A method and system for quantum security device accessing base station

Abstract

The present invention discloses a method and system for quantum security device accessing a base station. The method of the present application comprises: a quantum security device obtains an IP address of a base station; the quantum security device sends access request information to the base station according to the IP address of the base station and carries a device ID; the base station receives the access request information and sends an authentication request information carrying the device ID to a verification terminal; the method provides a method and an authentication scheme specifically for how a quantum security device accesses a base station, and can perform security authentication on the quantum security device during access to ensure the legitimacy of its identity; at the same time, the random number generated in the subsequent synchronous key authentication process cannot be obtained in advance by the outside world, and it is also difficult to counterfeit the random number; the encryption key is selected from a pre-configured root key group, which increases the difficulty of external acquisition; combined with the dual authentication of the quantum security device and the root key center, the security and reliability of the subsequent base station downloading the synchronous root key group are greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for accessing a quantum security device to a base station. Background Art

[0002] Traditional information security is achieved through encryption algorithms that rely on computational complexity. However, with the rapid development of computing power, traditional encryption algorithms that rely on computational complexity face increasing security risks.

[0003] As society attaches more and more importance to the security of communications, quantum secure communication technology has received attention from all parties. It can perfectly overcome the potential security risks of traditional communication technology and ensure the absolute security and reliability of the communication process.

[0004] Quantum secure communication is the first quantum information technology to be put into practical use and industrialized. At present, there are many quantum security devices on the market for ensuring information security. Quantum security devices can perform quantum encryption on data during use to ensure that the data they send is highly secure. When multiple quantum security devices need to interact, they need to communicate with the base station in a network to transmit data and relay keys. How to authenticate the quantum security device before it accesses the base station to ensure the legitimacy of its identity? At present, there is no mature method and system specifically for quantum security devices to securely access the base station. If the quantum security device is deployed in an untrusted environment, it is vulnerable to attacks by malicious users, posing a serious threat to the quantum security network and user terminals. Therefore, in the networking process of quantum security devices, a safe and complete authentication mechanism needs to be designed to ensure its security. Summary of the invention

[0005] In order to solve the above problems, the present invention discloses a method and system for quantum security device accessing a base station.

[0006] The present application provides a method for a quantum security device to access a base station, the method comprising:

[0007] The quantum security device obtains the base station IP address, and sends an access request message to the base station according to the base station IP address and carries the device ID;

[0008] The base station receives the access request information and sends an authentication request information carrying the device ID to the verification end;

[0009] The base station receives the first access authentication result information from the verification end, and when identifying the first access authentication result information as successful authentication, allows the quantum security device to access the base station; wherein the first access authentication result information is generated according to whether the device ID is in the security device list of the verification end, if the device ID is in the security device list of the verification end, the generated first access authentication result information is marked as successful authentication, otherwise, the generated first access authentication result information is marked as failed authentication.

[0010] Furthermore, the method for the quantum security device to obtain the IP address of the base station includes:

[0011] The quantum security device sends a base station request message to the base station external network server;

[0012] The base station external network server receives the base station request message, allocates a base station to the quantum security device according to the access status and load status of the current base station, and returns the base station IP address corresponding to the base station to the quantum security device.

[0013] Furthermore, the quantum security device further performs the following operations before accessing the base station:

[0014] The root key center obtains a root key group to be distributed to the quantum security device, and distributes the root key group to the quantum security device;

[0015] After the quantum security device is connected to the base station, the following operations are further performed:

[0016] When the quantum security device sends access request information to the base station, the access request information also carries first verification information;

[0017] The root key center receives the first verification information from the quantum security device, determines whether there is a root key group according to the device ID in the first verification information, and generates second verification information when the root key group exists; then selects one from the root key group of the root key center as the first key, encrypts the first verification information by the first key to form a first ciphertext, encrypts the second verification information to generate a second ciphertext, and then sends the first ciphertext, the second ciphertext and a first key index for determining the first key to the quantum security device;

[0018] The quantum security device receives a first ciphertext, a second ciphertext, and a first key index, determines a first key according to the first key index to decrypt the first ciphertext and verifies whether it is the same as the first verification information, and when the verification result is the same, selects one from the root key group stored therein as a second key, encrypts the second verification information by the second key to form a third ciphertext, and sends the third ciphertext and a second key index for determining a second key to the base station, where the second key is different from the first key;

[0019] The base station receives the third ciphertext and the second key index, and sends the third ciphertext and the second key index to the root key center;

[0020] The root key center receives the third ciphertext and the second key index, determines the second key according to the second key index to decrypt the third ciphertext and verifies whether it is the same as the second verification information to generate root key center authentication result information, and sends the root key group storage location information corresponding to the quantum security device to the base station when the root key center authentication result information indicates that the authentication is passed;

[0021] The base station receives the root key center authentication result information and the root key group storage location information, downloads the root key group corresponding to the quantum security device from the root key center according to the root key group storage location information, and returns the root key group acquisition result information to the quantum security device.

