A quantum secure key distribution method and system

Abstract

The present application discloses a quantum secure key distribution method and system. When the key center allocates a supplementary key to a quantum secure terminal, it also allocates an encryption key to the supplementary key. The key center can subsequently encrypt the supplementary key and send it to the quantum secure terminal based on the encryption key, so that the supplementary key is not transmitted in plain text during network transmission, avoiding security issues such as the theft of the supplementary key and tampering with the supplementary key, ensuring the security of the quantum secure key distribution process, and thus improving the security of subsequent quantum secure communications. The encryption key is encrypted and sent to ensure the security of the encryption key. In addition, there is no need for a dedicated optical fiber connection or a hardware system such as a transmitting device that controls free space, which reduces the cost and internal security risks of key distribution, avoids reducing the security of key distribution due to the security issues of the hardware system itself, and broadens the application scenarios of key distribution.

Description

Technical Field

[0001] The present application relates to the technical field of information security and quantum encryption technology, and in particular to a quantum secure key distribution method and system. Background Art

[0002] Security is an important evaluation indicator in communication networks, and cryptography provides a strong guarantee for secure communication. Traditional cryptography is based on the computational complexity of mathematical algorithms and cannot guarantee the absolute security of keys. Quantum cryptography uses the basic principles of quantum mechanics to ensure the absolute security of passwords: any measurement of a quantum system will interfere with the system. If a third party attempts to eavesdrop on the password, it must be measured in some way, and the measurement will bring about a perceptible anomaly, which will be known to both parties in the communication. This is one of the most important and unique properties of quantum cryptography. When eavesdropping occurs, the link can be cut off to ensure the security of communication.

[0003] In quantum encryption technology based on quantum cryptography, a "one-time one-pad" communication method can be used to ensure that data can be absolutely secure at the physical level, but this method consumes a large number of keys, making the number of unused keys stored in quantum security terminals less and less. Therefore, a reliable technology for distributing keys to quantum security terminals is urgently needed to supplement the keys of quantum security terminals.

[0004] In the related art, when the first identifier and the second identifier in the quantum key distribution request are the same metropolitan identifier, the first relay end establishes a quantum key distribution channel between the user end corresponding to the first identifier and the user end corresponding to the second identifier. When the first identifier and the second identifier are not the same metropolitan identifier, the second relay end establishes a quantum key distribution channel between the user end corresponding to the first identifier and the user end corresponding to the second identifier. The detection device is set in the first relay end and the second relay end to realize a quantum key distribution network based on untrusted relays. For this quantum key distribution method, it is realized through physical layer communication. Users need dedicated optical fiber connections or hardware systems such as free space transmitters to establish a quantum key distribution channel before they can distribute keys, which makes it lack the flexibility of security patches and system upgrades, reduces the security of key distribution, increases the cost of key distribution and internal security risks, and restricts many application scenarios. Summary of the invention

[0005] The present application provides a quantum secure key distribution method, device, system and medium for achieving reliable supplementation of keys.

[0006] In a first aspect, the present application provides a quantum security key distribution method, which is applied to a quantum security terminal, and the method includes:

[0007] Generate a key supplement request and send it to the quantum security base station;

[0008] Obtaining the allocation information and the encrypted encryption key sent by the quantum security base station, and decrypting the encrypted encryption key to obtain the encryption key; wherein the allocation information includes the address of the key center and the information of the supplementary key allocated to the quantum security terminal in the key center;

[0009] Sending a download request carrying information of the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal;

[0010] The received encrypted supplementary key is decrypted according to the encryption key to obtain the supplementary key, and key supplementation is performed according to the supplementary key.

[0011] In a second aspect, the present application also provides a quantum secure key distribution method, which is applied to a quantum secure base station, and the method includes:

[0012] Sending the key supplement request sent by the quantum security terminal to the key center, so that the key center allocates a supplement key to the quantum security terminal;

[0013] Sending distribution information and an encrypted encryption key to the quantum security terminal; wherein the distribution information and the encryption key are obtained from the key center, the distribution information includes the address of the key center, and information of the supplementary key allocated to the quantum security terminal in the key center, and the encryption key is used to encrypt the supplementary key.

[0014] In a third aspect, the present application also provides a quantum secure key distribution method, which is applied to a key center and includes:

[0015] Receiving a key supplement request sent by a quantum security base station; wherein the key supplement request is used to instruct the key center to allocate a key to the quantum security terminal;

[0016] Allocating a supplementary key to the quantum security terminal and determining an encryption key used to encrypt the supplementary key;

[0017] Sending the allocation information and the encryption key to the quantum secure base station; wherein the allocation information includes the address of the key center and the information of the supplementary key;

[0018] Receiving a download request carrying the information of the supplementary key sent by the quantum security terminal;

[0019] Based on the encryption key, the supplementary key is encrypted and sent to the quantum security terminal.

