A quantum key distribution management method and system

Abstract

The present invention discloses a quantum key distribution management method and system, which specifically relates to the field of information security. User KU1 sends a session request with KU2 to KUn to a management system platform KS, and the management system platform KS submits the request sent by KU1 to a key generation control and management platform KMC; the key generation control and management platform KMC matches KU1 to KUn through the request, forms a user pair and puts it into a user pair list in the management system platform KS, and forms an updated user pair list; the management system platform KS distributes keys according to the updated user pair list, and provides keys to user KU1. The management system platform KS uniformly controls the generation of a communication user list, and the key generation control and management platform KMC uniformly generates communication keys. It is not necessary to require all users KU participating in the communication to confirm when the communication is confirmed. On the one hand, the quantum key distribution process is shortened; on the other hand, keys can also be provided to multiple users KU at the same time.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically, to a quantum key distribution management method and system. Background Art

[0002] External files involve secure transmission. The pseudo-random or random keys used in traditional encryption methods are predictable and difficult to resist quantum attacks. There is a risk of being cracked, which will lead to the theft of external files and the risk of leaks. In particular, since quantum computers are about to be launched, with a computing power trillions of times higher than that of existing computers, external files encrypted using traditional encryption are at risk of being cracked at any time.

[0003] During the quantum key distribution process, its security is guaranteed by quantum mechanics, and it is secure against eavesdropping and deciphering. Quantum key distribution also solves the problem of the difficulty of traditional symmetric key distribution and the inability to prove the security of asymmetric keys.

[0004] In the process of quantum key distribution, the management steps of key distribution are relatively cumbersome. The existing Chinese patent number is CN201510910928.8, which introduces a management method and system for dynamic distribution of quantum keys. It matches users through the communication ends KU1 and KU2 respectively sending corresponding communication requests to the key service agents KA1 and KA2. KA1 and KA2 distribute keys according to the updated user pair list, and provide keys to KU1 and KU2 respectively; KU1 and KU2 use the obtained keys for data encryption communication. However, the above method requires both users to confirm the communication, and the steps are still relatively cumbersome; and it is only applicable to communication between two ends. When multiple ends communicate at the same time, due to the large number of user ends involved, this method is difficult to pair at the same time. Therefore, the above management method still has certain defects and it is difficult to manage key distribution efficiently. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a quantum key distribution management method and system, which uniformly controls the generation of a communication user list through a management system platform KS, and uniformly generates communication keys using a key generation control and management platform KMC, thereby eliminating the need to require all users KU participating in the communication to confirm when confirming the communication, thereby solving the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A quantum key distribution management method comprises the following steps:

[0008] Step S101, user KU1 sends a request to the management system platform KS to apply for communicating with KU2-KUn using a key;

[0009] Step S102, the management system platform KS submits the request sent by KU1 to the key generation control and management platform KMC;

[0010] Step S103: The key generation control and management platform KMC matches KU1 to KUn through the request to form user pairs and put them into the user pair list in the management system platform KS to form an updated user pair list;

[0011] Step S104, the management system platform KS distributes keys according to the updated user pair list, and provides the key to the user KU1;

[0012] Step S105: User KUx sends a request to the management system platform KS to apply for communication with users KU1-KU(x-1), KU(x+1)-KUn using a key;

[0013] Step S106, the management system platform KS distributes keys according to the updated user pair list and provides keys to the user KUx;

[0014] Among them, n≥2,1<x≤n.

[0015] In a preferred embodiment, the user KU1 is the first user who requests to perform encrypted communication with the relevant user.

[0016] In a preferred embodiment, if n users KU apply for encrypted communication, when two or more of them receive the key, the encrypted communication starts immediately without waiting for all users KU to apply before starting the communication; other users KU will automatically join the encrypted communication after applying later;

[0017] Among them, n>2.

[0018] In a preferred embodiment, when conducting multi-user encrypted communication, the user pair information submitted by user KU to the management system platform KS must be the same as that submitted by KU1. If the user pair information requested by one of the users is inconsistent with KU1, it cannot join the multi-user communication. If the user pair information in its request does not exist in the management system platform KS, the user pair list will be updated through the key generation control and management platform KMC.