[0022] In a scenario where the quantum security device is disconnected from the base station and then accesses the base station again, the method includes:

[0023] The quantum security device sends the access request information to the base station again according to the base station IP address, and the access request information also carries the current network access ID and the third verification information;

[0024] The base station sends authentication request information to the authentication center again, and the base station determines whether the current network access ID exists in the allocation record of the base station, and generates an updated network access ID for the quantum security device when the network access ID exists in the allocation record;

[0025] The authentication center determines whether the device ID is in the security device list according to the device ID in the access request information to generate non-first access authentication result information, and returns the non-first access authentication result information to the base station;

[0026] If the base station identifies that the non-first access authentication result information is a successful authentication, the base station generates fourth verification information, searches for a root key group stored in the base station according to the received device ID, selects one from the root key group stored in the base station as a third key, encrypts the third verification information by the third key to form a fourth ciphertext, encrypts the fourth verification information to generate a fifth ciphertext, and then generates a third key index corresponding to the third key; sends the fourth ciphertext, the fifth ciphertext and the third key index to the quantum security device;

[0027] The quantum security device receives the fourth ciphertext, the fifth ciphertext and the third key index, determines the third key in the root key group stored in the quantum security device according to the third key index to decrypt the fourth ciphertext and verify whether it is the same as the third verification information to generate first verification result information, and when the first verification result information is marked as the same, selects one from the root key group stored therein as the fourth key, generates a fourth key index corresponding to the fourth key, encrypts the fourth verification information by the fourth key to form a sixth ciphertext, and sends the sixth ciphertext and the fourth key index to the base station, where the fourth key is different from the third key;

[0028] The base station receives the sixth ciphertext and the fourth key index, determines the fourth key in the root key group stored in the base station according to the fourth key index to decrypt the sixth ciphertext and verifies whether it is the same as the fourth verification information to generate second verification result information, and sends an access completion message to the quantum security device when the second verification result information is identified as the same, and the access completion message carries an updated network access ID;

[0029] The quantum security device receives the access completion message and connects to the base station through the updated network access ID in the access completion message.

[0030] Further, the first verification information includes a first random number generated by the quantum security device, the second verification information includes a second random number generated by the root key center, the third verification information includes a third random number generated by the quantum security device, and the fourth verification information includes a fourth random number generated by the base station.

[0031] Furthermore, the first random number, the second random number, the third random number and the fourth random number are all quantum true random numbers.

[0032] Furthermore, after identifying that the first access authentication result information is a successful authentication, the base station also allocates a network access ID to the quantum security device; and the authentication center also records the network access ID.

[0033] The present application also provides a system for quantum security device access to a base station, the system comprising a quantum security device, a base station and an authentication center;

[0034] The quantum security device is used to obtain the base station IP address, and send access request information to the base station according to the base station IP address, wherein the access request information carries a device ID;

[0035] The base station is used to receive the access request information, send the device ID to the authentication center, and receive the first access authentication result information from the authentication center, and when the first access authentication result information is identified as successful authentication, allow the quantum security device to access the base station;

[0036] The authentication center is used to receive a device ID from a base station and generate first-access authentication result information for sending to the base station, wherein the first-access authentication result information is generated according to whether the device ID is in a security device list of the authentication center. If the device ID is in the security device list of the authentication center, the generated first-access authentication result information is marked as a successful authentication; otherwise, the generated first-access authentication result information is marked as a failed authentication.

[0037] Furthermore, the system also includes a base station external network server and a DNS server;

[0038] The base station external network server is used to receive a base station request message from a quantum security device, and allocate a base station to the quantum security device according to the access status and load status of the current base station, and return the base station IP address corresponding to the base station;

[0039] The DNS server is used to receive an address query request from the quantum security device, and send the base station external network server IP address to the quantum security device according to the address query request;

[0040] The quantum security device is also used to receive the IP address of the base station external network server and connect to the base station external network server according to the IP address of the base station external network server.

[0041] Compared with the prior art, the beneficial effects of the present invention are as follows: the method of the present application provides a method and an authentication scheme specifically for how a quantum security device accesses a base station, and can perform security authentication on the quantum security device during access to ensure the legitimacy of its identity;

[0042] The system of the present application includes a quantum security device, a base station and a root key center, and the same root key group is pre-installed in the quantum security device and the root key center. When accessing, the quantum security device and the root key center mutually encrypt the random numbers generated by each other, and then determine the decryption key from their respective root key groups. After the encrypted ciphertext is decrypted and successfully verified with the random number generated by itself, the generated authentication information is marked as authentication passed. At this time, the base station is allowed to download and synchronize the root key group corresponding to the quantum security device from the root key center; the random number generated in this process cannot be obtained in advance by the outside world, cannot be predicted, and is difficult to counterfeit. The encryption key is selected from the pre-configured root key group, which increases the difficulty of external acquisition. Combined with the dual authentication of the quantum security device and the root key center, the security and reliability of the subsequent base station downloading and synchronizing the root key group are greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a timing diagram of the quantum security device in the embodiment of the present application accessing the base station;

