Quantum key negotiation method, device, computer equipment and readable medium

Abstract

The present disclosure provides a quantum key negotiation method, including: receiving a quantum key request sent by a first QSC, obtaining a virtual identifier of a second QSC carried in the quantum key request; performing a route query according to the virtual identifier of the second QSC, and determining a next-hop device; obtaining a physical identifier of the second QSC through the next-hop device, and the physical identifier of the second QSC is obtained by the next-hop device according to the virtual identifier of the second QSC; sending a quantum key response carrying the physical identifier of the second QSC to the first QSC, so that a first QKD terminal of the first QSC and a second QKD terminal of the second QSC perform quantum key negotiation according to the physical identifier of the second QSC. The embodiment of the present disclosure builds a network including at least a QSC and a QSM outside the QKD network, dynamically obtains a physical identifier using the virtual identifier of the QSC, and simplifies the management of quantum key negotiation.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a quantum key negotiation method, apparatus, computer equipment, and readable medium. Background Art

[0002] Quantum Key Distribution (QKD) uses the properties of quantum mechanics to ensure communication security. It enables both parties in communication to generate and share a random, secure key to encrypt and decrypt messages. Under the encouragement of relevant national industrial policies and against the backdrop of the rapid development of cyberspace security technology, the development of the quantum communication industry, with QKD network deployment and integrated application system construction as the main body, will enter a period of rapid development. At present, QKD has made great improvements in communication distance, speed, integration, networking capabilities, etc., and has reached a practical technical level. With the expansion of the scale of QKD network deployment and the growth of user demand for high-security cryptographic products, user demand for application service access to QKD networks will continue to expand.

[0003] The related technology provides the device addressing function between quantum key management service nodes, realizes the key management control plane by establishing a secure channel for key management, and completes the routing addressing function by device addressing between various quantum key service nodes. The QKD network requires point-to-point key negotiation between two points, but the related technology mainly belongs to the management within the QKD network, which is to perform quantum key negotiation based on the physical identification of the quantum key management service node within the QKD network. Therefore, it needs to be configured in advance at the application layer, which is complex to manage and cannot be applied on a large scale. Summary of the invention

[0004] The present invention provides a quantum key negotiation method, apparatus, computer device and readable medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a quantum key negotiation method, which is applied to a first QSM and includes:

[0006] Receiving a quantum key request sent by a first quantum security service client QSC, and obtaining a virtual identifier of a second quantum security service client QSC carried in the quantum key request;

[0007] Perform a route query according to the virtual identifier of the second QSC to determine a next-hop device;

[0008] Acquire the physical identifier of the second QSC through the next-hop device, where the physical identifier of the second QSC is acquired by the next-hop device according to the virtual identifier of the second QSC;

[0009] A quantum key response carrying the physical identification of the second QSC is sent to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC perform quantum key negotiation based on the physical identification of the second QSC.

[0010] In another aspect, the present disclosure also provides a quantum key negotiation method, which is applied to a first QSP and includes:

[0011] Receiving a quantum key request sent by a first quantum security service management and control center QSM, and obtaining a virtual identifier of a second quantum security service client QSC carried in the quantum key request, wherein the quantum key request is sent by the first QSC to the first QSM;

[0012] Acquiring a physical identifier of the second QSC according to the virtual identifier of the second QSC;

[0013] A quantum key response carrying the physical identification of the second QSC is sent to the first QSM, so that the first QSM sends the quantum key response to the first QSC, and the quantum key response is used to instruct the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC to perform quantum key negotiation based on the physical identification of the second QSC.

[0014] In another aspect, the present disclosure also provides a quantum key negotiation method, which is applied to a first QSC and includes:

[0015] Sending a quantum key request to the first quantum security service control center QSM to which the first QSC belongs, wherein the quantum key request carries the virtual identifier of the second QSC, so that the first QSM can determine the next-hop device through routing query according to the virtual identifier of the second QSC, and obtain the physical identifier of the second QSC through the next-hop device;

[0016] receiving a quantum key response sent by the first QSM, and acquiring a physical identifier of the second QSC carried in the quantum key response, wherein the quantum key response is sent by the next-hop device to the first QSM;

[0017] The physical identification of the second QSC is sent to the first quantum key distribution QKD terminal, so that the first QKD terminal can perform quantum key negotiation with the second QKD terminal of the second QSC according to the physical identification of the second QSC.

[0018] In another aspect, the disclosed embodiment further provides a quantum security service control center, including:

[0019] A first receiving module is configured to receive a quantum key request sent by a first quantum security service client QSC, and obtain a virtual identifier of a second quantum security service client QSC carried in the quantum key request, where the virtual identifier is a virtual identifier;

[0020] A first routing addressing module, configured to perform routing query according to the virtual identifier of the second QSC to determine a next hop device;

[0021] A first physical identification acquisition module, configured to acquire the physical identification of the second QSC through the next-hop device, wherein the physical identification of the second QSC is acquired by the next-hop device according to the virtual identification of the second QSC;

[0022] The first sending module is used to send a quantum key response carrying the physical identification of the second QSC to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC can perform quantum key negotiation based on the physical identification of the second QSC.

[0023] On the other hand, the embodiment of the present disclosure further provides a quantum security service agent device, including:

[0024] A second receiving module is configured to receive a quantum key request sent by a first quantum security service control center QSM, and obtain a virtual identifier of a second quantum security service client QSC carried in the quantum key request, wherein the quantum key request is sent by the first QSC to the first QSM;

[0025] A second physical identification acquisition module, configured to acquire the physical identification of the second QSC according to the virtual identification of the second QSC;

[0026] The second sending module is used to send a quantum key response carrying the physical identification of the second QSC to the first QSM, so that the first QSM sends the quantum key response to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC perform quantum key negotiation according to the physical identification of the second QSC.

[0027] In another aspect, the disclosed embodiment further provides a quantum security service client, including:

[0028] A third sending module is used to send a quantum key request to a first quantum security service control center QSM to which the first QSC belongs, wherein the quantum key request carries a virtual identifier of the second QSC, so that the first QSM determines a next-hop device through a routing query according to the virtual identifier of the second QSC, and obtains a physical identifier of the second QSC through the next-hop device;

[0029] a third receiving module, configured to receive a quantum key response sent by the first QSM, and obtain a physical identifier of the second QSC carried in the quantum key response, wherein the quantum key response is sent by the next-hop device to the first QSM;

[0030] The third sending module is also used to send the physical identification of the second QSC to the first quantum key distribution QKD terminal, so that the first QKD terminal can perform quantum key negotiation with the second QKD terminal of the second QSC according to the physical identification of the second QSC.

[0031] On the other hand, an embodiment of the present disclosure also provides a computer device, including: one or more processors; a storage device on which one or more programs are stored; when the one or more programs are executed by the one or more processors, the one or more processors implement the quantum key agreement method as described above.

[0032] On the other hand, an embodiment of the present disclosure further provides a computer-readable medium having a computer program stored thereon, wherein the program, when executed, implements the quantum key agreement method as described above.