[0019] In a preferred embodiment, after step S106, step S107 is further included:

[0020] The management system platform KS sets an expiration time. When user KU1 applies for encrypted communication from KUn and user KU1 obtains the communication key, if the management system platform KS waiting time exceeds the expiration time, the communication key will become invalid. When user KU applies subsequently, the management system platform KS will provide user KU with a new communication key for encrypted communication.

[0021] In a preferred embodiment, after step S101, the management system platform KS performs identity determination on the user KU1, and the determination steps are as follows:

[0022] Step S201, determine whether the user KU1 is a user of this system, if not, terminate the communication request, if yes, proceed to step S202;

[0023] Step S202, determine whether the device used by user KU1 is legal, if not, terminate the communication request, if yes, proceed to step S102.

[0024] In a preferred embodiment, in step S103, the key generation control and management platform KMC will determine whether other users in the user information are members of the system. If the user information contains users who do not meet the corresponding conditions, an error will be reported and the communication request will be terminated.

[0025] In a preferred embodiment, in step S105, when multiple users apply for communication, if the management system platform KS has previously updated the user pair list for the multiple users, there is no need to re-determine the user information through the key generation control and management platform KMC, and the new key generated by the key generation control and management platform KMC can be directly distributed using the previous user pair information.

[0026] A quantum key distribution management system, comprising a server and a plurality of user terminals, wherein the server comprises a management system platform KS and a key generation control and management platform KMC;

[0027] The management system platform KS is the control center of the user terminal and the key generation control and management platform KMC, which is used to send the communication request submitted by the received user terminal to the key generation control and management platform KMC, and update the user pair list according to the feedback of the key generation control and management platform KMC, and distribute the key generated by the key generation control and management platform KMC to each user terminal;

[0028] The key generation control and management platform KMC is used to generate and return key information according to the communication request of the management system platform KS, thereby providing keys for encrypted communication;

[0029] The user terminal is used to initiate a communication request and perform encrypted communication.

[0030] In a preferred embodiment, the user terminal sends and receives information with the server according to dedicated hardware; the dedicated hardware is a TF card, a security chip, a U shield, etc.

[0031] Technical effects and advantages of the present invention:

[0032] The present invention generates a communication user list through a management system platform KS and uses a key generation control and management platform KMC to uniformly generate communication keys, thereby eliminating the need to require all users KU participating in the communication to confirm when confirming the communication. On the one hand, this shortens the quantum key distribution process and improves the distribution rate; on the other hand, it can also provide keys to multiple users KU at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flow chart of a quantum key distribution management method of the present invention;

[0034] Figure 2 This is a key distribution principle diagram when the number of encrypted communication user terminals of the present invention is two;

[0035] Figure 3 This is a key distribution principle diagram when the number of encrypted communication user terminals of the present invention is greater than two;

[0036] Figure 4 This is a quantum key distribution management service flow chart of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] Since the embodiments of the present application involve quantum key generation and quantum key distribution, for ease of understanding, the following first introduces the relevant terms and concepts involved in the embodiments of the present application:

[0039] KU: user, KU1 is user 1, and so on, KUn is user n;

[0040] KS: Management system platform, i.e. management backend;

[0041] KMC: Key generation control and management platform, that is, a platform for generating and managing keys.

[0042] Example 1

[0043] The present invention provides a quantum key distribution management method, which generates a communication user list through a management system platform KS and uniformly controls the generation of a communication key using a key generation control and management platform KMC, thereby eliminating the need to require all users KU participating in the communication to confirm when confirming the communication. On the one hand, the quantum key distribution process is shortened and the distribution rate is increased; on the other hand, keys can be provided to multiple users KU at the same time.

[0044] Specifically, Figure 1 As shown, the following steps are included:

[0045] Step S101: User KU1 sends a request to the management system platform KS to apply for communication with KU2-KUn using a key.

[0046] Step S102: The management system platform KS submits the request sent by KU1 to the key generation control and management platform KMC.

[0047] Step S103: The key generation control and management platform KMC matches KU1 to KUn through the request to form user pairs and put them into the user pair list in the management system platform KS to form an updated user pair list.

