A method and system for quantum security device to change access base station

Abstract

The present invention discloses a method and system for quantum security equipment to change access base stations. In the method of the present application, when the quantum security equipment changes the first base station to be accessed to a second base station, the quantum security equipment first obtains the IP address of the second base station, and sends an access request to the second base station according to the IP address, wherein the access request carries a device ID, a network access ID and a first random number; and then sends the request to the first base station previously accessed, and the first base station selects one from a key set stored therein to encrypt the random number to form encrypted data, and the quantum security equipment decrypts the encrypted data to verify whether the decrypted encrypted data is the same as the random number generated by itself for authentication; the random number generated in the process is difficult for the outside world to generate and counterfeit, so it is difficult for a non-connected device to pass the authentication, thereby improving the security and reliability of subsequent base stations in synchronizing key sets in a simple and efficient manner.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for changing an access base station of a quantum security device. Background Art

[0002] Information security is a dynamic balance in the constant struggle between the attacker and the defender. Due to the importance of information and information infrastructure in modern society, information security plays an increasingly important role in the game of national interests. With the improvement of information security requirements, quantum encryption technology has gradually entered the public's field of vision, and better confidentiality protection can be achieved through quantum encryption technology.

[0003] For example, in quantum key encryption technology, the security key generated by quantum key distribution, in addition to the "one-time one-pad" encryption method which is unconditionally secure in principle, can also be combined with the classical symmetric encryption algorithm to take into account both security and communication speed.

[0004] Various quantum security devices developed based on the principles of quantum encryption technology have gradually been applied in many fields such as government networks, smart cities, big data centers, smart cars, rail transit, etc. During the installation process, quantum security devices need to communicate with external devices such as base stations, servers, and authentication centers. After the quantum security device is connected to the base station, further key synchronization and relay operations are required. Among them, how to authenticate the security of the quantum security device when the quantum security device changes the base station it has accessed to another base station, there is no mature solution in the relevant technology. If an unsafe device is connected to the network during the process of the quantum security device changing the access base station, it will bring serious security risks. Therefore, it is necessary to further improve the security of the quantum security device when changing the currently connected base station, as well as the reliability of the subsequent key transfer between the old base station and the new base station. Summary of the invention

[0005] In order to solve the above problems, the present invention discloses a method and system for changing the access base station of a quantum security device.

[0006] The present application provides a method for changing a base station to which a quantum security device is connected, which is applied to a scenario in which a quantum security device changes a base station to which it is connected from a first base station to a second base station, and the method includes:

[0007] The quantum security device obtains the IP address of the second base station, and sends an access request to the second base station according to the IP address, wherein the access request carries a device ID, a network access ID, and a first random number;

[0008] The second base station receives the access request and sends authentication request information carrying the device ID to the authentication terminal;

[0009] The authentication end receives the authentication request information, generates authentication result information according to the device ID carried in the authentication request information, and returns the authentication result information to the second base station;

[0010] The second base station receives the authentication result information, and determines whether to allow the quantum security device to switch from the first base station to the second base station according to the authentication result information.

[0011] Further, before the quantum security device is switched from the first base station to the second base station, the same key set is synchronized in the first base station and the quantum security device, and after the quantum security device is switched from the first base station to the second base station, the following operations are further performed:

[0012] The second base station sends a device ID and a first random number to the first base station;

[0013] The first base station searches and determines the key set according to the device ID, and generates a second random number when the key set exists, selects one from the key set in the first base station as the first key, encrypts the first random number by the first key to form the first encrypted data, encrypts the second random number to generate the second encrypted data, and then sends the first encrypted data, the second encrypted data and the first key identifier carrying the first key index information to the quantum security device through the second base station;

[0014] The quantum security device receives the first encrypted data, the second encrypted data and the first key identifier, determines the first key to decrypt the first encrypted data and verifies whether it is the same as the first random number according to the first key identifier, and determines the first key to decrypt the second encrypted data to obtain the second random number, and when the verification result is the same, selects one from the key set stored in the quantum security device as the second key, encrypts the second random number by the second key to form the third encrypted data, and sends the third encrypted data and the second key identifier carrying the second key index information to the second base station, where the second key is different from the first key;