[0020] In a fourth aspect, the present application also provides a key management system, which includes a quantum security terminal that executes the method described in the first aspect, a quantum security base station that executes the method described in the second aspect, and a key center that executes the method described in the third aspect.

[0021] In a fifth aspect, the present application further provides a quantum security key distribution device, which is applied to a quantum security terminal, and the device includes:

[0022] A sending unit, used to generate a key supplement request and send it to a quantum security base station;

[0023] A receiving unit, configured to obtain the allocation information and the encrypted encryption key sent by the quantum security base station; wherein the allocation information includes the address of the key center and the information of the supplementary key allocated to the quantum security terminal in the key center;

[0024] A processing unit, configured to decrypt the encrypted encryption key to obtain the encryption key;

[0025] The sending unit is further configured to send a download request carrying information of the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal;

[0026] The receiving unit is further used to receive the encrypted supplementary key;

[0027] The processing unit is further configured to decrypt the received encrypted supplementary key according to the encryption key, obtain the supplementary key, and perform key supplementation according to the supplementary key.

[0028] In a sixth aspect, the present application further provides a quantum secure key distribution device, which is applied to a quantum secure base station, and the device includes:

[0029] A first sending module, configured to send a key supplement request sent by a quantum security terminal to a key center, so that the key center allocates a supplement key to the quantum security terminal;

[0030] The second sending module is used to send allocation information and an encrypted encryption key to the quantum security terminal; wherein the allocation information and the encryption key are obtained from the key center, the allocation information includes the address of the key center, and the information of the supplementary key allocated to the quantum security terminal in the key center, and the encryption key is used to encrypt the supplementary key.

[0031] In a seventh aspect, the present application further provides a quantum secure key distribution device, which is applied to a key center, and the device includes:

[0032] A second receiving module is used to receive a key supplement request sent by a quantum security base station; wherein the key supplement request is used to instruct the key center to allocate a key to the quantum security terminal;

[0033] A second processing module is used to allocate a supplementary key to the quantum security terminal and determine an encryption key used to encrypt the supplementary key;

[0034] A third sending module is used to send the allocation information and the encryption key to the quantum secure base station; wherein the allocation information includes the address of the key center and the information of the supplementary key;

[0035] The second receiving module is used to receive a download request carrying the information of the supplementary key sent by the quantum security terminal;

[0036] The second processing module is used to encrypt the supplementary key based on the encryption key;

[0037] The second sending module is used to send the encrypted supplementary key to the quantum security terminal.

[0038] In an eighth aspect, the present application also provides a quantum security terminal, which comprises at least a processor and a memory, and the processor is used to implement the steps of the quantum security key distribution method as described in the first aspect above when executing a computer program stored in the memory.

[0039] In the ninth aspect, the present application also provides a quantum secure base station, which includes at least a processor and a memory, and the processor is used to implement the steps of the quantum secure key distribution method described in the second aspect above when executing a computer program stored in the memory.

[0040] In the tenth aspect, the present application also provides a key center, which includes at least a processor and a memory, and the processor is used to implement the steps of the quantum secure key distribution method described in the third aspect above when executing a computer program stored in the memory.

[0041] In the eleventh aspect, the present application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the quantum secure key distribution method as described in the first aspect above, or implements the steps of the quantum secure key distribution method as described in the second aspect above, or implements the steps of the quantum secure key distribution method as described in the third aspect above.

[0042] In the twelfth aspect, the present application also provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the steps of the quantum secure key distribution method as described in the first aspect above, or to implement the steps of the quantum secure key distribution method as described in the second aspect above, or to implement the steps of the quantum secure key distribution method as described in the third aspect above.

[0043] The beneficial effects of this application are as follows:

[0044] 1. When the key center allocates a supplementary key to the quantum security terminal, it will also allocate an encryption key to the supplementary key. After receiving the download request from the quantum security terminal, the key center can encrypt the supplementary key and send it to the quantum security terminal according to the encryption key. This ensures that the supplementary key is not transmitted in plain text during network transmission, avoiding security issues such as the supplementary key being stolen or tampered with, thus ensuring the security of the quantum security key distribution process and improving the security of subsequent quantum security communications.

[0045] 2. Since the encryption key is also sent to the quantum security terminal by the quantum security base station in an encrypted manner, the security of the encryption key is guaranteed, and security issues such as the encryption key being stolen and tampered with are avoided, thereby improving the security of the subsequent decryption of the encrypted supplementary key based on the encryption key, further improving the security and stability of the quantum security key distribution process.