[0048] Step S104: The management system platform KS distributes keys according to the updated user pair list and provides the keys to the user KU1.

[0049] Step S105: User KUx sends a request to the management system platform KS to apply for communication with users KU1-KU(x-1), KU(x+1)-KUn using a key;

[0050] Step S106, the management system platform KS distributes keys according to the updated user pair list and provides keys to the user KUx;

[0051] Among them, n≥2,1<x≤n.

[0052] In the above steps, user KU1 is the first user who requests to perform encrypted communication with the relevant user.

[0053] like Figure 2As shown, when the number of user terminals that need encrypted communication is 2, that is, n=2 in KUn, that is, KU1 and KU2 perform dual-end encrypted communication. Among them, KU1 can refer to any one of the two users. At this time, user KU1 sends a request to the management system platform KS to apply for encrypted communication with KU2 using a key. KS submits a request to KMC. When KMC passes the request, KU1 and KU2 are matched to form a user pair and put into the user pair list in the management system platform KS to form an updated user pair list. Since KU1 has already applied for encrypted communication in the above process, KS distributes keys according to the updated user pair list and provides keys to user KU1. When KU2 sends a request to the management system platform KS to apply for communication with KU1 using a key, since it is the same as KU1's previous application, KS already has a relevant user pair list inside, and there is no need to submit a request to KMC at this time. KS can directly provide the same key as previously provided to KU1 to user KU2 based on the existing user pair list, thereby completing encrypted communication.

[0054] In this way, through the unified control of the management system platform KS and the key generation control and management platform KMC, there is no need for double confirmation by KU1 and KU2. Only one party needs to make a communication request to KS to form a user pair list for encrypted communication. When the other party makes a request, it can directly call the user pair list to provide the same key to complete the encrypted communication.

[0055] like Figure 3 As shown, when the number of user terminals that need encrypted communication is greater than 2, that is, n>2 in KUn, that is, multiple users KU1 to KUn perform multi-terminal encrypted communication. Among them, KU1 can refer to any one of the multiple users. At this time, user KU1 sends a request to the management system platform KS to apply for communication with KU2-KUn using a key. KS submits a request to KMC. When KMC passes the request, KU1 to KUn are matched to form a user pair and put into the user pair list in the management system platform KS to form an updated user pair list. Since KU1 has already applied for encrypted communication in the above process, KS distributes keys according to the updated user pair list and provides keys to user KU1. When KU1 to KUn send a request to the management system platform KS to apply for communication with KU1 using a key, since it is the same as KU1's previous application, KS already has a relevant user pair list inside, and there is no need to submit a request to KMC at this time. KS can directly provide users KU1 to KUn with the same key as previously provided to KU1 based on the existing user pair list, thereby completing encrypted communication.

[0056] In this way, through the unified control of the management system platform KS and the key generation control and management platform KMC, when multiple users KU confirm encrypted communication, there is no need for confirmation by all parties. Only any one of the users KU (represented by KU1) needs to make a communication request to KS with other users to form a user pair list of all users for encrypted communication. When any other party makes a subsequent communication request, it can directly call the user pair list established in KS after KU1's request, and provide the same key as KU1 to any other user KU to complete the encrypted communication.

[0057] It should be noted that when multiple users KU apply for encrypted communication, when two or more of them receive the key, the encrypted communication starts immediately, without waiting for all users KU to apply before starting the communication. Other users KU can automatically join the encrypted communication after applying later, without additional review, which ensures the smoothness and timeliness of encrypted communication.

[0058] In addition, when the present invention performs multi-user encrypted communication, the user pair information (i.e., the user information and quantity included in the communication request of the relevant users) proposed by user KU to KS must be the same as that proposed by KU1. If the user pair information requested by one of the users is inconsistent with that of KU1, it cannot join the multi-user communication. If the user pair information in its request does not exist in KS, the user pair list will be updated through KMC.

[0059] For example, when users KU1, KU2 and KU3 want to conduct encrypted communication, user KU1 sends a request to the management system platform KS to apply for the use of keys for encrypted communication with KU2 and KU3, and user KU2 sends a request to the management system platform KS to apply for the use of keys for encrypted communication with KU1 and KU3; user KU3 sends a request to the management system platform KS to apply for the use of keys for encrypted communication with KU1; at this time, user KU3 cannot obtain the communication key between KU1, KU2 and KU3, that is, cannot join the three-party communication; and KS judges the request made by user KU3. If the user pair information of KU1 and KU3 does not exist in KS, the user pair list will be updated through KMC.