[0015] The second base station receives the third encrypted data and the second key identifier, and sends the third encrypted data and the second key identifier to the first base station;

[0016] The first base station receives the third encrypted data and the second key identifier, determines the second key in the key set stored therein according to the second key identifier to decrypt the third encrypted data and verifies whether the second key is the same as the second random number to generate verification result information, and transmits the key set to the first base station when the verification result information indicates that the verification is passed;

[0017] The second base station sends key set acquisition result information to the quantum security device.

[0018] Furthermore, the quantum security device obtains the IP address of the second base station through the first base station.

[0019] The present application also provides a system for changing an access base station of a quantum security device, the system comprising a quantum security device, a first base station, an authentication center, and a second base station, wherein the quantum security device and the first base station are pre-installed with the same key set;

[0020] The first base station is used to send the IP address of the second base station to the quantum security device;

[0021] The quantum security device is used to receive the IP address, and send an access request to the second base station according to the IP address, wherein the access request carries a device ID, a network access ID and a first random number;

[0022] The second base station is used to receive the access request and send the device ID in the access request to the authentication center; receive the authentication result information from the authentication center, and determine whether to respond to the access request according to the authentication result information;

[0023] The authentication center is used to store the security device list, receive the device ID sent by the second base station, verify whether the device ID is in the security device list and generate authentication result information, and send the authentication result information to the second base station.

[0024] Further, the quantum security device is also used to generate a first random number for sending to the first base station, receive key data from the first base station, the key data carries the first encrypted data obtained by encrypting the first random number with the first key and the first key identifier for indicating the index position of the first key, and then determine the first key according to the first key identifier to decrypt the first encrypted data and verify whether it is the same as the first random number and generate the quantum security device verification result information for sending to the first base station;

[0025] The first base station is used to receive the first random number; generate key data for sending to the quantum security device; and receive quantum security device verification result information, and determine whether to allow the key set to be transmitted to the second base station according to the quantum security device verification result information.

[0026] Further, the first base station is also used to generate a second random number, encrypt the second random number with the first key to obtain second encrypted data; and receive a second key identifier and third encrypted data from the quantum security device, search the second key obtained in the key set stored in the first base station according to the second key identifier to decrypt the third encrypted data, verify whether the decrypted third encrypted data is the same as the second random number, and determine whether to allow the key set to be transmitted to the second base station based on the verification result and the received quantum security device verification result information; wherein, if the verification result and the received quantum security device verification result information are both marked as the same, the key set is allowed to be transmitted to the second base station, otherwise the key set is refused to be transmitted to the second base station;

[0027] The quantum security device is also used to receive second encrypted data, search for the first key obtained from the stored key set according to the first key identifier to decrypt the second encrypted data to obtain a second random number, then select another one from the stored key set as the second key, generate a second key identifier carrying index information of the second key, encrypt the second random number by the second key to generate third encrypted data, and send the second key identifier and the third encrypted data to the first base station.

[0028] Furthermore, the second base station is specifically used to transmit between the quantum security device and the first base station: a first random number, key data, verification result information, second encrypted data, a second key identifier and third encrypted data.

[0029] Furthermore, the quantum security device, the first base station and the second base station all have built-in true random number generators, the first random number is obtained by the quantum security device from its local true random number generator, and the second random number is obtained by the first base station from its local true random number generator.

[0030] Furthermore, the quantum security device is also used to send a device ID to the second base station; the second base station is also used to receive the device ID and send the device ID to the first base station; the first base station is also used to determine whether there is a corresponding key set in the quantum security device according to the device ID.

