Key distribution method and system based on quantum communication satellite and DH algorithm

Abstract

This patent discloses a key distribution method and system based on quantum communication satellite and DH algorithm, including quantum communication satellite, satellite ground station and ground network, the satellite ground station generates public and private keys, sends the public key to the quantum communication satellite under the protection of quantum key through quantum communication satellite, the quantum communication satellite generates communication key and sends it to another satellite ground station under the protection of another quantum key; the satellite ground station generates relay key using communication key; the satellite ground station generates auxiliary key using communication key, and the quantum communication satellite generates corresponding auxiliary key using public key; the satellite ground station uses auxiliary key to encrypt the relay key and send it to another satellite ground station through quantum communication satellite; the satellite ground station uses relay key to realize quantum key distribution for ground network users. This patent greatly improves the efficiency of relay key generation of satellite quantum communication, and can better meet the requirements of ground networks in two different regions for quantum secure communication.

Description

Technical Field

[0001] The present invention relates to the field of quantum key distribution, and in particular to a key distribution method and system based on a quantum communication satellite and a DH algorithm. Background Art

[0002] Quantum key distribution (QKD) uses the properties of quantum mechanics to generate and distribute keys, which can be used in various encryption algorithms to encrypt information and achieve communication between nodes in the quantum key distribution network. Due to the loss of communication optical fiber and the noise of detectors, quantum key distribution systems can usually only achieve a high coding rate within 100 kilometers. Long-distance quantum key distribution has always been a research pain point and hotspot in the field of quantum communication.

[0003] In the prior art, the use of trusted relays is a practical solution to long-distance quantum key distribution. Assuming that it is necessary to distribute quantum keys between communication nodes A and B that are far apart, a relay node 1 can be set between communication nodes A and B to form a serial link; each adjacent node performs quantum key distribution on each other and obtains relay keys, which are recorded as K A1 and K B1 , the session key K is between node A and K A1 XOR operation to get Then it is transmitted through the network to reach relay node 1. At relay node 1, the key K is first used A1 Decrypt the session key K, and then compare the session key K with the key K B1 XOR operation is performed to obtain It is then transmitted through the network to node B, where node B deciphers the session key K, ultimately enabling the sharing of the session key K between communication nodes A and B.

[0004] Since the completion of the quantum satellite "Mozi" and the quantum secure communication "Beijing-Shanghai Trunk Line", a series of wide-area quantum key distribution demonstration projects have been carried out based on the ground-to-space links between the two.

[0005] The prior art has the following defects:

[0006] The QKD key relay code rate of satellite quantum communication is low and cannot meet the requirements of quantum secure communication between ground networks in two different regions.

[0007] Suppose satellite ground stations A and B serve as relay nodes between ground network users. A and B use relay keys to implement quantum key distribution for ground network users via satellite. If A sends m relay keys to B via satellite, and B sends n relay keys to A via satellite, a total of 2(m+n) pairs of QKD keys are used to generate (m+n) pairs of relay keys. The efficiency ratio can be expressed as Summary of the invention

[0008] Purpose of the invention: To overcome the above-mentioned defects, the present invention proposes a key distribution method and system based on quantum communication satellite and DH algorithm. Summary of the invention:

[0010] A key distribution method based on a quantum communication satellite and a DH algorithm includes a quantum communication satellite, several satellite ground stations and several ground networks, and includes the following steps:

[0011] S1. The satellite ground station generates N pairs of public and private keys, where N is greater than or equal to 1, and sends the public key to the quantum communication satellite through the quantum communication satellite under the protection of the quantum key between the quantum communication satellite and the satellite ground station. The quantum communication satellite generates a communication key and sends it to another satellite ground station under the protection of the quantum key between the quantum communication satellite and another satellite ground station;

[0012] S2, two satellite ground stations respectively use the public key and the communication key to generate the first relay key;

[0013] S3. The satellite ground station generates an auxiliary key using the private key and the communication key, and the quantum communication satellite generates the corresponding auxiliary key using the public key;

[0014] S4, the satellite ground station generates a second relay key, encrypts the second relay key with an auxiliary key and sends it to the quantum communication satellite, which decrypts the second relay key and encrypts it with another auxiliary key and sends it to another satellite ground station;

[0015] S5. Satellite ground stations use relay keys to implement quantum key distribution for ground network users.

[0016] Preferably, the step in S1 where the satellite ground station generates N pairs of public and private keys may be that the satellite ground station generates a true random number, uses the true random number as a private key, and uses the private key to generate a public key based on a cryptographic algorithm.