[0046] 3. No special optical fiber connection or hardware system such as the transmitter that controls free space is required, which reduces the cost and internal security risks of key distribution, avoids the security of key distribution being reduced due to the security issues of the hardware system itself, and expands the application scenarios of key distribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 A schematic diagram of a quantum secure key distribution process provided in an embodiment of the present application;

[0049] Figure 2 A schematic diagram of a quantum secure key distribution process provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of another quantum secure key distribution process provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of another quantum secure key distribution process provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of the structure of a key supplement system provided in an embodiment of the present application;

[0053] Figure 6 A schematic diagram of the specific workflow of the quantum secure key distribution system provided for this application;

[0054] Figure 7 A schematic diagram of the workflow of another quantum secure key distribution system provided for this application;

[0055] Figure 8 A schematic diagram of the structure of a key supplement device provided in an embodiment of the present application;

[0056] Fig. 9 A schematic diagram of the structure of another key supplement device provided in an embodiment of the present application;

[0057] Fig.10 A schematic diagram of the structure of another key supplement device provided in an embodiment of the present application;

[0058] Fig.11 A schematic diagram of the structure of a quantum security terminal provided in an embodiment of the present application;

[0059] Fig.12 A schematic diagram of the structure of another quantum security base station provided in an embodiment of the present application;

[0060] Fig.13 A schematic diagram of the structure of another key center provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0062] In order to achieve reliable supplementation of keys, the present application provides a quantum secure key distribution method, device, system and medium.

[0063] Embodiment 1:

[0064] Figure 1 A schematic diagram of a quantum secure key distribution process provided in an embodiment of the present application, the process includes:

[0065] S101: Generate a key supplement request and send it to the quantum security base station.

[0066] The quantum security key distribution method provided in the present application is applied to a quantum security terminal, which can be an intelligent device, such as a global quantum security device, an isolation area device, etc., or a server, such as an application server, a business server, etc.

[0067] In one example, a key is stored in the quantum security terminal, and the key can be used for quantum encryption and decryption, quantum hash verification, etc. In order to ensure the security of quantum secure communication, the key stored in the quantum security terminal will only be used once, and the key after use will be discarded, so that the unused key in the quantum security terminal will become less and less. Therefore, in this application, the quantum security terminal can supplement the stored key. Exemplarily, the quantum security terminal can generate a key supplement request according to a preset period or time point and send it to the quantum security base station to supplement the key stored in the quantum security terminal. In another exemplary embodiment, the quantum security terminal can also generate a key supplement request and send it to the quantum security base station when it is determined that the key in the quantum security terminal meets the preset supplement requirements to supplement the key stored in the quantum security terminal. In another exemplary embodiment, the quantum security terminal can also generate a key supplement request and send it to the quantum security base station after receiving the supplement key operation input by the user to supplement the key stored in the quantum security terminal.

[0068] The key supplement request includes the number of keys to be supplemented (supplement number). Optionally, the key supplement request may also include one or more of the following: the total data size of the keys to be supplemented, the length of the keys to be supplemented, etc.

[0069] After receiving the key supplement request, the quantum security base station can send the key supplement request to the key center to facilitate the key center to determine how to allocate a supplementary key to the quantum security terminal based on the information carried in the key supplement request.

[0070] In order to promptly notify the user of the supplementary key, in this application, when the quantum security terminal needs to supplement the key, a prompt message of the supplementary key can be output. Among them, the prompt message can be displayed on the display interface of the quantum security terminal in the form of text or pictures, or it can be broadcast in the form of audio. Multiple ways of outputting prompt information can also be combined at the same time, such as broadcasting prompt information in audio form and displaying prompt information in text form on the display interface at the same time.

[0071] The specific method of outputting the prompt information can be pre-set according to the user's preference, or can be selected according to the capabilities of the quantum security terminal. For example, some quantum security terminals do not have a display interface for displaying prompt information. For these quantum security terminals, when outputting prompt information, prompt information in audio form can be broadcast.

[0072] S102: Obtaining the allocation information sent by the quantum security base station and the encrypted encryption key, and decrypting the encrypted encryption key to obtain the encryption key; wherein the allocation information includes the address of the key center and the information of the supplementary key allocated to the quantum security terminal in the key center.