[0031] Compared with the prior art, the beneficial effects of the present invention are as follows: the method of the present application can enable the quantum security device to switch from the first base station to the second base station safely and quickly; the system of the present application includes a quantum security device, a first base station, an authentication center and a second base station; wherein after the quantum security device accesses the second base station, the quantum security device first obtains a local random number, and then sends it to the first base station previously accessed, the first base station selects one from its stored key set as the first key to encrypt the random number generated by the quantum security device to form encrypted data, and then returns to the quantum security device, the quantum security device determines the decryption key from its stored key set according to the key identifier, decrypts the above encrypted data and verifies whether it is the same as the random number generated by itself, thereby authenticating and certifying the key synchronization between the second base station and the first base station; the random number generated in the process is difficult for the outside world to generate and counterfeit it, the encryption key is selected from the key set synchronized between the quantum security device and the first base station, and when there is no corresponding relationship between the encryption keys of the two parties, the subsequent verification is difficult to pass, so it is difficult for the non-connected device to pass the authentication, thereby improving the security and reliability of the subsequent base station in synchronizing the key set in a simple and efficient way. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A timing diagram of a quantum security device changing an access base station in an embodiment of the present application;

[0033] Figure 2 A system block diagram of a quantum security device in an embodiment of the present application changing an access base station;

[0034] Figure 3 A schematic diagram of a process of changing an access base station of a quantum security device in an embodiment of the present application;

[0035] Figure 4 This is a schematic diagram of a process of changing the access base station of another quantum security device in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0037] Embodiment 1: A method for a quantum security device to change an access base station is applied to a scenario where a quantum security device changes an access base station from a first base station to a second base station, the method comprising:

[0038] The quantum security device obtains the IP address of the second base station, and sends an access request to the second base station according to the IP address, wherein the access request carries the device ID, the network access ID and the first random number; in this step, when the quantum security device is preparing to switch from the first base station to the second base station, it sends the IP address of the second base station to be changed to the quantum security device through the first base station; in a possible implementation, the quantum security device can obtain the IP address of the second base station through the base station server. For example, the base station server can allocate the corresponding base station to the quantum security device according to the allocation strategy of the load and distance of each base station and send the IP address of the base station to the quantum security device. In addition, the IP address of the second base station can also be manually input; in order to improve the security of the transmission of the first random number, the first random number can be encrypted with a key before being sent. The specific encryption key can be the key synchronized between the quantum security device and the first base station;

[0039] The second base station receives the access request and sends authentication request information carrying the device ID to the authentication terminal;

[0040] The authentication end receives the authentication request information, generates authentication result information according to the device ID carried in the authentication request information, and returns the authentication result information to the second base station; the authentication end determines whether the device ID carried during the above authentication is in the security device list according to the security device list stored therein, if it is in the security device list, the generated authentication result information is marked as successful authentication, otherwise the generated authentication result information is marked as failed authentication;

[0041] The second base station receives the authentication result information, and determines whether to allow the quantum security device to switch from the first base station to the second base station according to the authentication result information, and specifically allows the quantum security device to access the second base station only when the authentication result information indicates that the authentication is successful.

[0042] Before the quantum security device is switched from the first base station to the second base station, the same key set is synchronized in the first base station and the quantum security device, and after the quantum security device is switched from the first base station to the second base station, the following operation is further performed:

[0043] The second base station sends a device ID and a first random number to the first base station;

[0044] The first base station searches and determines the key set according to the device ID, and generates a second random number when the key set exists, selects one from the key set in the first base station as the first key, encrypts the first random number by the first key to form the first encrypted data, encrypts the second random number to generate the second encrypted data, and then sends the first encrypted data, the second encrypted data and the first key identifier carrying the first key index information to the quantum security device through the second base station;

[0045] The quantum security device receives the first encrypted data, the second encrypted data and the first key identifier, determines the first key to decrypt the first encrypted data and verifies whether it is the same as the first random number according to the first key identifier, and determines the first key to decrypt the second encrypted data to obtain the second random number, and when the verification result is the same, selects one from the key set stored in the quantum security device as the second key, encrypts the second random number by the second key to form the third encrypted data, and sends the third encrypted data and the second key identifier carrying the second key index information to the second base station, wherein the second key is different from the first key to avoid the situation where the same key is used for repeated encryption verification;

[0046] The second base station receives the third encrypted data and the second key identifier, and sends the third encrypted data and the second key identifier to the first base station;

[0047] The first base station receives the third encrypted data and the second key identifier, determines the second key in the key set stored therein according to the second key identifier to decrypt the third encrypted data and verifies whether the second key is the same as the second random number to generate verification result information, and transmits the key set to the first base station when the verification result information indicates that the verification is passed;

[0048] The second base station sends key set acquisition result information to the quantum security device.

