain and process alarms about fault diagnosis results.

[0119] The cross-domain settlement module is used for traffic settlement and billing between different subnets.

[0120] Continue to see Figure 3 As a preferred implementation, the business plane of the key service layer can be provided with a user service module, and the control plane of the key service layer can be correspondingly provided with a service management and control module.

[0121] The user service module is used to receive and manage the keys generated by the key exchange module, and to provide end-to-end key services for users.

[0122] exist Figure 3 In the example of , the user service module may include a key storage module, a key lifecycle management module, a key output module, a user authentication module, and a service network element management module.

[0123] The service management and control module may include a user authentication and authorization module, a policy management module, and a service network element management and control module.

[0124] The key storage module is used to receive the key from the key exchange module, and store the key in a key pool according to the key information identifier according to preset rules.

[0125] The key lifecycle management module is used for the full lifecycle management of the key at this layer, which includes the entire process from receiving the key from the key exchange module to delivering it to the key application layer (user application or user device).

[0126] Furthermore, the key lifecycle management module can also perform deletion or retention operations on the key after use according to specific policy management.

[0127] The key output module is used to securely output the generated end-to-end key to the key application layer according to the requirements of the user service module.

[0128] The user authentication module is used for user authentication. For example, user initial authentication can be implemented in an offline manner, and after entering the network, authentication can be performed online.

[0129] The service network element management module is used to communicate with the service network element control module for I / O, monitor the key status of the device, control the start and stop of the device, set the device parameters, and is responsible for the authentication and network access of the device initialization. For example, the device initialization authentication can be implemented offline, and the authentication can be performed online after network access.

[0130] The user authentication and authorization module is used for user identity authentication, authorization and access control.

[0131] The policy management module is used to control the network resources obtained by users based on service quality management and billing policies.

[0132] The service network element management and control module is used to issue key service instructions according to the needs of the key application layer (user application or user equipment), obtain and configure the configuration information and status information of the service network element management module, obtain and process alarms about fault diagnosis results, and provide status data for the key application layer (user application or user equipment).

[0133] exist Figure 3 In the example of , the key distribution network architecture can adopt the following interface configuration.

[0134] A first business interface BP-1, a second business interface BP-2 and a third business interface BP-3 are set on the business plane, wherein: the first business interface is used to connect the reference point between the key production module and the key exchange module, and transmit the point-to-point key produced by the key production module to the key exchange module; the second business interface is used to connect the reference point between the key exchange module and the user service module, and transmit the key after exchange and relay by the key exchange module to the user service module; the third business interface is used to connect the reference point between the user service module and the user application or user equipment, and transmit the end-to-end key to the user application or user equipment.

[0135] A first control interface CP-1, a second control interface CP-2 and a third control interface CP-3 are set on the control plane, wherein: the first control interface is used to connect the reference point of the production control module and the switching control module, transmit the request and control information and data of the key exchange layer to the key production layer, and realize the dynamic adjustment of the production status of the key production module and the connection status of the physical layer link module; the second control interface is used to connect the reference point of the switching control module and the service control module, transmit the request and control information and data of the key service layer to the key exchange layer, and realize the dynamic adjustment of the key relay status of the key exchange module; the third control interface is used to connect the reference point of the service control module and the key application layer, transmit the key service data of the user application or the user equipment, and arrange corresponding strategies according to the requirements of the user application or the user equipment, so as to provide key services with a certain service quality.

[0136] The key service layer is provided with a first key service layer interface KPL-1, a second key service layer interface KPL-2, a third key service layer interface KPL-3, a fourth key service layer interface KPL-4, and a fifth key service layer interface KPL-5, wherein: the first key service layer interface is used to connect the reference point of the link network element control module and the link switching module, and transmit the network management information and control signaling exchanged between the transmission modules; the second key service layer interface is used to connect the reference point of the production network element control module and the production network element management module, and transmit the network management information and control signaling exchanged between the transmission modules; the third key service layer interface is used to connect the reference points of two adjacent signal preparation and detection modules, for example, through a physical link, and transmit the physical signal in the wireless or quantum key protocol; the fourth key service layer interface is used to connect the reference points of two adjacent time synchronization modules, for example, through a classical communication link, to provide high-precision time synchronization for signal preparation and detection, so as to support the sending and detection of quantum or wireless signals; the fifth key service layer interface is used to connect the reference points of two adjacent data negotiation modules through a classical communication link, and transmit the basis vector matching, parameter estimation, error correction and privacy amplification parameters and data required for the key distillation operation.