[0017] Optionally, the step of generating a communication key by the quantum communication satellite in S1 is to generate a first communication key based on a cryptographic algorithm using a public key.

[0018] Optionally, step S2 includes the satellite ground station generating a first relay key based on a cryptographic algorithm using a communication key and a public key; and step S3 includes the satellite ground station generating an auxiliary key based on a cryptographic algorithm using a communication key and a private key.

[0019] Preferably, the two satellite ground stations communicate via a quantum communication satellite, and step S1 specifically includes the first satellite ground station generating m pairs of first public keys and first private keys, wherein m is greater than or equal to 1, and sending the first public key to the quantum communication satellite under the protection of the quantum key between the quantum communication satellite and the first satellite ground station, the quantum communication satellite generating a first communication key and sending it to the second satellite ground station under the protection of the quantum key between the quantum communication satellite and the second satellite ground station, and the second satellite ground station receiving the first communication key from the quantum communication satellite; the second satellite ground station generating n pairs of second public keys and second private keys, wherein n is greater than or equal to 1, and sending the second public key to the quantum communication satellite under the protection of the quantum key between the quantum communication satellite and the second satellite ground station, the quantum communication satellite generating a second communication key and sending it to the first satellite ground station under the protection of the quantum key between the quantum communication satellite and the first satellite ground station, and the first satellite ground station receiving the second communication key from the quantum communication satellite;

[0020] The step S2 specifically includes the first satellite ground station generating a relay key using the second communication key and the first public key; the second satellite ground station generating a relay key using the first communication key and the second public key; repeating step S2 until m*n pairs of first relay keys are generated;

[0021] The step S3 includes the first satellite ground station generating a first auxiliary key using the second communication key and the first private key, and the quantum communication satellite generating the first auxiliary key using the first public key and the second public key; the second satellite ground station generating a second auxiliary key using the first communication key and the second private key, and the quantum communication satellite generating a second auxiliary key using the second public key and the first public key;

[0022] The step S4 includes the first satellite ground station generating a second relay key, encrypting the second relay key with the first auxiliary key and sending it to the quantum communication satellite, the quantum communication satellite decrypting with the first auxiliary key and then encrypting with the second auxiliary key and sending it to the second satellite ground station, the second satellite ground station decrypting with the second auxiliary key and obtaining the second relay key. Repeat steps S3-S4 until m*n pairs of second relay keys are generated;

[0023] Optionally, the cryptographic algorithm is a Diffie-Hellman key agreement algorithm.

[0024] Optionally, the cryptographic algorithm is an ECDH key agreement algorithm.

[0025] A key distribution system based on quantum communication satellite and DH algorithm includes a quantum communication satellite, several satellite ground stations and several ground networks, which are used to implement the steps of the above method.

[0026] Beneficial effects:

[0027] It has greatly improved the efficiency of generating relay keys for satellite quantum communications and can better meet the requirements of ground networks in two different regions for quantum secure communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 is a system structure diagram of an embodiment of the present invention;

[0029] Figure 2 Schematic diagram of step 1 of an embodiment of the present invention; DETAILED DESCRIPTION

[0030] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments. However, it should be understood that the present invention can be implemented in various forms, and some exemplary and non-limiting embodiments shown in the accompanying drawings and described below are not intended to limit the present invention to the specific embodiments described.

[0031] The present invention proposes a key distribution method based on quantum communication satellite and DH algorithm. The system structure is as follows: Figure 1 As shown, it includes quantum communication satellite, satellite ground station and ground network.

[0032] According to the Diffie-Hellman algorithm, a large prime number p and a number g are defined. g is the primitive root of the modulus p. Both g and p are parameters of the Diffie-Hellman algorithm. When issuing an asymmetric key pair, a random number a is generated first, and a is used as the private key to generate a public key a1=g a mod p.

[0033] Step 1:

[0034] Satellite ground station A forms m pairs of private and public keys, and sends the public key to satellite ground station B through quantum communication satellite R under the protection of QKD key, using 2m pairs of QKD keys; the detailed steps are as follows Figure 2 As shown, the text description is as follows:

[0035] A selects private key a and its public key a1=g from among m pairs of public and private keys. a mod p, a1 is sent to quantum communication satellite R under the protection of the QKD key between A and quantum communication satellite R, and quantum communication satellite R generates a2 = g a1 mod p and send a2 to B under the protection of the QKD key between R and the satellite ground station B. The whole process consumes 2 pairs of QKD keys. The process of transmitting m public keys consumes 2m pairs of QKD keys.