[0044] Figure 2 This is a timing diagram for a scenario in which a quantum security device is disconnected from a base station and then reconnects to the base station in an embodiment of the present application;

[0045] Figure 3 This is a system block diagram of a quantum security device accessing a base station in an embodiment of the present application;

[0046] Figure 4 This is a flow chart of a method for a quantum security device to access a base station in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0048] Embodiment 1: A method for a quantum security device to access a base station, the method comprising:

[0049] The quantum security device sends a base station request message to the base station external network server;

[0050] The base station external network server receives the base station request message, allocates a base station to the quantum security device according to the access status and load status of the current base station, and returns the base station IP address corresponding to the base station to the quantum security device; the access status refers to the base station that is currently online or available for use; the load status refers to the current load status of each base station, and the base station external network server preferentially allocates base stations with lower loads to the quantum security device;

[0051] See also Figure 4 In steps S201-S203: the quantum security device sends an access request message to the base station according to the base station IP address and carries the device ID;

[0052] The base station receives the access request information and sends an authentication request information carrying the device ID to the verification end;

[0053] The base station receives the first access authentication result information from the verification end, and when identifying the first access authentication result information as successful authentication, allows the quantum security device to access the base station; wherein the first access authentication result information is generated according to whether the device ID is in the security device list of the verification end, if the device ID is in the security device list of the verification end, the generated first access authentication result information is marked as successful authentication, otherwise, the generated first access authentication result information is marked as failed authentication.

[0054] In addition, after the base station identifies the first access authentication result information as successful authentication, it also allocates a network access ID to the quantum security device; the authentication center also records the network access ID, and the network access ID is recorded by the authentication center so that the service provider knows which base station the quantum security device is currently connected to.

[0055] When the authentication result information indicates that the authentication is successful, the authentication center further performs the following operations:

[0056] The authentication center sends the root key group storage location information corresponding to the quantum security device to the base station. The base station is also used to synchronize the root key group with the quantum security device after the quantum security device is connected. The base station uses the returned root key group storage location information to find and determine the root key group location corresponding to the quantum security device.

[0057] The method for the base station to obtain the corresponding root key group in the quantum security device includes:

[0058] The root key center obtains the root key group to be distributed to the quantum security device, and distributes the root key group to the quantum security device; specifically, an offline or online distribution method may be used, and the root key group is composed of true random numbers generated by quantum true random numbers;

[0059] When the quantum security device sends access request information to the base station, the access request information also carries first verification information;

[0060] The root key center receives the first verification information from the quantum security device, determines whether there is a root key group according to the device ID in the first verification information, and generates second verification information when the root key group exists; then selects one from the root key group of the root key center as the first key, encrypts the first verification information by the first key to form a first ciphertext, encrypts the second verification information to generate a second ciphertext, and then sends the first ciphertext, the second ciphertext and a first key index for determining the first key to the quantum security device;

[0061] The quantum security device receives a first ciphertext, a second ciphertext, and a first key index, determines a first key according to the first key index to decrypt the first ciphertext and verifies whether it is the same as the first verification information, and when the verification result is the same, selects one from the root key group stored therein as a second key, encrypts the second verification information by the second key to form a third ciphertext, and sends the third ciphertext and a second key index for determining a second key to the base station, where the second key is different from the first key;

[0062] The base station receives the third ciphertext and the second key index, and sends the third ciphertext and the second key index to the root key center;

[0063] The root key center receives the third ciphertext and the second key index, determines the second key according to the second key index to decrypt the third ciphertext and verifies whether it is the same as the second verification information to generate root key center authentication result information, and sends the root key group storage location information corresponding to the quantum security device to the base station when the root key center authentication result information indicates that the authentication is passed;

[0064] The base station receives the root key center authentication result information and the root key group storage location information, downloads the root key group corresponding to the quantum security device from the root key center according to the root key group storage location information, and returns the root key group acquisition result information to the quantum security device.

[0065] The first verification information includes a first random number generated by the quantum security device, and the second verification information includes a second random number generated by the root key center, and both the first random number and the second random number are quantum true random numbers;

[0066] The first key and the second key use different keys, and they can be selected in order, such as storage order or time order; when selecting the second key, the previous first key can be removed from the root key group and then randomly selected from the remaining root key groups; each key in the first root key group and the second root key group can pre-establish corresponding identifiers, and the key index is established based on the identifier to facilitate the subsequent search and determination of the key.

[0067] The random numbers generated during the above authentication process are obtained by both parties in real time from the inside. The outside world cannot know and predict them in advance, and it is difficult to counterfeit them. The encryption key is selected from a pre-configured root key group. It is difficult for external insecure devices to directly obtain the root key group information. Only the index of the encryption key is transmitted during the authentication process. Even if it is obtained externally, it will not cause the key to be leaked, and the correct key cannot be used to decrypt and verify the generated random number in the subsequent authentication process. Therefore, by generating random numbers and combining the mutual encryption and decryption verification between the two parties, as well as the dual authentication of the quantum security device and the root key center, the security and reliability of synchronizing the root key group between the base station and the root key center can be greatly improved.