[0073] In the present application, the quantum security terminal can download a key (recorded as a supplementary key) from the key center. Based on this, after receiving the key supplement request sent by the quantum security terminal, the quantum security base station determines the key center that distributes the key to the quantum security terminal. Exemplarily, the quantum security base station can send a query request to the network management device. After receiving the query request, the network management device allocates a key center to the quantum security base station according to the load, working status and other allocation strategies of each key center, and sends the address of the allocated key center to the quantum security base station. For example, the network management device allocates the key center with the lowest load to the quantum security base station, and sends the address of the allocated key center to the quantum security base station. After the quantum security base station determines the key center, it sends the key supplement request to the key center so that the key center can allocate a key to the quantum security terminal based on the information carried in the key supplement request.

[0074] After the key center determines the supplementary key, the key center can generate allocation information according to the address of the key center and the information of the supplementary key allocated to the quantum security terminal, and send the allocation information to the quantum security base station, so that the allocation information is sent to the quantum security terminal through the quantum security base station.

[0075] The information of the supplementary key may include one or more of the following: a hash value of the supplementary key, a storage path of the supplementary key, a size of the supplementary key, an available state of the supplementary key, and a generation time of the supplementary key. The hash value of the supplementary key is obtained by performing a hash operation on the supplementary key.

[0076] In one example, after the quantum security base station obtains the allocation information, it can encrypt the allocation information and send it to the quantum security terminal, or it can send the allocation information directly to the quantum security terminal. For example, the quantum security base station can encrypt the allocation information through a pre-agreed classical encryption algorithm, such as a symmetric encryption algorithm (such as Data Encryption Standard (DES), Advanced Encryption Standard (AES), National Secret SM4, etc.) and an asymmetric encryption algorithm (such as RSA asymmetric encryption algorithm, Elliptic Curves Cryptography (ECC)), etc.). For another example, the quantum security base station can encrypt the allocation information through a quantum encryption algorithm, such as obtaining a key, and encrypting the allocation information according to the key and a pre-configured quantum encryption algorithm.

[0077] After the quantum security terminal obtains the allocation information, it can download the supplementary key from the key center according to the allocation information, and the supplementary key is transmitted to the quantum security terminal via the Internet, which makes the supplementary key very easy to be stolen during the transmission process, reducing the security of the supplementary key obtained by the quantum security terminal. Therefore, in this application, the key center can use an encrypted transmission method to transmit the supplementary key to the quantum security terminal, thereby ensuring the security of the supplementary key during the transmission process. For example, the key center can encrypt the supplementary key by a pre-agreed classical encryption algorithm, or by a quantum encryption algorithm, such as obtaining a key (referred to as an encryption key), and encrypting the supplementary key according to the encryption key and a pre-configured quantum encryption algorithm.

[0078] In order to facilitate the quantum security terminal to obtain the encrypted supplementary key and decrypt the encrypted supplementary key, in this application, the quantum security terminal needs to obtain a method for decrypting the encrypted supplementary key. Exemplarily, if the key center uses a quantum encryption algorithm to encrypt the supplementary key, the quantum security terminal needs to obtain the encryption key used to encrypt the supplementary key. Based on this, after determining the supplementary key assigned to the quantum security terminal, the key center can determine the encryption key used to encrypt the supplementary key, and send the encryption key to the quantum security base station, so that the encryption key is sent to the key center through the quantum security base station. Among them, the key center can send the allocation information and the encryption key to the quantum security base station successively, or it can send the allocation information and the encryption key to the quantum security base station at the same time. In the specific implementation process, it can be flexibly set according to actual needs, and no specific limitation is made here.

[0079] If the quantum security base station directly sends the encryption key to the quantum security terminal after obtaining the encryption key, the encryption key may still be tampered with, stolen, and other security issues during the transmission process, so that the subsequent quantum security terminal still cannot guarantee the security of the obtained supplementary key. Therefore, in the present application, the quantum security base station can also encrypt the encryption key and send it to the quantum security terminal through a preset encryption method. For example, the quantum security base station can encrypt the encryption key through a pre-agreed classical encryption algorithm, or it can encrypt the encryption key through a quantum encryption algorithm. Exemplarily, the quantum security base station can obtain the key paired with the quantum security terminal (referred to as the first key), encrypt the encryption key according to the first key and the preset quantum encryption algorithm, and send the encrypted encryption key to the quantum security terminal.

[0080] Among them, the quantum security base station can send the allocation information and the encryption key to the quantum security terminal successively, or can send the allocation information and the encryption key to the quantum security terminal at the same time. In the specific implementation process, it can be flexibly set according to actual needs, and no specific limitation is made here.