[0033] The quantum key negotiation method provided by the embodiment of the present disclosure is applied to a first QSM, including: receiving a quantum key request sent by a first QSC, and obtaining a virtual identifier of a second QSC carried in the quantum key request; performing a routing query according to the virtual identifier of the second QSC to determine a next-hop device; obtaining a physical identifier of the second QSC through the next-hop device, and the physical identifier of the second QSC is obtained by the next-hop device according to the virtual identifier of the second QSC; and sending a quantum key response carrying the physical identifier of the second QSC to the first QSC, so that a first QKD terminal of the first QSC and a second QKD terminal of the second QSC perform quantum key negotiation according to the physical identifier of the second QSC. The disclosed embodiment builds a network including at least QSC and QSM outside the QKD network. The initiator QSC only knows the virtual identifier of the peer QSC, performs addressing based on the virtual identifier in the network, and obtains the physical identifier of the peer QSC, so that the initiator QSC and the peer QSC can perform quantum key negotiation based on the physical identifier of the peer QSC. There is no need to configure the physical identifier of QSC in advance on the application. The physical identifier is dynamically obtained by using the virtual identifier of QSC, which simplifies the management of quantum key negotiation and can be applied in large-scale QKD networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of the system architecture of the quantum key service network according to an embodiment of the present disclosure;

[0035] Figure 2A schematic diagram of a quantum key negotiation process with a first QSM as the execution subject provided in an embodiment of the present disclosure;

[0036] Figure 3 A schematic diagram of a quantum key negotiation process with a first QSP as the execution subject provided in an embodiment of the present disclosure;

[0037] Figure 4 A schematic diagram of a system architecture including two QSPs provided for an embodiment of the present disclosure;

[0038] Figure 5 A schematic diagram of a quantum key negotiation process with a first QSC as the execution subject provided in an embodiment of the present disclosure;

[0039] Figure 6 A schematic diagram of a quantum key negotiation process provided for a specific example of the present disclosure;

[0040] Figure 7 Schematic diagram of the structure of the quantum security service management center (QSM) provided in the embodiment of the present disclosure Figure 1 ;

[0041] Figure 8 A schematic diagram of the structure of a quantum security service proxy device (QSP) provided in an embodiment of the present disclosure Figure 1 ;

[0042] Fig. 9 A schematic diagram of the structure of a quantum security service proxy device (QSP) provided in an embodiment of the present disclosure Figure 2 ;

[0043] Fig.10 A schematic diagram of the structure of a quantum security service client (QSC) provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0044] Example embodiments will be described more fully below with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete and to enable those skilled in the art to fully understand the scope of the present disclosure.

[0045] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0046] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded.

[0047] The embodiments described herein may be described with reference to plan views and / or cross-sectional views by means of idealized schematic diagrams of the present disclosure. Therefore, the example illustrations may be modified according to manufacturing techniques and / or tolerances. Therefore, the embodiments are not limited to the embodiments shown in the accompanying drawings, but include modifications of the configurations formed based on the manufacturing process. Therefore, the regions illustrated in the accompanying drawings have schematic properties, and the shapes of the regions shown in the figures illustrate the specific shapes of the regions of the elements, but are not intended to be limiting.

[0048] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0049] In order to avoid threats to the QKD network from unsafe applications and classical networks, the topology of the QKD network should not be exposed to QSC (Quantum-safe Service Client) applications. The QKD network requires point-to-point quantum key negotiation, and ultimately the two ends of the application cannot directly correspond to the physical information of the quantum device (such as the physical address) for quantum key distribution negotiation. If the physical information of the quantum device changes, the application needs to change the configuration and re-adapt, making the quantum key negotiation process complicated and difficult to apply to large-scale QKD networks.

[0050] In order to solve the above problems, an embodiment of the present disclosure provides a quantum key negotiation method. Figure 1 Schematic diagram of the quantum key service network system architecture of the embodiment of the present disclosure. Figure 1As shown, the system includes a quantum-safe service management center (Quantum-safe Service Manager, QSM), a quantum-safe service client (Quantum-safe Service Client, QSC) and a quantum-safe service proxy (Quantum-safe Service Proxy, QSP). QSM performs access control and related routing management on QSC. QSM is also connected to QSP to perform cross-city or cross-vendor routing management, which can achieve nationwide interconnection and form a unified quantum security service wide area network. QSC is connected to the QKD terminal. A QSC only connects to one QKD terminal to obtain quantum keys. At the same time, it provides quantum-based security reinforcement services to the user's application system, which may include key services and encryption and decryption services. QSC is also connected to QSM and managed and controlled by the corresponding QSM. QSP mainly realizes cross-QSM routing management and can serve as a security edge protection agent between different manufacturers or QKD network operators.

[0051] During the initialization phase, the following configurations can be performed on QSM, QSC, and QSP:

[0052] (1) QSM, QSC, and QSP configure the information of their respective devices, including virtual ID and IP address.

[0053] (2) The QSC managed by the QSM configuration includes the virtual ID and IP address of the QSC, and the quantum device-related docking information corresponding to the QSC (i.e., the physical ID of the peer QSC).

[0054] (3) The QSM configures the directly connected QSM and QSP, including the virtual identifiers and IP addresses of the QSM and QSP at the same level.

[0055] (4) Configure the first routing table of the QSM, perform routing configuration according to the virtual identifier of the QSC, point the QSC managed by this QSM to the local, and point all other QSMs and the virtual identifiers of the corresponding QSCs to the QSM or QSP directly connected to this QSM.

[0056] (5) The QSP configures the directly connected QSP and QSM, including the virtual identifiers and IP addresses of the same-level QSP and subordinate QSM.

[0057] (6) Configure the second routing table of the QSP, perform routing configuration according to the virtual identifier of the QSC, and point the virtual identifier of the QSC to the corresponding QSM or other QSP directly connected to the QSP. The routing can be configured as the main route and the backup route.

[0058] It should be noted that, during the initialization phase, the mapping relationship between the virtual identifier and the physical identifier of the QSC governed by the QSM must also be configured in the QSM.

[0059] like Figure 2 As shown, the quantum key agreement method is applied to the first QSM, comprising the following steps:

[0060] Step 11: receive a quantum key request sent by the first QSC, and obtain the virtual identifier of the second QSC carried in the quantum key request.

[0061] In the disclosed embodiment, the first QSC is represented by QSC-S, which is the initiator of the quantum key request, and the second QSC is represented by QSC-R, which is the receiver of the quantum key request. The virtual identifier is an identifier used by the QSC application layer.

[0062] Step 12: Perform a route query according to the virtual identifier of the second QSC to determine the next hop device.

[0063] The next hop device of the first QSM may be a QSP or a QSM directly connected to the first QSM.

[0064] Step 13: Acquire the physical identifier of the second QSC through the next-hop device. The physical identifier of the second QSC is acquired by the next-hop device according to the virtual identifier of the second QSC.

[0065] The physical identifier is the identifier used in the QKD network. It should be noted that each QSC has a virtual identifier and a physical identifier.

[0066] Step 14, sending a quantum key response carrying the physical identification of the second QSC to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC can perform quantum key negotiation based on the physical identification of the second QSC.

[0067] The first QKD terminal is a QKD terminal directly connected to the first QSC, and the second QKD terminal is a QKD terminal directly connected to the second QSC. In the QKD network, the QKD terminals of the two QSCs use their respective physical identifiers to negotiate keys.