[0049] In the above process of selecting the first key and the second key, they can be selected in sequence, such as storage order or time order.

[0050] In this embodiment, when the quantum security device 100 changes the first base station 200 to be connected to the second base station 300, the following steps are specifically included: In this step, the generated first random number is recorded as random number A, and the generated second random number is recorded as random number B;

[0051] S101: The second base station 300 sends the IP address of the second base station 300 to the quantum security device 100;

[0052] S101: The quantum security device 100 sends an access request to the second base station 300 according to the IP address, wherein the access request carries a device ID, a network access ID, and a random number A obtained from a local true random number generator;

[0053] S102: The second base station 300 receives the access request and sends an authentication request message carrying the device ID to the authentication center 400;

[0054] S103: The authentication center 400 receives the authentication request information, verifies whether the device ID in the authentication request information is in the list of secure devices according to the authentication request information, and generates authentication result information, wherein if the device ID is in the list of secure devices, the generated authentication result information is marked as successful authentication, otherwise the generated authentication result information is marked as failed authentication; and returns the authentication result information to the second base station 300;

[0055] S104: The second base station 300 receives the authentication result information from the authentication center 400. If the authentication result information indicates that the authentication is successful, the quantum security device is allowed to access, and the device ID and the random number A are sent to the first base station 200; if the authentication result information indicates that the authentication fails, the authentication result information is sent to the quantum security device 100, and the access of the quantum security device 100 is rejected, and the subsequent steps are not executed;

[0056] S105: The first base station 200 receives the device ID and the random number A, searches for and determines the storage location of the corresponding key set according to the device ID, and if a key set exists, obtains a random number B from the local true random number generator, and selects any one from the key set found as the first key, encrypts the random number A by the first key to obtain the first encrypted data, encrypts the random number B by the first key to obtain the second encrypted data, and generates a first key identifier with the first key index information recorded, and then sends the first encrypted data, the second encrypted data and the first key identifier to the second base station 300; if it is determined that there is no corresponding key set for the device ID, it means that the authentication of the first base station 200 fails, and the first authentication information of the first base station is generated, and it is sent to the quantum security device 100 through the second base station 300;

[0057] S106: The second base station 300 receives the first encrypted data, the second encrypted data, and the first key identifier from the first base station 200, and sends the first encrypted data, the second encrypted data, and the first key identifier to the quantum security device 100;

[0058] S107: After receiving the first encrypted data, the second encrypted data, and the first key identifier, the quantum security device 100 determines the key for decryption in the key set stored therein according to the first key identifier, decrypts the first encrypted data to obtain the first plaintext, decrypts the second encrypted data to form the second plaintext, verifies whether the first plaintext is the same as its own random number A, and if the verification result is the same, selects any other one from the key set stored in the quantum security device 100 as the second key, generates a second key identifier carrying a second key index relationship, encrypts the second plaintext by the second key to generate third encrypted data, and sends the second key identifier and the third encrypted data to the second base station 300;

[0059] S108: The second base station 300 receives the second key identifier and the third encrypted data from the quantum security device 100, and sends the second key identifier and the third encrypted data to the first base station 200;

[0060] S109: The first base station 200 receives the second key identifier and the third encrypted data; determines the decryption key in the key set stored therein according to the second key identifier to decrypt the third encrypted data, and verifies whether the decrypted third encrypted data is the same as its own random number B, and transmits the key set corresponding to the quantum security device 100 to the second base station 300 if the verification result is the same, and refuses the second base station 300 to download the key set if the verification result is not the same;

[0061] S110: The second base station 300 sends key set acquisition result information to the quantum security device 100.