[0137] The key exchange layer is provided with a first key exchange layer interface KEL-1, a second key exchange layer interface KEL-2, a third key exchange layer interface KEL-3, and a fourth key exchange layer interface KEL-4, wherein: the first key exchange layer interface is used to connect the reference point between the switching network element control module and the switching network element management module, and transmit network management information and control signaling exchanged between the transmission modules; the second key exchange layer interface is used to connect the reference point between the routing control module and the routing query module, and transmit key routing information; the third key exchange layer interface is used to connect the reference point between the location service module and the location query module, and transmit location information; the fourth key exchange layer interface is used to connect the reference point of two adjacent key exchange modules, and transmit information and data on key relay, key synchronization, key authentication, and mutual identity authentication of key exchange modules between the transmission modules.

[0138] The first key service layer interface USL-1 and the second key service layer interface USL-2 are set in the key service layer, wherein: the first key service layer interface is used to connect the reference point of the service network element control module and the service network element management module, and transmit the network management information and control signaling exchanged between the modules; the second key service layer interface is used to connect the reference point of the user authentication and authorization module and the user authentication module, and is responsible for the identity authentication and credential update of the user service module.

[0139] In the open key distribution network architecture of the present invention, a three-layer architecture is adopted in which the key production layer, key exchange layer and key service layer are separated, control messages are separated from business messages, and the control plane is separated from the business plane: from a vertical perspective, it is divided into a control plane and a business plane, the control plane does not involve keys, and the business plane does not involve control signaling; from a horizontal perspective, the key generation layer, key exchange layer, and key service layer respectively realize the key production, distribution and output of adjacent nodes, cross-nodes and end-to-end, and the logical segmentation is clearer. Moreover, in terms of interface configuration, vertically, interfaces are set between modules of different levels in the same plane, and horizontally, interfaces of control signaling at different levels are set, which is particularly conducive to upgrade maintenance and compatibility with different manufacturers.

[0140] In addition, due to the separation of key and control information flows, the security design of classic IP bearer networks is easier, and security domain division can be better performed to provide more targeted protection.

[0141] Furthermore, in addition to QKD technology, the key distribution network architecture proposed in the present invention also provides the possibility of compatibility with WCKG and other secure key distribution technologies; at the same time, by optimizing the functional layer design, mobile terminals can also receive keys, greatly expanding the network application scenarios; and, with the help of the design of the user authentication module, user authentication and device authentication are separated, so that users can access the network through different devices to obtain key resources, thereby improving the availability of the key distribution network and enabling it to greatly meet the needs of mobility.

[0142] Although the present invention has been described above through specific embodiments in conjunction with the accompanying drawings, those skilled in the art will readily recognize that the above embodiments are merely exemplary and are used to illustrate the principles of the present invention, and do not limit the scope of the present invention. Those skilled in the art may make various combinations, modifications and equivalent substitutions to the above embodiments without departing from the spirit and scope of the present invention.