[0068] The quantum key negotiation method provided by the embodiment of the present disclosure is applied to a first QSM, including: receiving a quantum key request sent by a first QSC, and obtaining a virtual identifier of a second QSC carried in the quantum key request; performing a routing query according to the virtual identifier of the second QSC to determine a next-hop device; obtaining a physical identifier of the second QSC through the next-hop device, and the physical identifier of the second QSC is obtained by the next-hop device according to the virtual identifier of the second QSC; and sending a quantum key response carrying the physical identifier of the second QSC to the first QSC, so that a first QKD terminal of the first QSC and a second QKD terminal of the second QSC perform quantum key negotiation according to the physical identifier of the second QSC. The disclosed embodiment builds a network including at least QSC and QSM outside the QKD network. The initiator QSC only knows the virtual identifier of the peer QSC, performs addressing based on the virtual identifier in the network, and obtains the physical identifier of the peer QSC, so that the initiator QSC and the peer QSC can perform quantum key negotiation based on the physical identifier of the peer QSC. There is no need to configure the physical identifier of QSC in advance on the application. The physical identifier is dynamically obtained by using the virtual identifier of QSC, which simplifies the management of quantum key negotiation and can be applied in large-scale QKD networks.

[0069] In some embodiments, the obtaining of the physical identification of the second QSC through the next-hop device (i.e., step 13) includes the following steps: when the next-hop device is the first QSM, obtaining the physical identification of the second QSC based on the virtual identification of the second QSC and a first mapping relationship configured on the first QSM, the first mapping relationship being a mapping relationship between the virtual identification and the physical identification of each QSC under the jurisdiction of the first QSM.

[0070] like Figure 1 As shown, assuming that the first QSC is QSC (A1-1), the second QSC is QSC (A1-2), and the first QSM is QSM (A1), QSM (A1) performs routing query according to the virtual identifier of QSC (A1-2) and determines that the next-hop device is itself, that is, QSC (A1-1) and QSC (A1-2) are both governed by QSM (A1), then QSM (A1) can directly determine the physical identifier of QSC (A1-2) corresponding to the virtual identifier of QSC (A1-2) according to the mapping relationship stored locally.

[0071] In some embodiments, obtaining the physical identification of the second QSC through the next-hop device (i.e., step 13) includes the following steps:

[0072] When the next-hop device is the second QSM to which the second QSC belongs and the second QSM is directly connected to the first QSM, a quantum key request is sent to the second QSM so that the second QSM obtains the physical identifier of the second QSC based on the virtual identifier of the second QSC and a second mapping relationship configured on the second QSM, where the second mapping relationship is a mapping relationship between the virtual identifier and the physical identifier of each QSC under the jurisdiction of the second QSM; and a quantum key response carrying the physical identifier of the second QSC sent by the second QSM is received.

[0073] like Figure 1 As shown, assuming that the first QSC is QSC(A1-1), the second QSC is QSC(A2-2), the first QSM is QSM(A1), and the second QSM is QSM(A2), QSM(A1) performs routing query according to the virtual identifier of QSC(A2-2), determines that the next hop device is QSM(A2), and QSM(A2) is directly connected to QSM(A1), then QSM(A1) sends a quantum key request to QSM(A2), and QSM(A2) obtains the physical identifier of QSC(A2-2).

[0074] In some embodiments, obtaining the physical identification of the second QSC through the next-hop device (i.e., step 13) includes the following steps: when the next-hop device is the first QSP to which the first QSM belongs, and the second QSP to which the second QSC belongs is the same as the first QSP, and the first QSM and the second QSM to which the second QSC belongs are not directly connected, sending a quantum key request to the first QSP, so that the first QSP can determine the second QSM according to the virtual identification of the second QSC, and instructing the second QSM to obtain the physical identification of the second QSC according to the virtual identification of the second QSC; receiving a quantum key response sent by the first QSP and carrying the physical identification of the second QSC, and the quantum key response is sent by the second QSM to the first QSP.

[0075] like Figure 1As shown, it is assumed that the first QSC is QSC(A1-1), the second QSC is QSC(B1-2), the first QSM to which QSC(A1-1) belongs is QSM(A1), the second QSM to which QSC(B1-2) belongs is QSM(B1), the QSP to which QSC(A1-1) belongs is QSP(A), and the QSP to which QSC(B1-2) belongs is QSP(A). QSM(A1) performs routing query according to the virtual identifier of QSC(B1-2) and determines that the next hop device is QSP(A). The QSP(A) to which QSC(B1-2) belongs is the same as the QSP(A) to which QSC(A1-1) belongs, and QSM(A1) and QSM(B1) are not directly connected. In this case, QSM(A1) sends a quantum key request to QSP(A), and QSP(A) determines QSM(B1) according to the virtual identifier of QSC(B1-2), and QSM(B1) obtains the physical identifier of QSC(B1-2).

[0076] In some embodiments, obtaining the physical identification of the second QSC through the next-hop device (i.e., step 13) includes the following steps: when the next-hop device is the first QSP to which the first QSM belongs, and the second QSP to which the second QSC belongs is different from the first QSP, sending a quantum key request to the second QSP through the first QSP, so that the second QSP can determine the second QSM to which the second QSC belongs according to the virtual identification of the second QSC, and instruct the second QSM to obtain the physical identification of the second QSC according to the virtual identification of the second QSC; receiving a quantum key response carrying the physical identification of the second QSC sent by the first QSP, and the quantum key response is sent by the second QSM to the first QSP through the second QSP.

[0077] like Figure 1 As shown, it is assumed that the first QSC is QSC(A1-1), the second QSC is QSC(B2-2), the first QSM to which QSC(A1-1) belongs is QSM(A1), the second QSM to which QSC(B1-2) belongs is QSM(B2), the QSP to which QSC(A1-1) belongs is QSP(A), and the QSP to which QSC(B2-2) belongs is QSP(B). QSM (A1) performs routing query according to the virtual identifier of QSC (B2-2) and determines that the next hop device is QSP (A). QSP (B) to which QSC (B2-2) belongs is different from QSP (A) to which QSC (A1-1) belongs. In this case, QSM (A1) sends a quantum key request to QSP (A), and QSP (A) forwards the quantum key request to QSP (B). QSP (B) determines QSM (B2) according to the virtual identifier of QSC (B2-2), and QSM (B2) obtains the physical identifier of QSC (B2-2).

[0078] In some embodiments, the first QSM is configured with a first routing table, and the first routing table records the next-hop devices corresponding to the virtual identifiers of all QSCs in the entire network. Accordingly, performing routing query according to the virtual identifier of the second QSC to determine the next-hop device (i.e., step 12) includes the following steps: querying the pre-configured first routing table locally to determine the next-hop device corresponding to the virtual identifier of the second QSC.

[0079] In some embodiments, the virtual identifier is an identifier generated by the FQDN (Fully Qualified Domain Name) naming rule. It should be noted that the embodiment of the present disclosure is described by taking FQDN as an example, and the generation method of the virtual identifier includes but is not limited to the FQDN naming rule.

[0080] against Figure 1 The system architecture shown uses the FQDN naming rule to generate the virtual identifiers of each QSP, QSC, and QSM as shown in Table 1:

[0081] Table 1

[0082] Device Name FQDN QSP(A) qsp.a.mydomain QSM(A1) qsm.a1.mydomain QSC(A1-1) qsc1.a1.mydomain QSC(A1-2) qsc2.a1.mydomain QSM(A2) qsm.a2.mydomain QSC(A2-1) qsc1.a2.mydomain QSC(A2-2) qsc2.a2.mydomain QSP(B) qsp.b.mydomain QSM(B1) qsm.b1.mydomain QSC(B1-1) qsc1.b1.mydomain QSC(B1-2) qsc2.b1.mydomain QSM(B2) qsm.b2.mydomain QSC(B2-1) qsc1.b2.mydomain QSC(B2-2) qsc2.b2.mydomain

[0083] The relevant devices in the quantum security service system are uniformly identified by FQDN naming, and all QSMs, QSCs, and QSPs in the network are uniquely identified according to unified rules. For example, QSP (A) can be identified as qsp.a.mydomain, QSM (A1) can be identified as qsm.a1.mydomain, and QSC (A1-1) can be identified as qsc1.a1.mydomain.