[0036] B selects private key b and its public key b1=g ​​from n pairs of public and private keys. bmod p, b1 is sent to quantum communication satellite R under the protection of the QKD key between B and quantum communication satellite R, and quantum communication satellite R generates b2 = g b1 mod p and send b2 to A under the protection of the QKD key between R and the satellite ground station A. The whole process consumes 2 pairs of QKD keys. The process of transmitting n public keys consumes 2n pairs of QKD keys.

[0037] A total of 2(m+n) pairs of QKD keys are used in this step.

[0038] Step 2:

[0039] Step 2.1: First round of key distribution

[0040] Take the DH algorithm as an example.

[0041] Take the case where A chooses private key a and B chooses private key b as an example, that is, A receives b2 and B receives a2.

[0042] After A receives b2, it calculates the relay key K A-B =b2 a1 mod p, after B receives a2, calculates the relay key K B-A =a2 b1 mod p. Since K A-B =b2 a1 mod p=(g b1 mod p) a1 mod p = g a1*b1 mod p=(g a1 mod p) b1 mod p=a2 b1 mod p=K B-A , that is, K A-B =K B-A .

[0043] A's key pool has m private keys, corresponding to m public keys sent to B; B's key pool has n private keys, corresponding to n public keys sent to A. Therefore, there are a total of m*n pairs of relay keys generated in this step.

[0044] Step 2.2: Generate a secondary key

[0045] A secondary key is a key that can replace a pair of QKD keys.

[0046] A generates auxiliary key K A-R =b2 a mod p, R generates auxiliary key K R-A =a1 b1 mod p. From the above, we can see that K A-R =b2a mod p=(g b1 mod p) a mod p = g a*b1 mod p=(g a mod p) b1 mod p=a1 b1 mod p=K R-A , that is, K A-R =K R-A .

[0047] B generates auxiliary key K B-R =a2 b mod p; R generates auxiliary key K R-B =b1 a1 mod p. From the above, we can see that K B-R =a2 b mod p=(g a1 mod p) b mod p = g a1*b mod p=(g b mod p) a1 mod p=b1 a1 mod p=K R-B , that is, K B-R =K R-B .

[0048] Step 2.3: Second round of key distribution

[0049] A generates relay key K1 and uses K A-R Send confidentially to R, R uses K R-A After decryption, use K B-R Send it confidentially to B, who uses K R-B After decryption, the relay key K1 is obtained.

[0050] A's key pool has m private keys, corresponding to m*n auxiliary keys K A-R ; B's key pool has n private keys, corresponding to m*n auxiliary keys K B-R To ensure security, this embodiment limits the auxiliary key used as the symmetric encryption key to be used only once, so the relay key generated in this step has a total of m*n pairs.

[0051] Step 3:

[0052] A and B use the relay key pair to relay keys for ground network users.

[0053] In summary, the entire process consumes 2(m+n) pairs of QKD keys and generates 2m*n pairs of relay keys. The efficiency ratio can be expressed as

[0054] According to the efficiency ratio If m=n=10000 transmitted per day, then RT=5000; if m=n=30*10000 transmitted per month, RT=150000. This scheme greatly improves the efficiency of relay key generation and can better meet the requirements of quantum secure communication of ground networks in two different regions.

[0055] If the ECDH algorithm is used, then in step 1, A selects private key a and its public key (a1, a1y) = a*P, where P is the base point generator of the elliptic curve, and B selects private key b and its public key (b1, b1y) = b*P. Using the QKD key, A and B obtain b2||b2y and a2||a2y respectively through R. In step 2.1, A calculates K A-B =a1*(b2,b2y), B calculates K B-A =b1*(a2,a2y), we can get K A-B =a1*(b2,b2y)=a1*b1*P=b1*a1*P=b1*(a2,a2y)=K B-A , that is, K A-B =K B-A In step 2.2, A and R generate auxiliary keys K respectively. A-R =a*(b2,b2y),K R-A =b1*(a1,a1y), from the above we can get K A-R =K R-A ; B and R generate auxiliary keys K respectively B-R =b*(a2,a2y),K R-B =a1*(b1,b1y), from the above we can get K B-R =K R-B Steps 2.3 and 3 remain unchanged. A total of 2(m+n) pairs of QKD keys are consumed, and 2m*n pairs of relay keys are generated. Efficiency ratio