[0081] In one example, the obtaining the allocation information sent by the quantum secure base station and the encrypted encryption key includes:

[0082] Receiving a first encrypted ciphertext sent by the quantum secure base station and a first key index corresponding to the first encrypted ciphertext;

[0083] Determine a first key according to the first key index and a pre-stored key pool; the key pool stores keys and key indexes corresponding to the keys;

[0084] Decrypting the first encrypted ciphertext according to the first key to obtain the allocation information and encryption key information carried by the first encrypted ciphertext;

[0085] Sending an acquisition request carrying the information of the encryption key to the quantum security base station, so that the quantum security base station obtains the encryption key from the key center based on the information of the encryption key, and encrypts the encryption key and sends it to the quantum security terminal;

[0086] Receive the encrypted encryption key sent by the quantum security terminal.

[0087] The information of the encryption key includes one or more of the following: a hash value of the encryption key, a storage path of the encryption key, a size of the encryption key, an available state of the encryption key, and a generation time of the encryption key. The hash value of the encryption key is obtained by performing a hash operation on the encryption key.

[0088] After determining the supplementary key and the encryption key, the key center can determine the distribution information according to the information of the supplementary key, and then send the information of the encryption key and the distribution information to the quantum security base station. After the quantum security base station obtains the distribution information and the information of the encryption key, it obtains the information of the encryption key and the key paired with the quantum security terminal (recorded as the first key), and encrypts the distribution information and the information of the encryption key according to the first key and the preset quantum encryption algorithm to obtain the encrypted ciphertext (recorded as the first encrypted ciphertext). The key index corresponding to the first encrypted ciphertext and the first key (recorded as the first key index) is sent to the quantum security terminal. After the quantum security terminal obtains the first encrypted ciphertext and the first key index, it obtains the first key according to the first key index and the pre-saved key pool. According to the first key, the first encrypted ciphertext is decrypted to obtain the distribution information and the encryption key information. A request for obtaining the information of the encryption key is sent to the quantum security base station. After the quantum security base station obtains the acquisition request, it can send the acquisition request to the key center. After the key center obtains the acquisition request, it obtains the encryption key according to the information of the encryption key carried in the acquisition request and sends it to the quantum security base station. After the quantum security base station obtains the encryption key from the key center, it obtains the second key paired with the quantum security terminal, encrypts the encryption key according to the second key and a preset quantum encryption algorithm, obtains the encrypted encryption key, and sends the encrypted encryption key to the quantum security terminal.

[0089] In another example, after determining the supplementary key and the encryption key, the key center can determine the distribution information according to the information of the supplementary key, and then send the distribution information and the encryption key to the quantum security base station. After obtaining the distribution information and the encryption key, the quantum security base station can obtain the second key paired with the quantum security terminal, encrypt the encryption key according to the second key and a preset quantum encryption algorithm, obtain the encrypted encryption key, and send the encrypted encryption key and the distribution information to the quantum security terminal.

[0090] The quantum security terminal may also encrypt the distribution information according to the second key and a preset quantum encryption algorithm, obtain the encrypted distribution information, and send the encrypted distribution information and the encrypted encryption key to the quantum security terminal.

[0091] In the present application, after receiving the encrypted encryption key, the quantum security terminal can decrypt the encrypted encryption key and obtain the encryption key, thereby facilitating the quantum security terminal to decrypt the received encrypted supplementary key.

[0092] Taking the encrypted encryption key obtained by using a quantum encryption algorithm as an example, decrypting the encrypted encryption key to obtain the encryption key includes:

[0093] Obtaining a second key index corresponding to the encrypted encryption key;

[0094] Determine the second key according to the second key index and a pre-stored key pool; wherein the key pool stores the key and the key index corresponding to the key;

[0095] The encrypted encryption key is decrypted according to the second key to obtain the encryption key.

[0096] When encrypting an encryption key, the quantum security base station obtains the second key index corresponding to the second key used to encrypt the encryption key, and then sends the second key index and the encrypted encryption key to the quantum security terminal. After the quantum security terminal obtains the second key index and the encrypted encryption key, it can determine the second key according to the second key index and the pre-saved key pool. Then, according to the second key, the encrypted encryption key is decrypted to obtain the encryption key.

[0097] The key pool stores the key and the key index corresponding to the key. The quantum security base station stores the key paired with the key in the key pool, that is, the quantum security base station stores the key paired with the quantum security terminal.