[0084] The disclosed embodiment also provides a quantum key negotiation method, which is applied to a first QSP, such as Figure 3 As shown, the following steps are included:

[0085] Step 31, receiving a quantum key request sent by the first QSM, and obtaining the virtual identifier of the second QSC carried in the quantum key request, wherein the quantum key request is sent by the first QSC to the first QSM.

[0086] In the disclosed embodiment, the first QSC is represented by QSC-S, which is the initiator of the quantum key request, and the second QSC is represented by QSC-R, which is the receiver of the quantum key request. The virtual identifier is an identifier used by the QSC application layer.

[0087] Step 32, obtaining the physical identification of the second QSC according to the virtual identification of the second QSC.

[0088] The physical identifier is an identifier used in the QKD network. For example, in the QKD network, two QSCs use their respective physical identifiers to negotiate keys. It should be noted that each QSC has a virtual identifier and a physical identifier.

[0089] Step 33, sending a quantum key response carrying the physical identification of the second QSC to the first QSM, so that the first QSM sends a quantum key response to the first QSC, and the quantum key response is used to instruct the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC to perform quantum key negotiation based on the physical identification of the second QSC.

[0090] In this step, the first QSP uses the quantum key response to send the physical identification of the second QSC to the first QSM, so that the first QSM forwards the quantum key response to the first QSC, thereby enabling the first QSC to obtain the physical identification of the second QSC. In this way, the first QKD terminal of the first QSC and the second QKD terminal of the second QSC can perform quantum key negotiation in the QKD network based on the physical identification of the first QSC and the physical identification of the second QSC.

[0091] The quantum key negotiation method provided by the embodiment of the present disclosure is applied to a first QSP, including: receiving a quantum key request sent by a first QSM, obtaining a virtual identifier of a second QSC carried in the quantum key request, wherein the quantum key request is sent by the first QSC to the first QSM; obtaining a physical identifier of the second QSC according to the virtual identifier of the second QSC; sending a quantum key response carrying the physical identifier of the second QSC to the first QSM, so that the first QSM sends a quantum key response to the first QSC, wherein the quantum key response is used to instruct a first quantum key distribution QKD terminal of the first QSC to perform quantum key negotiation with a second QKD terminal of the second QSC according to the physical identifier of the second QSC. The disclosed embodiment builds a network including QSC, QSM and QSP outside the QKD network. The initiator QSC only knows the virtual identifier of the peer QSC. The first QSP obtains the physical identifier of the peer QSC based on the virtual identifier in the network, so that the initiator QSC and the peer QSC can perform quantum key negotiation based on the physical identifier of the peer QSC. There is no need to configure the physical identifier of the QSC in advance on the application. The physical identifier is dynamically obtained by using the virtual identifier of the QSC, which simplifies the management of quantum key negotiation and can be applied in large-scale QKD networks.

[0092] In some embodiments, the step of obtaining the physical identifier of the second QSC according to the virtual identifier of the second QSC (i.e., step 32) includes the following steps: locally querying a pre-configured second routing table to determine the next-hop device corresponding to the virtual identifier of the second QSC; wherein the second routing table records the next-hop devices corresponding to the virtual identifiers of all QSCs in the entire network; obtaining the physical identifier of the second QSC through the next-hop device, and the physical identifier of the second QSC is obtained by the next-hop device according to the virtual identifier of the second QSC. The next-hop device can be a QSM or other QSP directly connected to the first QSP. It should be noted that in the second routing table, the wildcard of the virtual identifier of the QSC can be used to represent the virtual identifiers of all QSCs under the jurisdiction of the first QSP.

[0093] In some embodiments, the obtaining of the physical identification of the second QSC through the next-hop device includes the following steps: when the next-hop device is the second QSM to which the second QSC governed by the first QSP belongs and the second QSM is not directly connected to the first QSM, a quantum key request is sent to the second QSM so that the second QSM can obtain the physical identification of the second QSC according to the virtual identification of the second QSC; and a quantum key response carrying the physical identification of the second QSC is received from the second QSM. It should be noted that the second QSM is configured with a second mapping relationship between the virtual identification and the physical identification of each QSC governed by the second QSM, and the second QSM obtains the physical identification of the second QSC according to the virtual identification of the second QSC and the second mapping relationship configured on the second QSM.

[0094] like Figure 1 As shown, it is assumed that the first QSC is QSC(A1-1), the second QSC is QSC(B1-2), the first QSM to which QSC(A1-1) belongs is QSM(A1), the second QSM to which QSC(B1-2) belongs is QSM(B1), the QSP to which QSC(A1-1) belongs is QSP(A), and the QSP to which QSC(B1-2) belongs is QSP(A). QSP(A) performs routing query according to the virtual identifier of QSC(B1-2) and determines that the next hop device is QSM(B1). QSM(B1) is the QSM under the jurisdiction of QSP(A) and QSM(B1) is not directly connected to QSM(A1). In this case, QSM(B1) is the second QSM to which QSC(B1-2) belongs. QSP(A) sends a quantum key request to QSM(B1), and QSM(B1) obtains the physical identifier of QSC(B1-2).

[0095] In some embodiments, the obtaining of the physical identification of the second QSC through the next-hop device includes the following steps: when the next-hop device is a second QSP different from the first QSP, sending a quantum key request to the second QSP, so that the second QSP can determine the second QSM to which the second QSC belongs according to the virtual identification of the second QSC, and instruct the second QSM to obtain the physical identification of the second QSC according to the virtual identification of the second QSC; receiving a quantum key response sent by the second QSP and carrying the physical identification of the second QSC, and the quantum key response is sent by the second QSM to the second QSP.

[0096] like Figure 1 As shown, it is assumed that the first QSC is QSC(A1-1), the second QSC is QSC(B2-2), the first QSM to which QSC(A1-1) belongs is QSM(A1), the second QSM to which QSC(B1-2) belongs is QSM(B2), the QSP to which QSC(A1-1) belongs is QSP(A), and the QSP to which QSC(B2-2) belongs is QSP(B). QSP (A) performs routing query according to the virtual identifier of QSC (B1-2) and determines that the next hop device is QSP (B). QSP (B) to which QSC (B2-2) belongs is different from QSP (A) to which QSC (A1-1) belongs. In this case, QSP (A) sends a quantum key request to QSP (B). QSP (B) determines QSM (B2) according to the virtual identifier of QSC (B2-2) and sends a quantum key request to QSM (B2). QSM (B2) obtains the physical identifier of QSC (B1-2).

[0097] In some embodiments, the virtual identifier is an identifier generated by the FQDN naming rule. It should be noted that the embodiment of the present disclosure is described by taking FQDN as an example, and the generation method of the virtual identifier includes but is not limited to the FQDN naming rule.

[0098] When the virtual identifier is an identifier generated by the FQDN naming rule and the next-hop device is a second QSP different from the first QSP, in order to prevent the application from directly obtaining network topology information and improve security, the embodiment of the present disclosure can also rewrite the virtual identifier of the first QSC.