[0068] Embodiment 2: In a scenario where the quantum security device is disconnected from the base station and then reconnects to the base station, the method includes:

[0069] The quantum security device sends the access request information to the base station again according to the base station IP address, and the access request information also carries the current network access ID and the third verification information;

[0070] The base station sends authentication request information to the authentication center again, and the base station determines whether the current network access ID exists in the allocation record of the base station, and generates an updated network access ID for the quantum security device when the network access ID exists in the allocation record;

[0071] The authentication center determines whether the device ID is in the security device list according to the device ID in the access request information to generate non-first access authentication result information, and returns the non-first access authentication result information to the base station;

[0072] If the base station identifies that the non-first access authentication result information is a successful authentication, the base station generates fourth verification information, searches for a root key group stored in the base station according to the received device ID, selects one from the root key group stored in the base station as a third key, encrypts the third verification information by the third key to form a fourth ciphertext, encrypts the fourth verification information to generate a fifth ciphertext, and then generates a third key index corresponding to the third key; sends the fourth ciphertext, the fifth ciphertext and the third key index to the quantum security device;

[0073] The quantum security device receives the fourth ciphertext, the fifth ciphertext and the third key index, determines the third key in the root key group stored in the quantum security device according to the third key index to decrypt the fourth ciphertext and verify whether it is the same as the third verification information to generate first verification result information, and when the first verification result information is marked as the same, selects one from the root key group stored therein as the fourth key, generates a fourth key index corresponding to the fourth key, encrypts the fourth verification information by the fourth key to form a sixth ciphertext, and sends the sixth ciphertext and the fourth key index to the base station, where the fourth key is different from the third key;

[0074] The base station receives the sixth ciphertext and the fourth key index, determines the fourth key in the root key group stored in the base station according to the fourth key index to decrypt the sixth ciphertext and verifies whether it is the same as the fourth verification information to generate second verification result information, and sends an access completion message to the quantum security device when the second verification result information is identified as the same, and the access completion message carries an updated network access ID;

[0075] The quantum security device receives the access completion message and connects to the base station through the updated network access ID in the access completion message.

[0076] The third verification information includes a third random number generated by the quantum security device, and the fourth verification information includes a fourth random number generated by the base station, and both the third random number and the fourth random number are quantum true random numbers;

[0077] In this scenario, the reason why authentication is still required is that whether quantum security devices are allowed to access needs to be controlled by the service provider, rather than simply allowing access when network communication and keys are normal.

[0078] In Embodiment 1-2, the first verification information includes a first random number generated by the quantum security device, the second verification information includes a second random number generated by the root key center, the third verification information includes a third random number generated by the quantum security device, and the fourth verification information includes a fourth random number generated by the base station;

[0079] The first random number, the second random number, the third random number and the fourth random number are all quantum true random numbers; the quantum true random number is generated by a quantum random number generator, and a completely unpredictable random sequence can be obtained by the quantum random number generator;

[0080] After identifying that the first access authentication result information is successful, the base station further allocates a network access ID to the quantum security device;

[0081] When the base station sends the authentication request information to the authentication center, the authentication request information also carries the network access ID;

[0082] After receiving the network access ID, the authentication center records the network access ID so that the service provider knows which base station the quantum security device is currently connected to.

[0083] Example 3: See Figure 1-3 The present application also provides a system for quantum security device access to a base station, which is specifically applied in a scenario where a quantum security device 100 accesses a base station 200 for the first time or accesses the base station 200 again after being returned to the factory for reset. The system includes a quantum security device 100, a base station 200, an authentication center 300 and a root key center 400. A second root key group is preset in the quantum security device 100, and a first root key group is preset in the root key center 400. The first root key group is the same as the second root key group.

[0084] The above-mentioned quantum security device 100 includes at least a quantum encryption and decryption device based on quantum encryption and decryption technology and an external communication interface to realize quantum secure communication, such as the quantum terminal mentioned in the patent application document with Chinese patent application number CN201611255339.1;

[0085] The root key group in the quantum security device 100 and the root key center 400 is composed of multiple quantum keys, which can be specifically a security key generated by a quantum key distribution device, with a "one-time one-key" that is unconditionally secure in principle, wherein the second root key group in the quantum security device 100 is preset at the factory; the root key center 400 usually stores multiple root key groups of quantum security devices 100, and in actual applications, the storage location of the corresponding root key group can be determined according to the device ID of the quantum security device 100;

[0086] The quantum security device 100 is used to obtain the base station IP address, and send access request information to the base station 200 according to the base station IP address, and the access request information carries the device ID;

[0087] The base station 200 is used to receive the access request information, send the device ID to the authentication center 300, and receive the first access authentication result information from the authentication center 300, and when the first access authentication result information is identified as successful authentication, allow the quantum security device 100 to access the base station 200;

[0088] The authentication center 300 is used to receive the device ID and generate first access authentication result information for sending to the base station 200. The first access authentication result information is generated according to whether the device ID is in the security device list of the authentication center 300. If the device ID is in the security device list of the authentication center 300, the generated first access authentication result information is marked as successful authentication. Otherwise, the generated first access authentication result information is marked as failed authentication.