[0098] If the key center encrypts the supplementary key through a quantum encryption algorithm, the quantum security base station needs to consume the key paired with the quantum security terminal to encrypt the encryption key, causing the key in the quantum security terminal to be further reduced. Therefore, in this application, the key center needs to control its own encryption ratio, that is, the ratio between the data size of the encryption key used to encrypt the supplementary key and the data size of the supplementary key, so that the data size of the supplementary key is larger than the data size of the encryption key, thereby ensuring that the data size of the supplementary key obtained by the subsequent quantum security terminal can be larger than the data size of the key consumed when the quantum security terminal decrypts the encrypted encryption key, thereby achieving the purpose of the supplementary key. For example, an encryption ratio of 1:10 means that the data size of the supplementary key is 10 times the data size of the encryption key.

[0099] In order to avoid security issues such as encryption key being tampered with during transmission, in this application, after obtaining the encryption key, the quantum security terminal can perform integrity verification on the encryption key. Exemplarily, the decryption of the encrypted encryption key, after obtaining the encryption key, and before sending a download request carrying the information of the supplementary key to the key center at the address, includes:

[0100] Determine whether the encryption key passes the integrity check.

[0101] After the quantum security terminal obtains the encryption key based on the above-mentioned embodiment, it can perform integrity check on the encryption key to prevent the encryption key from being tampered with during transmission. For example, after the key center allocates the encryption key to the quantum security terminal, it will also determine the hash value (recorded as the first hash value) corresponding to the encryption key according to the encryption key and the preset hash algorithm, so that the key can be subsequently determined according to the first hash value whether the encryption key has been tampered with during transmission. Security issues such as. When the key center sends the encryption key to the quantum security base station, it can also send the first hash value to the quantum security base station. When the quantum security base station sends the encrypted encryption key to the quantum security terminal, it will also send the first hash value to the quantum security terminal. After the quantum security terminal obtains the encrypted encryption key and the first hash value, it decrypts the encrypted encryption key to obtain the encryption key. Then, according to the decrypted encryption key and the preset hash algorithm, the hash value of the encryption key (recorded as the second hash value) is determined. The quantum security terminal determines whether the encryption key passes the integrity check based on whether the first hash value and the second hash value are consistent. If it is determined that the encryption key passes the integrity check, S103 may be continued to be executed. If it is determined that the encryption key does not pass the integrity check, a request for obtaining the encryption key may be resent to the quantum security base station.

[0102] S103: Send a download request carrying information about the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal.

[0103] After the quantum security terminal obtains the distribution information, it can download the supplementary key from the key center through the distribution information, that is, the quantum security terminal can obtain the address and information of the supplementary key in the distribution information, and send a download request carrying the information of the supplementary key to the key center of the address, so that the supplementary key can be obtained from the key center through the download request.

[0104] In one example, if the quantum security terminal obtains the encrypted distribution information, the quantum security terminal obtains the key for decrypting the encrypted distribution information. According to the key, the encrypted distribution information is decrypted to obtain the distribution information. For example, while the quantum security base station sends the encrypted distribution information to the quantum security terminal, it can also send the key index corresponding to the key used to encrypt the distribution information to the quantum security terminal. Among them, the key is paired with the quantum security terminal. After the quantum security terminal obtains the encrypted distribution information and the key index, it obtains the key for decrypting the encrypted distribution information according to the key index and the preset key pool. According to the key, the encrypted distribution information is decrypted to obtain the distribution information.

[0105] After the key center obtains the download request, it obtains the supplementary key pre-assigned to the quantum security terminal according to the information of the supplementary key carried in the download request, then processes the supplementary key accordingly and sends the supplementary key to the quantum security terminal.

[0106] In one example, the key center may encrypt the supplementary key using a pre-assigned encryption key, and send the encrypted supplementary key to the quantum security terminal, thereby ensuring the security of the supplementary key during transmission.

[0107] S104: Decrypt the received encrypted supplementary key according to the encryption key, obtain the supplementary key, and supplement the key according to the supplementary key.

[0108] Based on the above embodiments, the quantum security terminal can obtain an encryption key and an encrypted supplementary key. According to the encryption key, the encrypted supplementary key is decrypted to obtain the supplementary key. Then, according to the obtained supplementary key, the key of the quantum security terminal is supplemented. For example, according to the supplementary key, the key in the key pool stored by the quantum security terminal is supplemented. Among them, the key in the key pool can be used for quantum encryption and decryption, quantum hash calculation, quantum secure digital identity authentication, and quantum secure signature.