[0099] Correspondingly, after receiving the quantum key request sent by the first QSC (i.e., step 31), the quantum key negotiation method may further include the following steps: obtaining the virtual identifier of the first QSC carried in the quantum key request. In other words, the quantum key request carries not only the virtual identifier of the second QSC, but also the virtual identifier of the first QSC. It should be noted that the quantum key request may also carry the physical identifier of the first QSC.

[0100] Correspondingly, sending a quantum key request to the second QSP includes the following steps: updating the first virtual identifier of the first QSC carried in the quantum key request to the second virtual identifier of the first QSC, and sending a quantum key request carrying the second virtual identifier to the second QSP, wherein the generation rule of the second virtual identifier is different from that of the first virtual identifier.

[0101] It should be noted that the second virtual identifier can be a temporary identifier generated by the FQDN naming rule, but it does not reflect the real network topology information, that is, the generation rule of the second virtual identifier is different from that of the first virtual identifier. In this step, since the first virtual identifier of the first QSC is an identifier generated by the FQDN naming rule, and the FQDN naming rule can reflect the network topology information in the area where the first QSP is located, the first virtual identifier of the first QSC is replaced by the pre-set second virtual identifier, and the first virtual identifier of the first QSC is rewritten. In this way, the second QSP and the QSM and QSC under its jurisdiction cannot know the network topology information of the area where the first QSC is located, which can avoid the application of the second QSC directly obtaining the network topology information, thereby improving security.

[0102] Accordingly, the step of sending a quantum key response carrying the physical identifier of the second QSC to the first QSM (i.e., step 33) includes the following steps: updating the second virtual identifier of the first QSC to the first virtual identifier of the first QSC, and sending a quantum key response carrying the physical identifier of the second QSC and the first virtual identifier of the first QSC to the first QSM. In this step, when the first QSP sends the physical identifier of the second QSC to the first QSM, it rewrites the second virtual identifier of the first QSC to the original virtual identifier, i.e., the first virtual identifier.

[0103] Figure 4 A schematic diagram of a system architecture including two QSPs provided in an embodiment of the present disclosure. Figure 4As shown, the sender manufacturer A and the receiver manufacturer B deploy QSPs respectively, and static configuration is adopted between the sender QSP (A) and the receiver QSP (B). Assuming that the first QSC is QSC (A1-1) and the second QSC is QSC (B2-2), after QSP (A) receives the quantum key request sent by QSM (A), it rewrites the first virtual identifier of QSC (A1-1) into the second virtual identifier, and carries the second virtual identifier of QSC (A1-1) in the quantum key request forwarded to QSP (B). In this way, while supporting communication and intercommunication between different manufacturers, the equipment of the receiving manufacturer cannot obtain the topology information of the network where the sender is located, thereby improving security. All cross-manufacturer related routing messages in the quantum key service network are sent to the QSP. Each QSM or QSC adopts an extensible virtual identifier. When communicating across manufacturers, each QSM or QSC provides an accurate virtual identifier and sends it to the QSP of this manufacturer. After the QSP of this manufacturer rewrites the virtual identifier, it is forwarded to the QSP of other manufacturers to achieve network topology hiding.

[0104] In some embodiments, the quantum key negotiation method may further include the following steps: upon receiving a quantum key request sent by a preset QSP, returning an access denial response to the preset QSP according to the access control policy. The preset QSP may be a manufacturer that has not signed a communication interoperability agreement with the device manufacturer of this QSP. For the devices of these manufacturers, communication interoperability cannot be achieved. Through this step, access control can be achieved. The QSP can verify the data of both parties in the two manufacturers, the authenticity of the source of the message, the scope of use of the requested information, etc. through access control. If the manufacturer being visited does not reach an agreement with the local manufacturer, the manufacturer being visited will block the routing query.

[0105] In the related art, devices from different manufacturers cannot communicate with each other. However, in the disclosed embodiment, QSP can not only serve as a border gateway to achieve communication with other device manufacturers, but also implement functions such as access control and network topology hiding.

[0106] The present disclosure also provides a quantum key negotiation method, which is applied to a first QSC, such as Figure 5 As shown, the following steps are included:

[0107] Step 51, sending a quantum key request to the first QSM to which the first QSC belongs, the quantum key request carrying the virtual identifier of the second QSC, so that the first QSM determines the next hop device through routing query according to the virtual identifier of the second QSC, and obtains the physical identifier of the second QSC through the next hop device.

[0108] The application of the first QSC initiates a quantum key request, and the first QSC receives the quantum key request and obtains the virtual identifier of the second QSC carried in the quantum key request. The first QSC is represented by QSC-S, which is the initiator of the quantum key request, and the second QSC is represented by QSC-R, which is the receiver of the quantum key request. The virtual identifier is the identifier used by the QSC application layer. The next hop device of the first QSM can be a QSP or a QSM directly connected to the first QSM.

[0109] Step 52, receiving the quantum key response sent by the first QSM, obtaining the physical identification of the second QSC carried in the quantum key response, and the quantum key response is sent by the next-hop device to the first QSM.

[0110] Step 53, sending the physical identification of the second QSC to the first QKD terminal, so that the first QKD terminal can perform quantum key negotiation with the second QKD terminal of the second QSC according to the physical identification of the second QSC.

[0111] The first QKD terminal is a QKD terminal directly connected to the first QSC, the second QKD terminal is a QKD terminal directly connected to the second QSC, and the physical identifier is an identifier used in the QKD network. In this step, in the QKD network, the first QKD terminal performs quantum key negotiation with the second QKD terminal according to the physical identifier of the first QSC and the physical identifier of the second QSC.

[0112] The quantum key negotiation method provided by the embodiment of the present disclosure is applied to a first QSC, including: sending a quantum key request to a first QSM to which the first QSC belongs, wherein the quantum key request carries a virtual identifier of a second QSC, so that the first QSM determines a next-hop device through a routing query according to the virtual identifier of the second QSC, and obtains a physical identifier of the second QSC through the next-hop device; receiving a quantum key response sent by the first QSM, obtaining the physical identifier of the second QSC carried in the quantum key response, and the quantum key response is sent by the next-hop device to the first QSM; sending the physical identifier of the second QSC to a first QKD terminal, so that the first QKD terminal determines the next-hop device according to the virtual identifier of the second QSC through a routing query, and obtains a physical identifier of the second QSC through the next-hop device; receiving a quantum key response sent by the first QSM, obtaining the physical identifier of the second QSC carried in the quantum key response, and the quantum key response is sent by the next-hop device to the first QSM; and sending the physical identifier of the second QSC to a first QKD terminal, so that the first QKD terminal determines the next-hop device according to the virtual identifier of the second QSC. The physical identifier of the SC performs quantum key negotiation with the second QKD terminal of the second QSC; the disclosed embodiment builds a network including at least QSC and QSM outside the QKD network, and the initiator QSC only knows the virtual identifier of the opposite QSC, performs addressing based on the virtual identifier in the network, and obtains the physical identifier of the opposite QSC, so that the QKD terminal of the initiator QSC and the QKD terminal of the opposite QSC can perform quantum key negotiation based on the physical identifier of the opposite QSC, without the need to configure the physical identifier of the QSC in advance on the application, and dynamically obtains the physical identifier by using the virtual identifier of the QSC, thereby simplifying the management of quantum key negotiation, and can be applied in large-scale QKD networks.

[0113] In some embodiments, the virtual identifier is an identifier generated by the FQDN naming rule. It should be noted that the embodiment of the present disclosure is described by taking FQDN as an example, and the generation method of the virtual identifier includes but is not limited to the FQDN naming rule.