[0089] When the base station 200 needs to synchronize the root key group for key relay service, the quantum security device 100 is also used to generate a first message to be sent to the root key center 400, wherein the first message includes a first random number; obtain a second message generated by the root key center 400, wherein the second message includes a first key index, a first ciphertext, and a second ciphertext, determine the first key in the preset second root key group according to the first key index, decrypt the first ciphertext to obtain a first plaintext, decrypt the second ciphertext to obtain a second plaintext, verify whether the first plaintext is the same as the first random number and generate first authentication information, and select any other one from the preset second root key group as the second key, generate a second key index corresponding to the second key, encrypt the second plaintext by the second key to generate a third ciphertext, and send the first authentication information, the second key index and the third ciphertext to the root key center 400;

[0090] The first random number and the second random number are both generated by a quantum random number generator to ensure that they cannot be predicted or known by a third party. The quantum random number generator may be a true random number generator as described in the Chinese patent application number CN.201410478930.8. The quantum security device 100, the root key center 400, and the base station 200 each have a quantum random number generator. The first random number is obtained by the quantum security device 100 through its local quantum random number generator, and the second random number is obtained by the root key center 400 through its local quantum random number generator.

[0091] The root key center 400 is used to receive the first message and generate a second message for sending to the quantum security device 100; wherein the second message includes a first ciphertext obtained by encrypting a first random number with the first key, a second ciphertext obtained by encrypting a second random number generated by the root key center 400, and a first key index corresponding to the first key, by arbitrarily selecting one from the preset first root key group as the first key by the root key center 400; and then receiving the first authentication information, the second key index and the third ciphertext, determining the decryption key in the preset first root key group according to the second key index to decrypt the third ciphertext, and verifying the first authentication information. Verify whether the decrypted third ciphertext is the same as the second random number, generate second authentication information based on the verification result and the first authentication information, and send the second authentication information to the base station 200; wherein, when the verification result and the first authentication information are both marked as the same, the second authentication information is marked as authentication passed; when the first authentication information is marked as failed, it is not necessary to verify the third ciphertext later to save program steps; the first authentication information is marked as failed, indicating that the authentication between the quantum security device 100 and the root key center 400 has not passed, and the base station 200 will not perform further key download operations;

[0092] The base station 200 is used to receive the second authentication information, and when the second authentication information indicates that the authentication is passed, download the first root key group from the root key center 400, and send the acquisition result information of the first root key group to the quantum security device 100; in the process of interaction between the above-mentioned quantum security device 100 and the root key center 400, the base station 200 is also used to transmit key data between the quantum security device 100 and the root key center 400, and the key data includes one or more of the first message, the second message, the first authentication information, the second key index and the third ciphertext.

[0093] After both the quantum security device 100 and the root key center 400 have successfully verified the random numbers generated by themselves, the generated second authentication information is marked as authentication passed, and the base station 200 is allowed to download the first root key group from the root key center 400;

[0094] The random number generated in the above-mentioned authentication process is obtained by both parties from the inside in real time, and the outside world cannot know it in advance, and it is difficult to counterfeit it; the encryption key is selected from the pre-configured root key group, and it is difficult for external insecure devices to directly obtain the root key group information. Only the index of the encryption key is transmitted during the authentication process. Even if it is obtained externally, it will not cause the key to be leaked, and thus it is impossible to decrypt and verify the generated random number with the correct key in the subsequent authentication process; therefore, by generating random numbers combined with the mutual encryption and decryption verification between the two parties, as well as the dual authentication of the quantum security device 100 and the root key center 400, the security and reliability of synchronizing the root key group between the base station 200 and the root key center 400 can be greatly improved.

[0095] In the scenario where the quantum security device 100 is disconnected from the base station 200 and subsequently accesses the base station 200 again, the quantum security device 100 is also used to obtain the base station IP, and send an access request to the base station according to the base station IP; and obtain the current network access ID and the third random number to be sent to the base station 200; receive a third message from the base station 200, the third message including any one selected by the base station 200 from the downloaded first root key group as the third key, a fourth ciphertext obtained by encrypting the third random number with the third key, a fifth ciphertext obtained by encrypting the fourth random number generated by the base station 200, and a third key index corresponding to the third key generated by the base station 200;

[0096] The quantum security device 100 determines the decryption key from the second root key group according to the third key index, decrypts the fourth ciphertext to obtain the fourth plaintext, decrypts the fifth ciphertext to obtain the fifth plaintext, verifies whether the fourth plaintext is the same as the third random number, and generates the third authentication information for sending to the base station 200 based on the verification result; selects any other one from the preset second root key group as the fourth key, generates the fourth key index corresponding to the fourth key, encrypts the fifth plaintext to form the sixth ciphertext, and sends the fourth key index, the sixth ciphertext and the third authentication information to the base station 200; receives the updated network access ID from the base station 200, replaces the current network access ID with the updated network access ID, and accesses the base station 200 by updating the network access ID;