[0062] The key set acquisition result information is used to indicate whether the transmission of the key set between the second base station 300 and the first base station 200 is completed.

[0063] Embodiment 2: A system for changing a base station to which a quantum security device is connected is applied to a scenario in which a quantum security device first accesses a certain base station, performs key synchronization with the base station, and then changes the accessed base station to another base station; the system comprises a quantum security device, a first base station, an authentication center, and a second base station, wherein the quantum security device and the first base station are pre-installed with the same key set; wherein the first base station is a base station that the quantum security device has accessed, and the second base station is a base station that the quantum security device is about to access;

[0064] In this system, quantum security equipment mainly refers to equipment that uses quantum encryption technology for communication, which includes at least an external communication interface and a quantum encryption and decryption device for data encryption and decryption; for example, a network encryption machine based on quantum keys is provided in the patent document with Chinese patent application number CN.201020537240.2;

[0065] The key set is composed of multiple quantum keys for encryption or decryption, and the quantum keys are specifically generated by an existing quantum key generation device; when the remaining quantum keys of the key set are insufficient, they can be supplemented and updated through the corresponding key distribution device;

[0066] In actual use, the first base station usually stores multiple quantum security device key sets. When searching for the key set location, the storage location of the corresponding key set can be determined according to the device ID of the quantum security device;

[0067] The first base station is used to send the IP address of the second base station to the quantum security device;

[0068] The quantum security device is used to receive the IP address, and send an access request to the second base station according to the IP address, wherein the access request carries a device ID, a network access ID and a first random number;

[0069] The second base station is used to receive the access request and send the device ID in the access request to the authentication center; receive the authentication result information from the authentication center, and determine whether to respond to the access request according to the authentication result information;

[0070] The authentication center is used to store the security device list, receive the device ID sent by the second base station, verify whether the device ID is in the security device list and generate authentication result information, and send the authentication result information to the second base station.

[0071] In addition, the quantum security device is also used to generate a first random number for sending to the first base station, receive key data from the first base station, the key data carries the first encrypted data obtained by encrypting the first random number with a first key and a first key identifier for indicating the index position of the first key, and then determine the first key according to the first key identifier to decrypt the first encrypted data and verify whether it is the same as the first random number and generate a quantum security device verification result information for sending to the first base station;

[0072] Specifically, the quantum security device, the first base station and the second base station are all equipped with a true random number generator. The first random number is obtained by the quantum security device from its local true random number generator, and the second random number described below is obtained by the first base station from its local true random number generator. Both the first random number and the second random number can be generated in real time, and the random numbers generated each time are different and unpredictable. Among them, the true random number generator can be the true random number generator involved in the patent document with Chinese patent application number CN.201410478930.8.

[0073] The first base station is used to receive the first random number; generate key data for sending to the quantum security device; and receive the quantum security device verification result information, and determine whether to allow the key set to be transmitted to the second base station according to the quantum security device verification result information; wherein, if the plain text obtained after decryption of the first encrypted data is the same as the first random number, the above-mentioned quantum security device verification result information is marked as passed, otherwise the quantum security device verification result information is marked as failed; when the quantum security device verification result information is marked as passed, the first base station allows the key set to be transmitted to the second base station; otherwise, when the verification result information is marked as failed, the first base station refuses to transmit the key set to the second base station;

[0074] The random numbers generated in this process are completely random, and cannot be known in advance by the outside world, nor can they be counterfeited. The encryption key is selected from the key set synchronized between the quantum security device and the first base station. When there is no corresponding relationship between the encryption keys of the two parties, the subsequent quantum security device or the first base station cannot correctly decrypt and verify the random number, making subsequent verification difficult to pass, so it is difficult for non-connected devices to pass authentication; and during the authentication process, only the identifier of the encryption key, that is, the index information of the key, is transmitted. Even if it is leaked and obtained externally, it is difficult to determine the encryption key based on the key index information, thereby greatly improving the security and reliability of subsequent base stations downloading the synchronized key set.