[0114] The disclosed embodiments provide a QKD quantum key negotiation method and system supporting a wide area network to implement routing addressing, forming an interconnected quantum key service network, which can not only facilitate applications to implement arbitrary point-to-point negotiation of quantum keys, but also avoid applications from directly obtaining the QKD network topology, while supporting communication and interoperability between different equipment manufacturers.

[0115] To clearly illustrate the solution of the embodiment of the present disclosure, the quantum key negotiation process of the embodiment of the present disclosure is described in detail below through a specific example. Figure 1 As shown, taking the example where the initiator of the quantum key request is the first QSC (the first QSC is QSC(A1-1)) and the receiver of the quantum key request is the second QSC (the second QSC is QSC(B1-2)), that is, QSC-S is QSC(A1-1), QSC-R is QSC(B1-2), QSM-S is QSM(A1), QSM-R is QSM(B1), and QSP is QSP(A).

[0116] like Figure 6 As shown, the quantum key negotiation method comprises the following steps:

[0117] Step 1: The application of QSC-S initiates a quantum key request, which carries the virtual identifier (PeerNode) of the receiving party QSC (QSC-R).

[0118] Step 2: QSC-S initiates a quantum key request to its QSM-S. The quantum key request carries the virtual identifier (ReqNode) of the device (i.e., QSC-S), the physical identifier (ReqNodeID) of the device, and the virtual identifier (PeerNode) of QSC-R.

[0119] Step 3: After receiving the quantum key request, QSM-S queries the route based on the PeerNode and determines the QSP corresponding to the PeerNode of QSC-R, which is QSP(A).

[0120] Step 4: Forward the quantum key request to the QSP.

[0121] Step 5: After receiving the quantum key request, QSP queries the route based on the PeerNode and determines the QSM-R corresponding to the PeerNode of QSC-R.

[0122] Step 6: QSP forwards the quantum key request to QSM-R.

[0123] Step 7, QSM-R queries the route according to PeerNode, finds that it is the QSC-R under its jurisdiction, and obtains the physical identification (PeerNodeID) of QSC-R.

[0124] Step 8, QSM-R returns a quantum key response to QSP, which carries the virtual identifier (ReqNode) and physical identifier (ReqNodeID) of QSC-S and the virtual identifier (PeerNode) and physical identifier (PeerNodeID) of QSC-R.

[0125] Step 9: QSP forwards the quantum key response to QSM-S.

[0126] Step 10, QSM-S forwards the quantum key response to QSC-S, so that QSC-S can obtain the physical identification (PeerNodeID) of QSC-R.

[0127] Step 11. After QSC-S obtains the PeerNodeID of QSC-R, it sends the PeerNodeID of QSC-R to the first QKD terminal directly connected to QSC-S. The first QKD terminal sends a key application to the second QKD terminal directly connected to QSC-R through the QKD network. The key application carries the ReqNodeID of QSC-S and the PeerNodeID of QSC-R. The second QKD terminal returns the quantum key to the first QKD terminal, thereby completing the quantum key negotiation.

[0128] Step 12: After obtaining the quantum key, QSC-S returns the quantum key to the application of QSC-S.

[0129] QSC-S initiates a routing request to QSM based on the unique device identifier (PeerNode) of QSC-R carried by the application. QSM performs routing addressing and finally returns the QKD terminal device information (PeerNodeID) of QSC-R. QSC-S sends the PeerNodeID of QSC-R that needs to negotiate the quantum key to the directly connected local QKD terminal device, and the QKD network completes the relevant quantum key negotiation.

[0130] The routing addressing method proposed in the embodiment of the present disclosure obtains QKD terminal information (physical identification) by addressing the unique device identification (virtual identification) of QSC through QSM, and realizes any point-to-point quantum key negotiation on the application side of QSM through QSP. At the same time, QSP can be used as a border gateway to realize communication and interoperability with other equipment manufacturers, and realize functions such as access control and topology hiding, so as to give full play to the role of the national QKD network, combine with application scenarios, expand the use scenarios and flexibility of the QKD network, and build a quantum key and cryptographic ecosystem. The embodiment of the present disclosure can be combined with relevant cryptographic algorithms to realize quantum security cryptographic services of the national QKD network.

[0131] Based on the same technical concept, the disclosed embodiment also provides a quantum security service management and control center (QSM), such as Figure 7 As shown, the quantum security service control center includes:

[0132] The first receiving module 101 is used to receive a quantum key request sent by a first quantum security service client QSC, and obtain a virtual identifier of a second quantum security service client QSC carried in the quantum key request, where the virtual identifier is a virtual identifier.

[0133] The first routing addressing module 102 is used to perform routing query according to the virtual identifier of the second QSC to determine the next hop device.

[0134] The first physical identification acquisition module 103 is used to acquire the physical identification of the second QSC through the next-hop device. The physical identification of the second QSC is acquired by the next-hop device according to the virtual identification of the second QSC.

[0135] The first sending module 104 is used to send a quantum key response carrying the physical identification of the second QSC to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC can perform quantum key negotiation based on the physical identification of the second QSC.

[0136] In some embodiments, the first physical identification acquisition module 103 is used to obtain the physical identification of the second QSC based on the virtual identification of the second QSC and a first mapping relationship configured on the first QSM when the next-hop device is the first QSM. The first mapping relationship is a mapping relationship between the virtual identification and the physical identification of each QSC under the jurisdiction of the first QSM.

[0137] In some embodiments, the first physical identification acquisition module 103 is used to send the quantum key request to the second QSM, when the next-hop device is the second QSM to which the second QSC belongs and the second QSM is directly connected to the first QSM, so that the second QSM can obtain the physical identification of the second QSC based on the virtual identification of the second QSC and a second mapping relationship configured on the second QSM, wherein the second mapping relationship is a mapping relationship between the virtual identification and the physical identification of each QSC under the jurisdiction of the second QSM; and receive a quantum key response sent by the second QSM and carrying the physical identification of the second QSC.

[0138] In some embodiments, the first physical identification acquisition module 103 is used to send the quantum key request to the first QSP, so that the first QSP can determine the second QSM according to the virtual identification of the second QSC, and instruct the second QSM to obtain the physical identification of the second QSC according to the virtual identification of the second QSC, when the next-hop device is the first quantum security service proxy QSP to which the first QSM belongs, and the second QSP to which the second QSC belongs is the same as the first QSP, and the first QSM is not directly connected to the second QSM to which the second QSC belongs. The quantum key request is received by the first QSP and carries the physical identification of the second QSC, and the quantum key response is sent by the second QSM to the first QSP.

[0139] In some embodiments, the first physical identification acquisition module 103 is used to send the quantum key request to the second QSP through the first QSP, when the next-hop device is the first quantum security service proxy QSP to which the first QSM belongs, and the second QSP to which the second QSC belongs is different from the first QSP, so that the second QSP can determine the second QSM to which the second QSC belongs according to the virtual identification of the second QSC, and instruct the second QSM to obtain the physical identification of the second QSC according to the virtual identification of the second QSC; receive the quantum key response sent by the first QSP and carrying the physical identification of the second QSC, and the quantum key response is sent by the second QSM to the first QSP through the second QSP.

[0140] In some embodiments, the first routing addressing module 102 is used to locally query a pre-configured first routing table to determine the next-hop device corresponding to the virtual identifier of the second QSC; wherein the first routing table records the next-hop devices corresponding to the virtual identifiers of all QSCs in the entire network.