[0097] The above-mentioned quantum security device 100 obtains the base station IP in a manner that can be specifically obtained through the base station external network server 500, which is used to receive a base station request message from the quantum security device 100 and return the base station IP address according to the base station request message; the current network access ID in this scenario is assigned to it by the base station 200 when the quantum security device 100 first accesses the base station 200; the acquisition method and type of the third random number and the fourth random number are the same as the above-mentioned first random number and the second random number, which will not be repeated here;

[0098] The base station 200 is also used to receive the current network access ID and the third random number, determine the storage location of the downloaded root key according to the current network access ID, and generate a third message for sending to the quantum security device 100; receive the fourth key index, the sixth ciphertext and the third authentication information; determine the decryption key from the downloaded root key group according to the fourth key index, decrypt the sixth ciphertext to obtain the sixth plaintext, verify whether the sixth plaintext is the same as the fourth random number, and when the verification result and the third authentication information are both marked as the same, allow the quantum security device 100 to access and carry the updated network access ID reallocated by the base station to the quantum security device 100; that is, when the quantum security device 100 accesses the base station 200 again, the base station 200 will reallocate the network access ID to the quantum security device 100, and the quantum security device 100 will re-access the base station 200 through the newly allocated network access ID.

[0099] Since a connection has been established between the quantum security device 100 and the root key center 400, the previously connected base station 200 will synchronize the root key group corresponding to the quantum security device 100; at the same time, the base station 200 may be connected to more than one quantum security device 100, so the base station 200 will store root key groups corresponding to multiple quantum security devices 100, and each root key group can establish a corresponding relationship with the current network access ID of the quantum security device 100.

[0100] In the subsequent access process between the quantum security device 100 and the base station 200, both parties generate corresponding random numbers, and then use the root key in the preset root key group to encrypt the random numbers generated by each other, and verify whether their respective random numbers are the same and legal after decryption. The random numbers and encryption keys in this process are difficult to obtain in advance from the outside. Combined with the dual authentication of the quantum security device 100 and the base station 200, the security and reliability of the subsequent quantum security device 100 accessing the base station 200 again are greatly improved.

[0101] The root key center 400 is further configured to delete the first key corresponding to the first key index in the first root key group stored therein after sending the first key index to the quantum security device 100;

[0102] The quantum security device 100 is further configured to, after sending the second key index to the root key center, perform a deletion operation on the second key corresponding to the second key index in the second root key group stored therein, and after sending the fourth key index to the base station, perform a deletion operation on the fourth key corresponding to the fourth key index in the root key group stored therein;

[0103] The base station 200 is further configured to perform a deletion operation on the third key corresponding to the third key index in the first root key group downloaded by the base station 200 after sending the third key index to the quantum security device;

[0104] That is, the first key, the second key, the third key and the fourth key are deleted from the corresponding root key group after use, so as to avoid subsequent repeated use or leakage, thereby reducing security.

[0105] The system also includes a DNS server 600, which is used to receive an address query request from the quantum security device 100, and send the base station external network server IP address to the quantum security device 100 according to the address query request. The quantum security device 100 is also used to send a base station request message to the base station external network server 500 according to the base station external network server IP address; that is, when accessing the base station, you can also enter a domain name, resolve the domain name through the DNS server 600, return the base station external network server IP address to the quantum security device 100, and then perform subsequent operations, so as to facilitate users to use it flexibly according to their needs.

[0106] When the quantum security device 100 is connected to the base station 200 for the first time or is connected to the base station 200 again after being returned to the factory for reset, the following steps are specifically included: wherein the first random number is a random number s, and the second random number is a random number v;

[0107] S101: The quantum security device 100 sends an address query request to the DNS server 600;

[0108] S102: The DNS server 600 sends the base station external network server IP address to the quantum security device 100 according to the address query request;

[0109] S103: The quantum security device 100 sends a base station request message to the base station external network server 500 according to the base station external network server IP address;

[0110] S104: The base station external network server 500 receives the base station request message from the quantum security device 100, and returns the base station IP address according to the base station request message;

[0111] In steps S101-S104, the quantum security device 100 first finds the base station external network server 500 through the DNS server 600, and then obtains the IP address of the base station to be accessed through the base station external network server 500, wherein the interaction between the quantum security device 100 and the DNS server 600 is a non-essential link. In actual applications, it can also be accessed by directly entering the base station IP address;

[0112] S105: The quantum security device 100 receives the base station IP address, and sends an access request and a first message to the base station 200 according to the base station IP address, wherein the first message carries the device ID corresponding to the quantum security device 100 and a random number s obtained locally;

[0113] S106: The base station 200 receives the first message, and sends an authentication request message to the authentication center 300, carrying the device ID in the first message;

[0114] S107: The authentication center 300 receives the device ID, verifies whether it is in the list of security devices that can pass authentication based on the device ID, determines whether to allow the quantum security device 100 to access, and returns the first access authentication result information to the base station 200 based on the authentication result;

[0115] S108: The base station 200 receives the first access authentication result information from the authentication center 300. If the first access authentication result information indicates that the authentication is successful, the base station 200 sends the first message to the root key center 400. If the authentication result information indicates that the authentication fails, the base station 200 sends the first access authentication result information to the quantum security device 100.