[0109] In one example, after obtaining the allocation information, the quantum security base station can also download the supplementary key from the key center according to the allocation information, so as to facilitate the subsequent forwarding of the key relay between the quantum security base station and the quantum security terminal. Exemplarily, after the quantum security base station obtains the allocation information, it sends a download request carrying the information of the supplementary key to the key center, or, after the quantum security base station obtains the allocation information and receives the encryption key confirmation information sent by the quantum security terminal, it sends a download request carrying the information of the supplementary key to the key center. After receiving the download request, the key center determines the supplementary key according to the information of the supplementary key. Then the supplementary key is sent to the quantum security base station, or, the supplementary key is encrypted by the encryption key, and the encrypted supplementary key is sent to the quantum security base station. After receiving the supplementary key, the quantum security base station can supplement the key paired with the quantum security terminal in the quantum security base station according to the supplementary key.

[0110] In a possible implementation, during the process of supplementing the key in the quantum security terminal according to the supplementary key, a progress bar of the current key supplementation can be displayed on the display screen of the quantum security terminal to facilitate the user to understand the progress of the current key supplementation and improve the user experience.

[0111] The beneficial effects of this application are as follows:

[0112] 1. When the key center allocates a supplementary key to the quantum security terminal, it will also allocate an encryption key to the supplementary key. After receiving the download request from the quantum security terminal, the key center can encrypt the supplementary key and send it to the quantum security terminal according to the encryption key. This ensures that the supplementary key is not transmitted in plain text during network transmission, avoiding security issues such as the supplementary key being stolen or tampered with, thus ensuring the security of the quantum security key distribution process and improving the security of subsequent quantum security communications.

[0113] 2. Since the encryption key is also sent to the quantum security terminal by the quantum security base station in an encrypted manner, the security of the encryption key is guaranteed, and security issues such as the encryption key being stolen and tampered with are avoided, thereby improving the security of the subsequent decryption of the encrypted supplementary key based on the encryption key, further improving the security and stability of the quantum security key distribution process.

[0114] 3. No special optical fiber connection or hardware system such as the transmitter that controls free space is required, which reduces the cost and internal security risks of key distribution, avoids the security of key distribution being reduced due to the security issues of the hardware system itself, and expands the application scenarios of key distribution.

[0115] Embodiment 2:

[0116] In order to supplement the key in time, based on the above embodiment, in this application, a supplement requirement is preset to determine whether the key in the quantum security terminal needs to be supplemented. Exemplarily, the quantum security terminal can determine whether the key in the quantum security terminal meets the preset supplement request. If it is determined that the key in the quantum security terminal meets the preset supplement requirement, a key supplement request is generated and sent to the quantum security base station, thereby realizing automatic online distribution of keys without relying on manual key supplementation, which greatly improves the efficiency of key supplementation.

[0117] The supplementary requirement may be that the capacity of the used keys in the quantum security terminal reaches a first preset capacity threshold, or the number of used keys reaches a first preset number threshold, or the capacity of the unused keys in the quantum security terminal reaches a second preset capacity threshold, or the number of unused keys reaches a second preset number threshold, etc. When setting the supplementary requirements, they can be flexibly set according to actual needs, and are not specifically limited here.

[0118] For example, the quantum security terminal may record the number of used keys and determine whether the number reaches a first preset number threshold. If it is determined that the number reaches the first preset number threshold, indicating that the number of keys is insufficient, it is determined to supplement the keys of the quantum security terminal.

[0119] In one example, if it is determined that the key in the quantum security terminal does not meet the preset supplement requirement, it means that the key is sufficient, then it is determined that there is no need to supplement the key in the quantum security terminal, and the key in the quantum security terminal continues to be monitored to see whether it meets the preset supplement requirement.

[0120] In some possible scenarios, if you want to distribute keys to quantum security terminals through the key center, the quantum security base station needs to have the ability to distribute keys online, that is, the ability to negotiate with the key center to allocate supplementary keys to the quantum security terminal. Therefore, in this application, before generating a key supplement request and sending it to the quantum security base station, the method also includes:

[0121] Determine that the key in the quantum security terminal meets the preset supplementary requirements and that the quantum security base station supports online key distribution.

[0122] Each time a quantum security terminal accesses a quantum security base station, it can obtain access feedback information sent by the quantum security base station, and the access feedback information may include information on whether the quantum security base station supports online key distribution. Based on the information on whether the quantum security base station supports online key distribution, the quantum security terminal can determine whether the quantum security base station supports online key distribution. Among them, the access feedback information carrying information supporting online key distribution can be recorded as the first access feedback information, and the access feedback information not carrying information supporting online key distribution can be recorded as the second access feedback information. The subsequent quantum security terminal will generate a key supplement request and send it to the quantum security base station only when it determines that the key meets the preset supplement requirements and the quantum security base station supports online key distribution.