[0141] In some embodiments, the virtual identifier is an identifier generated by a fully qualified domain name (FQDN) naming rule.

[0142] Based on the same technical concept, the embodiment of the present disclosure also provides a quantum security service proxy device (QSP), such as Figure 8 As shown, the quantum security service agent device includes:

[0143] The second receiving module 201 is used to receive a quantum key request sent by the first quantum security service management and control center QSM, and obtain the virtual identifier of the second quantum security service client QSC carried in the quantum key request. The quantum key request is sent by the first QSC to the first QSM.

[0144] The second physical identification acquisition module 202 is used to acquire the physical identification of the second QSC according to the virtual identification of the second QSC.

[0145] The second sending module 203 is used to send a quantum key response carrying the physical identification of the second QSC to the first QSM, so that the first QSM sends the quantum key response to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC perform quantum key negotiation based on the physical identification of the second QSC.

[0146] In some embodiments, the second physical identification acquisition module 202 is used to locally query a pre-configured second routing table to determine the next-hop device corresponding to the virtual identification of the second QSC; wherein the second routing table records the next-hop devices corresponding to the virtual identifications of all QSCs in the entire network; the physical identification of the second QSC is obtained through the next-hop device, and the physical identification of the second QSC is obtained by the next-hop device according to the virtual identification of the second QSC.

[0147] In some embodiments, the second physical identification acquisition module 202 is used to send the quantum key request to the second QSM, when the next-hop device is the second QSM to which the second QSC under the jurisdiction of the first QSP belongs and the second QSM is not directly connected to the first QSM, so that the second QSM can obtain the physical identification of the second QSC according to the virtual identification of the second QSC; and receive the quantum key response sent by the second QSM and carrying the physical identification of the second QSC.

[0148] In some embodiments, the second physical identification acquisition module 202 is used to send the quantum key request to the second QSP when the next-hop device is a second QSP different from the first QSP, so that the second QSP can determine the second QSM to which the second QSC belongs according to the virtual identification of the second QSC, and instruct the second QSM to obtain the physical identification of the second QSC according to the virtual identification of the second QSC; receive the quantum key response sent by the second QSP and carrying the physical identification of the second QSC, and the quantum key response is sent by the second QSM to the second QSP.

[0149] In some embodiments, the virtual identifier is an identifier generated by a fully qualified domain name (FQDN) naming rule.

[0150] In some embodiments, the second physical identification acquisition module 202 is further used to update the first virtual identification of the first QSC carried in the quantum key request to the second virtual identification of the first QSC, and send a quantum key request carrying the second virtual identification to the second QSP, where the generation rule of the second virtual identification is different from that of the first virtual identification.

[0151] The second sending module 203 is also used to update the second virtual identifier of the first QSC to the first virtual identifier of the first QSC, and send a quantum key response carrying the physical identifier of the second QSC and the first virtual identifier of the first QSC to the first QSM.

[0152] In some embodiments, Fig. 9 As shown, the quantum security service proxy device also includes an access processing module 204, which is used to return an access denial response to the preset QSP according to the access control policy when receiving the preset QSP.

[0153] Based on the same technical concept, the embodiment of the present disclosure also provides a quantum security service client (QSC), such as Fig.10 As shown, the quantum security service client (QSC) includes:

[0154] The third sending module 301 is used to send a quantum key request to the first quantum security service management and control center QSM to which the first QSC belongs. The quantum key request carries the virtual identifier of the second QSC, so that the first QSM determines the next-hop device through routing query according to the virtual identifier of the second QSC, and obtains the physical identifier of the second QSC through the next-hop device.

[0155] The third receiving module 302 is used to receive the quantum key response sent by the first QSM, and obtain the physical identification of the second QSC carried in the quantum key response. The quantum key response is sent by the next-hop device to the first QSM.

[0156] The third sending module 302 is also used to send the physical identification of the second QSC to the first quantum key distribution QKD terminal, so that the first QKD terminal can perform quantum key negotiation with the second QKD terminal of the second QSC according to the physical identification of the second QSC.

[0157] In some embodiments, the virtual identifier is an identifier generated by a fully qualified domain name (FQDN) naming rule.

[0158] The embodiments of the present disclosure also provide a computer device, which includes: one or more processors and a storage device; wherein one or more programs are stored on the storage device, and when the one or more programs are executed by the one or more processors, the one or more processors implement the quantum key agreement method provided in the aforementioned embodiments.

[0159] The embodiments of the present disclosure also provide a computer-readable medium on which a computer program is stored, wherein when the computer program is executed, the quantum key agreement method provided in the aforementioned embodiments is implemented.

[0160] It will be appreciated by those skilled in the art that all or some of the steps in the method disclosed above, the functional modules / units in the device may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0161] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly stated, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, it will be understood by those skilled in the art that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A quantum key negotiation method, characterized in that: The method is applied to the first quantum security service management and control center QSM, including: Receiving a quantum key request sent by a first quantum security service client QSC, and obtaining a virtual identifier of a second quantum security service client QSC carried in the quantum key request; Perform a route query according to the virtual identifier of the second QSC to determine a next-hop device; Acquire the physical identifier of the second QSC through the next-hop device, where the physical identifier of the second QSC is acquired by the next-hop device according to the virtual identifier of the second QSC; A quantum key response carrying the physical identification of the second QSC is sent to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC perform quantum key negotiation based on the physical identification of the second QSC.

2. The method according to claim 1, characterized in that The acquiring the physical identifier of the second QSC through the next-hop device includes: When the next-hop device is the first QSM, the physical identifier of the second QSC is obtained according to the virtual identifier of the second QSC and the first mapping relationship configured on the first QSM, and the first mapping relationship is the mapping relationship between the virtual identifier and the physical identifier of each QSC under the jurisdiction of the first QSM.

3. The method according to claim 1, characterized in that The acquiring the physical identifier of the second QSC through the next-hop device includes: When the next-hop device is a second QSM to which the second QSC belongs and the second QSM is directly connected to the first QSM, the quantum key request is sent to the second QSM, so that the second QSM obtains the physical identifier of the second QSC according to the virtual identifier of the second QSC and a second mapping relationship configured on the second QSM, where the second mapping relationship is a mapping relationship between the virtual identifier and the physical identifier of each QSC under the jurisdiction of the second QSM; Receive a quantum key response sent by the second QSM and carrying the physical identification of the second QSC.

4. The method according to claim 1, characterized in that The acquiring the physical identifier of the second QSC through the next-hop device includes: When the next-hop device is the first quantum security service proxy QSP to which the first QSM belongs, and the second QSP to which the second QSC belongs is the same as the first QSP, and the first QSM and the second QSM to which the second QSC belongs are not directly connected, the quantum key request is sent to the first QSP, so that the first QSP determines the second QSM according to the virtual identifier of the second QSC, and instructs the second QSM to obtain the physical identifier of the second QSC according to the virtual identifier of the second QSC; Receive a quantum key response sent by the first QSP and carrying the physical identification of the second QSC, where the quantum key response is sent by the second QSM to the first QSP.