Claims

1. An open key distribution network based on a physical system, which is divided into a business plane, a control plane and a user plane, and includes a key production layer, a key exchange layer, a key service layer and a key application layer, wherein: The key production layer is used to generate point-to-point keys; The key exchange layer is used to realize network distribution of keys; The key service layer is used to implement user authentication, authorization and policy management, and supply keys; The key production layer, key exchange layer and key service layer are all divided into the business plane and the control plane, wherein: the business plane is defined as undertaking the key production, key exchange and key service functions, and the control plane is defined as controlling the functional modules in the business plane but not involving the key itself; and The key application layer constitutes the user plane; On the business plane, interfaces are only provided between the key production layer and the key exchange layer, between the key exchange layer and the key service layer, and between the key service layer and the key application layer to realize the transmission of the key; On the control plane, interfaces are only provided between the key production layer and the key exchange layer, between the key exchange layer and the key service layer, and between the key service layer and the key application layer to realize the transmission of request and control information and data; In each of the key production layer, the key exchange layer and the key service layer, an interface is provided between the business plane and the control plane to realize the interaction of data and control information; and Interfaces for data interaction with adjacent nodes are respectively provided on the business planes of the key production layer and the key exchange layer; The business plane of the key production layer is provided with a key production module and a physical layer link module, and the control plane of the key production layer is provided with a production control module, the key production module is used to generate a key according to a key distribution protocol, and the production control module includes a production network element control module and a link network element control module; The business plane of the key exchange layer is provided with a key exchange module, and the control plane of the key exchange layer is provided with an exchange management and control module, and the key exchange module is used to receive and manage the key generated by the key production module and relay it; The business plane of the key service layer is provided with a user service module, and the control plane of the key service layer is provided with a service management and control module. The user service module is used to receive and manage the key from the key exchange module and provide end-to-end key services for the key application layer; The service plane is provided with a first service interface, a second service interface and a third service interface; The first service interface is used to connect the reference point of the key production module and the key exchange module, and the key production module transmits the point-to-point key to the key exchange module; The second service interface is used to connect the reference point of the key exchange module and the user service module, and the key exchange module transmits the key to the user service module; The third service interface is used to connect the reference point of the user service module and the key application layer, and the user service module transmits the key to the key application layer; The control plane is provided with a first control interface, a second control interface and a third control interface; The first control interface is used to connect the reference points of the production control module and the exchange control module, and transmit requests and control information and data for the key production layer, so as to dynamically adjust the production status of the key production module and the connection status of the physical layer link module; The second control interface is used to connect the reference points of the exchange control module and the service control module, and transmit the request and control information and data for the key exchange layer, so as to dynamically adjust the key relay state of the key exchange module; The third control interface is used to connect the service control module and the reference point of the key application layer, and transmit the key service data of the key application layer; The key production layer is provided with a first and a second key production layer interface, wherein: the first key production layer interface is used to connect the reference point of the link network element control module of the control plane and the link switching module of the service plane to transmit network management information and control signaling; the second key production layer interface is used to connect the reference point of the production network element control module of the control plane and the production network element management module of the service plane to transmit network management information and control signaling; The key exchange layer is provided with a first, a second and a third key exchange layer interface, wherein: the first key exchange layer interface is used to connect the reference point of the switching network element control module of the control plane and the switching network element management module of the business plane to transmit network management information and control signaling; the second key exchange layer interface is used to connect the reference point of the routing control module of the control plane and the routing query module of the business plane to transmit key routing information; the third key exchange layer interface is used to connect the reference point of the location service module of the control plane and the location query module of the business plane to transmit location information; The key service layer is provided with a first and a second key service layer interface, wherein: the first key service layer interface is used to connect the reference point of the service network element control module of the control plane and the service network element management module of the business plane to transmit network management information and control signaling; the second key service layer interface is used to connect the reference point of the user authentication and authorization module of the control plane and the user authentication module of the business plane, so as to authenticate the identity and update the credentials of the user service module; The key production layer is provided with a third, fourth and fifth key production layer interfaces, wherein: the third key production layer interface is used to connect the reference points of two adjacent signal preparation detection modules to transmit the physical signal used for the key distribution protocol; the fourth key production layer interface is used to connect the reference points of two adjacent time synchronization modules to provide time synchronization for signal preparation detection; the fifth key production layer interface is used to connect the reference points of two adjacent data negotiation modules to transmit basis vector matching, parameter estimation, error correction and privacy amplification parameters and data used for key distillation operations; The key exchange layer is provided with a fourth key exchange layer interface for connecting the reference points of two adjacent key exchange modules and transmitting information and data related to key relay, key synchronization, key authentication and mutual identity authentication of key exchange modules.