[0075] The above process can also be seen in Figure 3 Flowchart of S201-S204 in FIG.

[0076] Embodiment 3: The difference from Embodiment 2 is to further improve the security of the corresponding key set in the second base station synchronization quantum security device during the change process of the quantum security device from the first base station to the second base station;

[0077] The first base station is further configured to generate a second random number, encrypt the second random number using the first key to obtain second encrypted data; and receive a second key identifier and third encrypted data from the quantum security device, search the second key obtained in the key set stored in the first base station according to the second key identifier to decrypt the third encrypted data, verify whether the decrypted third encrypted data is the same as the second random number, and determine whether to allow the key set to be transmitted to the second base station based on the verification result and the received quantum security device verification result information; wherein, if the verification result and the received quantum security device verification result information are both identified as the same, then the key set is allowed to be transmitted to the second base station, otherwise the key set is refused to be transmitted to the second base station;

[0078] The quantum security device is also used to receive second encrypted data, search the first key obtained from the stored key set according to the first key identifier to decrypt the second encrypted data to obtain a second random number, then select another one from the stored key set as the second key, generate a second key identifier carrying index information of the second key, encrypt the second random number by the second key to generate third encrypted data, and send the second key identifier and the third encrypted data to the first base station;

[0079] The second base station generates the second encrypted data with the quantum security device, and sends it to the first base station for secondary decryption verification through the first base station. Only when the verification result information of the quantum security device is marked as the same as the previous one, the key set is allowed to be transmitted to the second base station, otherwise the key set is refused to be transmitted to the second base station, thereby further improving the security and reliability of the first base station to the second base station through double verification;

[0080] In the above process, the second base station is specifically used to transmit between the quantum security device and the first base station: the first random number, the key data, the verification result information, the second encrypted data, the second key identifier and the third encrypted data.

[0081] The method for generating the second random number is the same as described in Example 2.

[0082] In addition, the quantum security device is also used to send a device ID to the second base station; the second base station is also used to receive the device ID and send the device ID to the first base station; the first base station is also used to determine whether there is a corresponding key set in the quantum security device according to the device ID; the second base station sends the device ID to the authentication center while sending the network access ID to the authentication center. When the authentication is successful, the authentication center records the network access ID of the quantum security device so that the service provider knows which base station the quantum security device is currently connected to.

[0083] After the first base station and the second base station complete the transmission of the key set, the first base station also performs a deletion operation on the key set corresponding to the quantum security device stored therein to prevent it from being obtained by other devices and increasing the risk of leakage.

[0084] The above process can also be seen in Figure 4 Flowchart of S301-S307 in FIG.

Claims

1. A method for changing a base station to be accessed by a quantum security device, which is applied to a scenario in which a quantum security device changes the base station to be accessed from a first base station to a second base station, and is characterized in that: The method comprises: The quantum security device obtains the IP address of the second base station, and sends an access request to the second base station according to the IP address, wherein the access request carries a device ID, a network access ID, and a first random number; The second base station receives the access request and sends authentication request information carrying the device ID to the authentication terminal; The authentication end receives the authentication request information, generates authentication result information according to the device ID carried in the authentication request information, and returns the authentication result information to the second base station; The second base station receives the authentication result information, and determines whether to allow the quantum security device to be switched from the first base station to the second base station according to the authentication result information; Before the quantum security device is switched from the first base station to the second base station, the same key set is synchronized in the first base station and the quantum security device. After the quantum security device is switched from the first base station to the second base station, the following operation is further performed: The second base station sends a device ID and a first random number to the first base station; The first base station searches and determines the key set according to the device ID, and generates a second random number when the key set exists, selects one from the key set in the first base station as the first key, encrypts the first random number by the first key to form the first encrypted data, encrypts the second random number to generate the second encrypted data, and then sends the first encrypted data, the second encrypted data and the first key identifier carrying the first key index information to the quantum security device through the second base station; The quantum security device receives the first encrypted data, the second encrypted data and the first key identifier, determines the first key to decrypt the first encrypted data and verifies whether it is the same as the first random number according to the first key identifier, and determines the first key to decrypt the second encrypted data to obtain the second random number, and when the verification result is the same, selects one from the key set stored in the quantum security device as the second key, encrypts the second random number by the second key to form the third encrypted data, and sends the third encrypted data and the second key identifier carrying the second key index information to the second base station, where the second key is different from the first key; The second base station receives the third encrypted data and the second key identifier, and sends the third encrypted data and the second key identifier to the first base station; The first base station receives the third encrypted data and the second key identifier, determines the second key in the key set stored therein according to the second key identifier to decrypt the third encrypted data and verifies whether the second key is the same as the second random number to generate verification result information, and transmits the key set to the second base station when the verification result information indicates that the verification is passed; The second base station sends key set acquisition result information to the quantum security device.