5. The method according to claim 1, characterized in that The acquiring the physical identifier of the second QSC through the next-hop device includes: When the next-hop device is the first quantum security service proxy QSP to which the first QSM belongs, and the second QSP to which the second QSC belongs is different from the first QSP, the quantum key request is sent to the second QSP through the first QSP, so that the second QSP determines the second QSM to which the second QSC belongs according to the virtual identifier of the second QSC, and instructs the second QSM to obtain the physical identifier of the second QSC according to the virtual identifier of the second QSC; Receive a quantum key response sent by the first QSP and carrying the physical identification of the second QSC, where the quantum key response is sent by the second QSM to the first QSP through the second QSP.

6. The method according to claim 1, characterized in that The performing a route query according to the virtual identifier of the second QSC to determine a next hop device includes: A pre-configured first routing table is queried locally to determine the next-hop device corresponding to the virtual identifier of the second QSC; wherein the first routing table records the next-hop devices corresponding to the virtual identifiers of all QSCs in the entire network.

7. The method according to any one of claims 1 to 6, characterized in that: The virtual identifier is an identifier generated according to the fully qualified domain name FQDN naming rule.

8. A quantum key negotiation method, characterized in that: The method is applied to the first quantum security service agent QSP, comprising: Receiving a quantum key request sent by a first quantum security service management and control center QSM, and obtaining a virtual identifier of a second quantum security service client QSC carried in the quantum key request, wherein the quantum key request is sent by the first QSC to the first QSM; Acquiring a physical identifier of the second QSC according to the virtual identifier of the second QSC; A quantum key response carrying the physical identification of the second QSC is sent to the first QSM, so that the first QSM sends the quantum key response to the first QSC, and the quantum key response is used to instruct the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC to perform quantum key negotiation based on the physical identification of the second QSC.

9. The method according to claim 8, characterized in that The acquiring the physical identifier of the second QSC according to the virtual identifier of the second QSC includes: Querying a pre-configured second routing table locally to determine the next-hop device corresponding to the virtual identifier of the second QSC; wherein the second routing table records the next-hop devices corresponding to the virtual identifiers of all QSCs in the entire network; The physical identifier of the second QSC is obtained through the next-hop device, and the physical identifier of the second QSC is obtained by the next-hop device according to the virtual identifier of the second QSC.

10. The method according to claim 9, characterized in that The acquiring the physical identifier of the second QSC through the next-hop device includes: When the next-hop device is a second QSM to which a second QSC governed by the first QSP belongs and the second QSM is not directly connected to the first QSM, sending the quantum key request to the second QSM so that the second QSM obtains the physical identifier of the second QSC according to the virtual identifier of the second QSC; Receive a quantum key response sent by the second QSM and carrying the physical identification of the second QSC.

11. The method according to claim 9, characterized in that The acquiring the physical identifier of the second QSC through the next-hop device includes: In a case where the next-hop device is a second QSP different from the first QSP, sending the quantum key request to the second QSP, so that the second QSP determines the second QSM to which the second QSC belongs according to the virtual identifier of the second QSC, and instructs the second QSM to obtain the physical identifier of the second QSC according to the virtual identifier of the second QSC; Receive a quantum key response sent by the second QSP and carrying the physical identification of the second QSC, where the quantum key response is sent by the second QSM to the second QSP.

12. The method according to claim 11, characterized in that The virtual identifier is an identifier generated according to the fully qualified domain name FQDN naming rule.

13. The method according to claim 12, characterized in that The sending the quantum key request to the second QSP comprises: Updating the first virtual identifier of the first QSC carried in the quantum key request to the second virtual identifier of the first QSC, and sending a quantum key request carrying the second virtual identifier to the second QSP, where the generation rule of the second virtual identifier is different from that of the first virtual identifier; The sending a quantum key response carrying the physical identification of the second QSC to the first QSM includes: The second virtual identifier of the first QSC is updated to the first virtual identifier of the first QSC, and a quantum key response carrying the physical identifier of the second QSC and the first virtual identifier of the first QSC is sent to the first QSM.

14. The method according to any one of claims 8 to 13, characterized in that: The method further comprises: When receiving a quantum key request sent by a preset QSP, an access denial response is returned to the preset QSP according to the access control policy.

15. A quantum key negotiation method, characterized in that: The method is applied to a first quantum security service client QSC, comprising: Sending a quantum key request to the first quantum security service control center QSM to which the first QSC belongs, wherein the quantum key request carries the virtual identifier of the second QSC, so that the first QSM can determine the next-hop device through routing query according to the virtual identifier of the second QSC, and obtain the physical identifier of the second QSC through the next-hop device; receiving a quantum key response sent by the first QSM, and acquiring a physical identifier of the second QSC carried in the quantum key response, wherein the quantum key response is sent by the next-hop device to the first QSM; The physical identification of the second QSC is sent to the first quantum key distribution QKD terminal, so that the first QKD terminal can perform quantum key negotiation with the second QKD terminal of the second QSC according to the physical identification of the second QSC.

16. The method according to claim 15, characterized in that The virtual identifier is an identifier generated according to the fully qualified domain name FQDN naming rule.

17. A quantum security service control center, characterized in that: include: A first receiving module is configured to receive a quantum key request sent by a first quantum security service client QSC, and obtain a virtual identifier of a second quantum security service client QSC carried in the quantum key request, where the virtual identifier is a virtual identifier; A first routing addressing module, configured to perform routing query according to the virtual identifier of the second QSC to determine a next hop device; A first physical identification acquisition module, configured to acquire the physical identification of the second QSC through the next-hop device, wherein the physical identification of the second QSC is acquired by the next-hop device according to the virtual identification of the second QSC; The first sending module is used to send a quantum key response carrying the physical identification of the second QSC to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC can perform quantum key negotiation based on the physical identification of the second QSC.

18. A quantum security service agent device, characterized in that: include: A second receiving module is configured to receive a quantum key request sent by a first quantum security service control center QSM, and obtain a virtual identifier of a second quantum security service client QSC carried in the quantum key request, wherein the quantum key request is sent by the first QSC to the first QSM; A second physical identification acquisition module, configured to acquire the physical identification of the second QSC according to the virtual identification of the second QSC; The second sending module is used to send a quantum key response carrying the physical identification of the second QSC to the first QSM, so that the first QSM sends the quantum key response to the first QSC, so that the first quantum key distribution QKD terminal of the first QSC and the second QKD terminal of the second QSC perform quantum key negotiation according to the physical identification of the second QSC.

19. A quantum security service client, characterized in that: include: A third sending module is used to send a quantum key request to a first quantum security service control center QSM to which the first QSC belongs, wherein the quantum key request carries a virtual identifier of the second QSC, so that the first QSM determines a next-hop device through a routing query according to the virtual identifier of the second QSC, and obtains a physical identifier of the second QSC through the next-hop device; a third receiving module, configured to receive a quantum key response sent by the first QSM, and obtain a physical identifier of the second QSC carried in the quantum key response, wherein the quantum key response is sent by the next-hop device to the first QSM; The third sending module is also used to send the physical identification of the second QSC to the first quantum key distribution QKD terminal, so that the first QKD terminal can perform quantum key negotiation with the second QKD terminal of the second QSC according to the physical identification of the second QSC.

20. A computer device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the quantum key negotiation method as described in any one of claims 1 to 7, the quantum key negotiation method as described in any one of claims 8 to 14, or the quantum key negotiation method as described in any one of claims 15 to 16.

21. A computer readable medium having a computer program stored thereon, wherein: When the program is executed, the quantum key negotiation method according to any one of claims 1 to 7, the quantum key negotiation method according to any one of claims 8 to 14, or the quantum key negotiation method according to any one of claims 15 to 16 is implemented.

Images