[0056] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0057] The above-mentioned embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A key distribution method based on quantum communication satellite and DH algorithm, characterized in that: It includes a quantum communication satellite, several satellite ground stations and several ground networks, and includes the following steps: S1. The satellite ground station generates N pairs of public and private keys, where N is greater than or equal to 1, and sends the public key to the quantum communication satellite through the quantum communication satellite under the protection of the quantum key between the quantum communication satellite and the satellite ground station. The quantum communication satellite generates a communication key and sends it to another satellite ground station under the protection of the quantum key between the quantum communication satellite and another satellite ground station; The first satellite ground station generates m pairs of first public keys and first private keys, where m is greater than or equal to 1, and sends the first public key to the quantum communication satellite under the protection of the quantum key between the quantum communication satellite and the first satellite ground station. The quantum communication satellite generates a first communication key and sends it to the second satellite ground station under the protection of the quantum key between the quantum communication satellite and the second satellite ground station. The second satellite ground station receives the first communication key from the quantum communication satellite. The second satellite ground station generates n pairs of second public keys and second private keys, where n is greater than or equal to 1, and sends the second public key to the quantum communication satellite under the protection of the quantum key between the quantum communication satellite and the second satellite ground station. The quantum communication satellite generates a second communication key and sends it to the first satellite ground station under the protection of the quantum key between the quantum communication satellite and the first satellite ground station. The first satellite ground station receives the second communication key from the quantum communication satellite. S2, two satellite ground stations respectively use the public key and the communication key to generate the first relay key; The first satellite ground station generates a first relay key using the second communication key and the first public key; the second satellite ground station generates a first relay key using the first communication key and the second public key; repeating step S2 until m*n pairs of first relay keys are generated; S3. The satellite ground station generates an auxiliary key using the private key and the communication key, and the quantum communication satellite generates the corresponding auxiliary key using the public key; The first satellite ground station generates a first auxiliary key using the second communication key and the first private key, and the quantum communication satellite generates the first auxiliary key using the first public key and the second public key; The second satellite ground station generates a second auxiliary key using the first communication key and the second private key, and the quantum communication satellite generates a second auxiliary key using the second public key and the first public key; S4, the satellite ground station generates a second relay key, encrypts the second relay key with an auxiliary key and sends it to the quantum communication satellite, which decrypts the second relay key and encrypts it with another auxiliary key and sends it to another satellite ground station; The first satellite ground station generates a second relay key, encrypts the second relay key with the first auxiliary key and sends it to the quantum communication satellite. The quantum communication satellite decrypts the second relay key with the first auxiliary key and then encrypts the second relay key with the second auxiliary key and sends it to the second satellite ground station. The second satellite ground station decrypts the second relay key with the second auxiliary key and then obtains the second relay key. Steps S3-S4 are repeated until m*n pairs of second relay keys are generated. S5. Satellite ground stations use relay keys to implement quantum key distribution for ground network users.

2. The key distribution method based on quantum communication satellite and DH algorithm according to claim 1 is characterized in that: The step of generating N pairs of public and private keys by the satellite ground station in S1 includes: The satellite ground station generates a true random number, uses the true random number as a private key, and uses the private key to generate a public key based on a cryptographic algorithm.

3. The key distribution method based on quantum communication satellite and DH algorithm according to claim 2 is characterized in that: The step of generating a communication key by the quantum communication satellite in S1 is to generate a first communication key based on a cryptographic algorithm using a public key.

4. The key distribution method based on quantum communication satellite and DH algorithm according to claim 3 is characterized in that: The step S2 includes the satellite ground station generating a first relay key based on a cryptographic algorithm using a communication key and a public key; and the step S3 includes the satellite ground station generating an auxiliary key based on a cryptographic algorithm using a communication key and a private key.

5. The key distribution method based on quantum communication satellite and DH algorithm according to claim 4 is characterized in that: The cryptographic algorithm is the Diffie-Hellman key agreement algorithm.

6. The key distribution method based on quantum communication satellite and DH algorithm according to claim 4 is characterized in that: The cryptographic algorithm is the ECDH key agreement algorithm.

7. A key distribution system based on quantum communication satellite and DH algorithm, characterized in that: It comprises a quantum communication satellite, several satellite ground stations and several ground networks, and is used to implement the steps of the method described in any one of claims 1-6.

Images