2. The method for changing the access base station of a quantum security device according to claim 1, characterized in that: The quantum security device obtains the IP address of the second base station through the base station server.

3. A system for changing the access base station of a quantum security device, characterized in that: The system comprises a quantum security device, a first base station, an authentication center and a second base station, wherein the quantum security device and the first base station are pre-installed with the same key set; The first base station is used to send the IP address of the second base station to the quantum security device; The quantum security device is used to receive the IP address, and send an access request to the second base station according to the IP address, wherein the access request carries a device ID, a network access ID and a first random number; The second base station is used to receive the access request and send the device ID in the access request to the authentication center; Receiving authentication result information from an authentication center, and determining whether to respond to the access request according to the authentication result information; The authentication center is used to store the security device list, receive the device ID sent by the second base station, verify whether the device ID is in the security device list and generate authentication result information, and send the authentication result information to the second base station; The quantum security device is further used to generate a first random number for sending to the first base station, receive key data from the first base station, the key data carrying first encrypted data obtained by encrypting the first random number with a first key and a first key identifier for indicating the index position of the first key, and then determine the first key according to the first key identifier to decrypt the first encrypted data and verify whether it is the same as the first random number and generate quantum security device verification result information for sending to the first base station; The first base station is used to receive the first random number; generate key data for sending to the quantum security device; and receiving quantum security device verification result information, and determining whether to allow the key set to be transmitted to the second base station according to the quantum security device verification result information; The first base station is further configured to generate a second random number, encrypt the second random number using the first key to obtain second encrypted data; and receive a second key identifier and third encrypted data from the quantum security device, search the second key obtained in the key set stored in the first base station according to the second key identifier to decrypt the third encrypted data, verify whether the decrypted third encrypted data is the same as the second random number, and determine whether to allow the key set to be transmitted to the second base station based on the verification result and the received quantum security device verification result information; wherein, if the verification result and the received quantum security device verification result information are both identified as the same, then the key set is allowed to be transmitted to the second base station, otherwise the key set is refused to be transmitted to the second base station; The quantum security device is further configured to receive second encrypted data, search the first key obtained from the stored key set according to the first key identifier to decrypt the second encrypted data to obtain a second random number, select another key from the stored key set as the second key, generate a second key identifier carrying index information of the second key, encrypt the second random number using the second key to generate third encrypted data, and send the second key identifier and the third encrypted data to the first base station. The second base station is specifically used to transmit between the quantum security device and the first base station: a first random number, key data, verification result information, second encrypted data, a second key identifier and third encrypted data; The quantum security device is further used to send a device ID to the second base station; the second base station is further used to receive the device ID and send the device ID to the first base station; the first base station is further used to determine whether there is a corresponding key set in the quantum security device according to the device ID.

4. The system for changing the access base station of a quantum security device according to claim 3 is characterized in that: The quantum security device, the first base station and the second base station are all equipped with a true random number generator. The first random number is obtained by the quantum security device from its local true random number generator, and the second random number is obtained by the first base station from its local true random number generator.

Images