[0116] S109: If the root key center 400 receives the first message from the base station 200, it determines the storage location of the corresponding root key group according to the device ID in the first message. If the root key group exists, it obtains a random number v from the local, selects one from the first root key group as the first key, encrypts the random number s with the first key to obtain the first ciphertext, encrypts the random number v to obtain the second ciphertext, generates the first key index corresponding to the first key to form the second message, and then sends the second message to the base station 200; if the root key group does not exist, it means that the authentication fails, generates the root key center authentication result information, and sends it to the base station 200;

[0117] S110: The base station 200 receives the second message and the root key center authentication result information from the root key center 400, and sends the second message and the root key center authentication result information to the quantum security device 100;

[0118] S111: The quantum security device 100 receives the second message and the root key center authentication result information. When the root key center 400 identifies the authentication result information as passed, the key used for decryption is determined in the preset second root key group according to the first key index, the first ciphertext is decrypted to form the first plaintext, the second ciphertext is decrypted to form the second plaintext, and the first plaintext is verified to be the same as its own random number s. Based on the verification result, the first authentication information is generated, and any other one is selected from the preset second root key group as the second key, a second key index corresponding to the second key is generated, and the second plaintext is encrypted by the second key to generate a third ciphertext, and the first authentication information, the second key index and the third ciphertext are sent to the base station 200;

[0119] When the root key center authentication result information indicates that it fails, the subsequent steps are not executed;

[0120] S112: The base station 200 receives the first authentication information, the second key index and the third ciphertext from the quantum security device 100, and sends the first authentication information, the second key index and the third ciphertext to the root key center 400;

[0121] S113: The root key center 400 receives the first authentication information, the second key index and the third ciphertext; determines the decryption key in the preset first root key group according to the second key index to decrypt the third ciphertext, and verifies whether the decrypted third ciphertext is the same as its own random number v, and generates the second authentication information based on the verification result and the first authentication information, and sends the second authentication information to the base station 200. If the root key center 400 indicates that the second authentication information is passed, the base station 200 is allowed to download the first root key group, otherwise, the base station 200 is refused to download the first root key group; wherein, when the verification result and the first authentication information are both marked as the same, the second authentication information is marked as authentication passed, otherwise the second authentication information is marked as authentication failed; this process further improves the security of the authentication process by means of double verification;

[0122] S114: The base station 200 receives the second authentication information from the root key center 400, and when the second authentication information indicates that the authentication is passed, downloads the first root key group from the root key center 400, and sends the first root key group acquisition result information to the quantum security device 100;

[0123] The quantum security device 100 receives the first root key group acquisition result information, and identifies whether the base station 200 has completed the root key synchronization operation with the root key center 400 through the first root key group acquisition result information.

[0124] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for quantum security device accessing a base station, characterized in that: The method comprises: The quantum security device obtains the base station IP address, and sends an access request message to the base station according to the base station IP address and carries the device ID; The base station receives the access request information and sends an authentication request information carrying the device ID to the verification end; The base station receives the first access authentication result information from the verification end, and when the first access authentication result information is identified as successful authentication, allows the quantum security device to access the base station; wherein the first access authentication result information is generated according to whether the device ID is in the security device list of the verification end, if the device ID is in the security device list of the verification end, the generated first access authentication result information is marked as successful authentication, otherwise, the generated first access authentication result information is marked as failed authentication; Before the quantum security device accesses the base station, the following operations are further performed: The root key center obtains a root key group to be distributed to the quantum security device, and distributes the root key group to the quantum security device; After the quantum security device is connected to the base station, the following operations are further performed: When the quantum security device sends access request information to the base station, the access request information also carries first verification information; The root key center receives the first verification information from the quantum security device, determines whether there is a root key group according to the device ID in the first verification information, and generates second verification information when the root key group exists; then selects one from the root key group of the root key center as the first key, encrypts the first verification information by the first key to form a first ciphertext, encrypts the second verification information to generate a second ciphertext, and then sends the first ciphertext, the second ciphertext and a first key index for determining the first key to the quantum security device; The quantum security device receives a first ciphertext, a second ciphertext, and a first key index, determines a first key according to the first key index to decrypt the first ciphertext and verifies whether it is the same as the first verification information, and when the verification result is the same, selects one from the root key group stored therein as a second key, encrypts the second verification information by the second key to form a third ciphertext, and sends the third ciphertext and a second key index for determining a second key to the base station, where the second key is different from the first key; The base station receives the third ciphertext and the second key index, and sends the third ciphertext and the second key index to the root key center; The root key center receives the third ciphertext and the second key index, determines the second key according to the second key index to decrypt the third ciphertext and verifies whether it is the same as the second verification information to generate root key center authentication result information, and sends the root key group storage location information corresponding to the quantum security device to the base station when the root key center authentication result information indicates that the authentication is passed; The base station receives the root key center authentication result information and the root key group storage location information, downloads the root key group corresponding to the quantum security device from the root key center according to the root key group storage location information, and returns the root key group acquisition result information to the quantum security device.