[0060] Furthermore, the present invention also includes step S107 after step S106. Specifically, the management system platform KS is set with an expiration time. When KU1 applies for encrypted communication from KUn, after KU1 obtains the communication key, if the KS waiting time exceeds the expiration time, the communication key becomes invalid. When user KU applies subsequently, KS will provide user KU with a new communication key for encrypted communication.

[0061] Furthermore, the expiration time KS can be set according to actual conditions, for example, a fixed encrypted communication time can be set, and the encrypted communication can be interrupted after the time is exceeded; preconditions can also be added, specifically, when multiple users are communicating, the communication time is not included in the waiting time, that is, the waiting time of KS only calculates the invalid waiting time when no communication is carried out.

[0062] Example 2

[0063] The difference between the embodiment 2 of the present invention and the above embodiment is that in the above embodiment 1, the quantum key generation and distribution method is mainly introduced, but the identity determination method of each user is not introduced. For the security of quantum communication, this system needs to monitor the information of the user.

[0064] like Figure 4 The specific monitoring process is as follows:

[0065] After user KU1 sends a communication request to the management system platform KS (i.e. after step S101), the management system platform KS performs identity determination on user KU1. The determination steps are as follows:

[0066] Step S201, determine whether the user KU1 is a user of this system, if not, terminate the communication request, if yes, proceed to step S202.

[0067] Step S202, determine whether the device used by user KU1 is legal, if not, terminate the communication request, if yes, proceed to step S102.

[0068] Specifically, in step S201 and step S202, the identity is determined mainly by monitoring the status of the user who submitted the application in the system.

[0069] For example: whether the user verifies the device and account used by the mobile phone number, and if not registered, registers the account in the system; whether the user has paid the corresponding fees (daily rent, monthly rent, sub-rent, etc.) to activate the corresponding usage key, real-time key update service, etc.

[0070] At the same time, if Figure 4 As shown in the figure, when user KU sends a communication request to the management system platform KS, KS sends the request to KMC, and KMC will determine whether other users in the user pair information are members of the system, that is, whether they have registered and whether they have opened the corresponding service, etc., to avoid generating an invalid user pair list. If the user pair information contains users who do not meet the corresponding conditions, an error will be reported and the communication request will be terminated directly.

[0071] Further, such as Figure 4As shown in the figure, when multiple users apply for communication, if KS has previously updated the user pair list for these multiple users, there is no need to re-judge the user pair information through KMC, and the new key generated by KMC can be directly distributed using the previous user pair information. That is, the management system platform KS can ensure the long-term existence of user pair information, avoiding the tedious steps of repeatedly generating user pairs.

[0072] Example 3

[0073] The difference between Embodiment 3 of the present invention and the above-mentioned embodiments is that Embodiment 3 introduces a quantum key distribution management system, specifically, including a server and multiple user terminals, and the server includes a management system platform KS and a key generation control and management platform KMC.

[0074] The management system platform KS is the control center of the user terminal and the key generation control and management platform KMC, which is used to send the communication request submitted by the received user terminal to the key generation control and management platform KMC, and update the user pair list according to the feedback of the key generation control and management platform KMC, and distribute the key generated by the key generation control and management platform KMC to each user terminal.

[0075] The key generation control and management platform KMC is used to generate and return key information according to the communication request of the management system platform KS, thereby providing keys for encrypted communication.

[0076] The user terminal is used to initiate communication requests and perform encrypted communications. It sends and receives information with the server based on dedicated hardware such as TF cards, security chips, U shields, etc.

[0077] The outgoing files for communication in the present invention can be divided into: text files, picture files, audio files, video files, executable files, etc. That is, text, pictures, emoticons, recording files, audio calls, video calls, office files, etc. transmitted through the network. Support multiple types of communication.