2. The open key distribution network according to claim 1, wherein: In the key production layer, the service plane is defined to implement physical signal reception and transmission, time synchronization, key data negotiation, key output, and link switching functions, and the control plane is defined to implement production control strategy, link switching strategy, and status monitoring functions; In the key exchange layer, the business plane is defined to implement key input, key storage, key relay, key output, and routing addressing functions, and the control plane is defined to implement location services, routing control, and cross-domain settlement functions; In the key service layer, the business plane is defined to implement user registration, key input, key storage, and key output functions, and the control plane is defined to implement user authorization and authentication, policy management, status monitoring, and billing management functions.

3. The open key distribution network according to claim 1, wherein: The key production module includes a signal preparation detection module, a time synchronization module, a data negotiation module, a key output module, a random number module, and a production network element management module; The signal preparation and detection module is used to communicate with the signal preparation and detection modules of adjacent nodes to achieve preparation, transmission and detection of physical signals; The time synchronization module is used to communicate with the signal preparation and detection modules of adjacent nodes to achieve time synchronization; The data negotiation module is used to communicate with the signal preparation and detection modules of the adjacent nodes to achieve parameter evaluation, error correction and privacy amplification of the signal detection data; The key output module is used to output the point-to-point key to the key exchange layer; The random number module is used to generate random numbers and provide them to the signal preparation detection module and the data negotiation module; The production network element management module is used to communicate with the production network element control module to monitor the device status, control the start and stop of the device, set device parameters, and perform authentication and network access for device initialization; The physical layer link module includes a multiplexing module for wavelength division multiplexing of multiple quantum channels and classical channels, and a link switching module for optical path switching or branching of communication channels between multiple pairs of key generation modules; The production network element control module is used to issue production instructions according to the requirements of the switching control module, and obtain and configure the configuration and status information of the production network element management module; The link network element control module is used to issue link switching control instructions according to the requirements of the production network element control module, and obtain and configure the configuration and status information of the link network element management module.

4. The open key distribution network according to claim 1, wherein: The key exchange module includes a key storage module, a key relay module, a key lifecycle management module, a key output module, a location query module, a routing query module, and a switching network element management module. The switching control module includes a location service module, a routing control module, a switching network element control module, and a cross-domain settlement module; The key storage module is used to receive the key from the key production module and store it; The key relay module is used to communicate with other key exchange modules and relay keys using the communication links between the key exchange modules; The key lifecycle management module is used to manage the whole lifecycle of the key of this layer, which includes the process from receiving the key to outputting the key to the user service module; The key output module is used to output the key to the user service module; The location query module is used to communicate with the location service module to obtain and report the key production network address so as to generate a key relay route; The routing query module is used to communicate with the routing control module to generate the key relay route according to the network addresses of the local end and the opposite end; The switching network element management module is used to communicate with the switching network element control module to monitor the device status, control the device start and stop, set device parameters, and perform device initialization authentication and network access; The location service module is used to record the network location information of the user equipment and provide query services; The routing control module is used to provide the key relay route for the key exchange module according to the link status or the key inventory; The switching network element management and control module is used to issue key exchange instructions according to the requirements of the service management and control module, and obtain and configure the configuration and status information of the switching network element management module; The cross-domain settlement module is used for traffic settlement and billing between different subnets.

5. The open key distribution network according to claim 1, wherein: The user service module includes a key storage module, a key lifecycle management module, a key output module, a user authentication module, and a service network element management module; the service control module includes a user authentication and authorization module, a policy management module, and a service network element control module; The key storage module is used to receive the key from the key exchange module and store it; The key lifecycle management module is used to manage the whole lifecycle of the key of this layer, which includes the process from receiving the key to outputting the key to the key application layer; The key output module is used to output the key to the key application layer; The user authentication module is used for user authentication; The service network element management module is used to communicate with the service network element control module to monitor the device status, control the device start and stop, set device parameters, and initialize the device authentication and network access; The user authentication and authorization module is used for user identity authentication, authorization and access control; The policy management module is used to control the network resources obtained by users according to service quality management and billing policies; The service network element management and control module is used to issue key service instructions according to the requirements of the key application layer, obtain and configure the configuration and status information of the service network element management module, and provide status data for the key application layer.

6. The open key distribution network according to claim 1, wherein: The relay of the key adopts a one-time pad scheme.

Images