2. The method for accessing a quantum security device to a base station according to claim 1, characterized in that: The method for the quantum security device to obtain the IP address of the base station includes: The quantum security device sends a base station request message to the base station external network server; The base station external network server receives the base station request message, allocates a base station to the quantum security device according to the access status and load status of the current base station, and returns the base station IP address corresponding to the base station to the quantum security device.

3. The method for accessing a quantum security device to a base station according to claim 1, characterized in that: The first verification information includes a first random number generated by the quantum security device, and the second verification information includes a second random number generated by the root key center.

4. The method for accessing a quantum security device to a base station according to claim 3, characterized in that: The first random number and the second random number are both quantum true random numbers.

5. The method for accessing a quantum security device to a base station according to claim 1, characterized in that: After identifying that the first access authentication result information is successful authentication, the base station also allocates a network access ID to the quantum security device.

6. A method for a quantum security device to access a base station, which is applied to a scenario where a quantum security device is disconnected from a base station and then accesses the base station again, and is characterized in that: The method comprises: The quantum security device sends an access request message to the base station again according to the base station IP address, where the access request message carries a device ID, a current network access ID and third verification information; The base station sends authentication request information to the authentication center again, and the base station determines whether the current network access ID exists in the allocation record of the base station, and generates an updated network access ID for the quantum security device when the network access ID exists in the allocation record; The authentication center determines whether the device ID is in the security device list according to the device ID in the access request information to generate non-first access authentication result information, and returns the non-first access authentication result information to the base station; If the base station identifies that the non-first access authentication result information is a successful authentication, the base station generates fourth verification information, searches for a root key group stored in the base station according to the received device ID, selects one from the root key group stored in the base station as a third key, encrypts the third verification information by the third key to form a fourth ciphertext, encrypts the fourth verification information to generate a fifth ciphertext, and then generates a third key index corresponding to the third key; sends the fourth ciphertext, the fifth ciphertext and the third key index to the quantum security device; The quantum security device receives the fourth ciphertext, the fifth ciphertext and the third key index, determines the third key in the root key group stored in the quantum security device according to the third key index to decrypt the fourth ciphertext and verify whether it is the same as the third verification information to generate first verification result information, and when the first verification result information is marked as the same, selects one from the root key group stored therein as the fourth key, generates a fourth key index corresponding to the fourth key, encrypts the fourth verification information by the fourth key to form a sixth ciphertext, and sends the sixth ciphertext and the fourth key index to the base station, where the fourth key is different from the third key; The base station receives the sixth ciphertext and the fourth key index, determines the fourth key in the root key group stored in the base station according to the fourth key index to decrypt the sixth ciphertext and verifies whether it is the same as the fourth verification information to generate second verification result information, and sends an access completion message to the quantum security device when the second verification result information is identified as the same, and the access completion message carries an updated network access ID; The quantum security device receives the access completion message and connects to the base station through the updated network access ID in the access completion message; The third verification information includes a third random number generated by the quantum security device, and the fourth verification information includes a fourth random number generated by the base station; and both the third random number and the fourth random number are quantum true random numbers.

7. A system based on the method of quantum security device accessing a base station according to claim 1, characterized in that: The system includes a quantum security device, a base station and an authentication center; The quantum security device is used to obtain the base station IP address, and send access request information to the base station according to the base station IP address, wherein the access request information carries a device ID; The base station is used to receive the access request information, send the device ID to the authentication center, and receive the first access authentication result information from the authentication center, and when the first access authentication result information is identified as successful authentication, allow the quantum security device to access the base station; The authentication center is used to receive a device ID from a base station and generate first-access authentication result information for sending to the base station, wherein the first-access authentication result information is generated according to whether the device ID is in a security device list of the authentication center. If the device ID is in the security device list of the authentication center, the generated first-access authentication result information is marked as a successful authentication; otherwise, the generated first-access authentication result information is marked as a failed authentication.

8. The system according to claim 7, characterized in that: The system also includes a base station external network server and a DNS server; The base station external network server is used to receive a base station request message from a quantum security device, and allocate a base station to the quantum security device according to the access status and load status of the current base station, and return the base station IP address corresponding to the base station; The DNS server is used to receive an address query request from the quantum security device, and send the base station external network server IP address to the quantum security device according to the address query request; The quantum security device is also used to receive the IP address of the base station external network server and connect to the base station external network server according to the IP address of the base station external network server.

Images