[0078] Furthermore, according to the type of outgoing files, the management system platform KS of the present invention also supports the following processing functions:

[0079] View permissions (read-only, print, modify, number of reads, reading time);

[0080] The information will be burned after reading, and screenshots are prohibited when reading;

[0081] User viewing permissions are managed in layers, and data is isolated and controlled between departments.

[0082] The above embodiments of the present invention may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium may be a solid-state hard disk.

[0083] In the present application, "plurality" means two or more.

[0084] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0085] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0087] Secondly: In the drawings of the embodiments disclosed in the present invention, only the structures related to the embodiments disclosed in the present invention are involved, and other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of the present invention can be combined with each other;

[0088] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A quantum key distribution management method, characterized in that: The steps include: Step S101, user KU1 sends a request to the management system platform KS to apply for communicating with users KU2-KUn using a key; Step S102, the management system platform KS submits the request sent by KU1 to the key generation control and management platform KMC; Step S103: The key generation control and management platform KMC matches KU1 to KUn through the request to form user pairs and put them into the user pair list in the management system platform KS to form an updated user pair list; Step S104, the management system platform KS distributes keys according to the updated user pair list, and provides the key to the user KU1; Step S105: User KUx sends a request to the management system platform KS to apply for communication with users KU1-KU(x-1), KU(x+1)-KUn using a key; Step S106, the management system platform KS distributes keys according to the updated user pair list and provides keys to the user KUx; Among them, n≥2,1<x≤n; If m users KU apply for encrypted communication, when two or more of them receive the key, the encrypted communication starts immediately, without waiting for all users KU to apply before starting the communication; other users KU will automatically join the encrypted communication after applying later; Where m>2; When performing multi-user encrypted communication, the user pair information submitted by user KU to the management system platform KS must be the same as that submitted by KU1. If the user pair information requested by a certain user is inconsistent with KU1, it cannot join the multi-user communication. If the user pair information in its request does not exist in the management system platform KS, the user pair list will be updated through the key generation control and management platform KMC. After step S106, the process further includes step S107, in which the management system platform KS sets an expiration time. When user KU1 applies for encrypted communication from user KU1 to KUn and user KU1 obtains a communication key, if the management system platform KS waits for longer than the expiration time, the communication key becomes invalid. When user KU applies for a subsequent communication, the management system platform KS will provide user KU with a new communication key for encrypted communication. After step S101, the management system platform KS performs identity determination on the user KU1, and the determination steps are as follows: Step S201, determine whether the user KU1 is a user of this system, if not, terminate the communication request, if yes, proceed to step S202; Step S202, determine whether the device used by user KU1 is legal, if not, terminate the communication request, if yes, proceed to step S102.

2. A quantum key distribution management method according to claim 1, characterized in that: The user KU1 is the first user who requests to perform encrypted communication with the relevant user.

3. A quantum key distribution management method according to claim 1, characterized in that: In step S103, the key generation control and management platform KMC will determine whether other users in the user information are members of the system. If the user information contains users who do not meet the corresponding conditions, an error will be reported and the communication request will be terminated.

4. A quantum key distribution management method according to claim 2, characterized in that: In step S105, when multiple users apply for communication, if the management system platform KS has previously updated the user pair list for the multiple users, there is no need to re-determine the user information through the key generation control and management platform KMC, and the new key generated by the key generation control and management platform KMC can be directly used to distribute the previous user pair information.

5. A quantum key distribution management system, used to execute a quantum key distribution management method according to claim 1, characterized in that: It includes a server and multiple user terminals, wherein the server includes a management system platform KS and a key generation control and management platform KMC; The management system platform KS is the control center of the user terminal and the key generation control and management platform KMC, which is used to send the communication request submitted by the received user terminal to the key generation control and management platform KMC, and update the user pair list according to the feedback of the key generation control and management platform KMC, and distribute the key generated by the key generation control and management platform KMC to each user terminal; The key generation control and management platform KMC is used to generate and return key information according to the communication request of the management system platform KS, thereby providing keys for encrypted communication; The user terminal is used to initiate a communication request and perform encrypted communication.

6. A quantum key distribution management system according to claim 5, characterized in that: The user terminal sends and receives information with the server according to dedicated hardware; the dedicated hardware is a TF card or a security chip or a U shield.

Images