[0123] For example, after the quantum security terminal sends an access request to the quantum security base station, if the quantum security terminal receives first access feedback information fed back by the quantum security base station, it determines that the quantum security base station supports online key distribution based on the information carried in the first access feedback information that the quantum security base station supports online key distribution; if the quantum security terminal receives second access feedback information fed back by the quantum security base station, it determines that the quantum security base station does not support online key distribution based on the information carried in the second access feedback information that the quantum security base station does not support online key distribution.

[0124] In some other possible scenarios, there may be a situation where the quantum security base station does not have the ability to distribute keys online. Therefore, in this application, the method also includes:

[0125] If it is determined that the key in the quantum security terminal meets the preset supplementary requirements and the quantum security base station does not support online key distribution, then output a prompt message of the supplementary key, and receive the input encrypted supplementary key and key information; wherein the key information includes information of the encrypted key;

[0126] Sending an acquisition request carrying the key information to the quantum secure base station, so that the quantum secure base station obtains the encryption key from the key distribution base station according to the key information and encrypts the encryption key and sends it to the quantum secure terminal;

[0127] Decrypting the encrypted encryption key sent by the quantum secure base station to obtain the encryption key;

[0128] The encrypted supplementary key is decrypted according to the encryption key to obtain the supplementary key, and key supplementation is performed according to the supplementary key.

[0129] In this application, there may be a situation where the quantum security base station does not support online key distribution, so that the quantum security terminal cannot supplement the key through the method in the above embodiment. Based on this, in order to supplement the key in the quantum security terminal in time, in this application, if it is determined that the quantum security base station does not support online distribution, and it is determined that the key in the key pool needs to be supplemented, the quantum security terminal can output a prompt message for supplementing the key, and supplement the key by manually supplementing the key, that is, the staff inputs the supplementary key to the quantum security terminal.

[0130] In one example, the input supplementary key can be obtained by connecting a key distribution machine, that is, the staff connects the key distribution machine storing the key to the quantum security terminal. After the quantum security terminal is connected to the key distribution machine, the indexes corresponding to the multiple groups of keys stored in the key distribution machine can be displayed on the display screen to facilitate the staff to select the key index from the display screen of the quantum security terminal. After receiving the selected key index, the quantum security terminal can obtain the supplementary key corresponding to the key index from the key distribution machine and save it, so that the quantum security terminal can obtain the input supplementary key.

[0131] Among them, the key distribution machine can be a device with quantum security storage function such as a quantum security USB flash drive, a quantum security optical disk, etc.

[0132] Considering that the supplementary key may be stolen or tampered with in the key distribution machine, thus affecting the security of the supplementary key, in the present application, the key in the key distribution machine may be encrypted, that is, the input key received by the quantum security terminal may be an encrypted supplementary key. In addition, the quantum security terminal may also obtain the key information corresponding to the encrypted supplementary key, so that the subsequent quantum security terminal can obtain the encryption key according to the key information, and then decrypt the encrypted supplementary key according to the encryption key. Among them, the key information includes the information of the encryption key.

[0133] Exemplarily, after the quantum security terminal obtains the key information, it can generate an acquisition request based on the key information and send the acquisition request to the quantum security base station. After the quantum security base station obtains the acquisition request, it sends the key information carried in the acquisition request to the key distribution base station to obtain the encryption key from the key distribution base station. Among them, the key distribution base station can be a key center or other quantum security device that stores the encryption key. After the key distribution base station obtains the key information, it obtains the encryption key based on the key information and sends the encryption key to the quantum security base station. After obtaining the encryption key, the quantum security base station can send the encryption key to the quantum security terminal.

[0134] In one example, the quantum security base station may also encrypt the encryption key and send it to the quantum security terminal through a preset encryption method, thereby ensuring the security of the encryption key during transmission. For example, the quantum security base station may encrypt the encryption key through a pre-agreed classical encryption algorithm, or may encrypt the encryption key through a quantum encryption algorithm. Exemplarily, the quantum security base station may obtain a key from a key pool paired with the quantum security terminal, encrypt the encryption key according to the key and a preset quantum encryption algorithm, and send the encrypted encryption key to the quantum security terminal.

[0135] After receiving the encrypted encryption key sent by the quantum security base station, the quantum security terminal can decrypt the encrypted encryption key to obtain the encryption key. Then, according to the encryption key, the encrypted supplementary key is decrypted to obtain the supplementary key. Subsequently, according to the supplementary key, the key of the quantum security terminal can be supplemented.

[0136] In a possible implementation, after the quantum security terminal obtains the encryption key, it can perform an integrity check on the encryption key to prevent the encryption key from being tampered with during transmission. For example, the first hash value corresponding to the encryption key is determined by a preset hash algorithm, so that the first hash value can be used to determine whether the encryption key has been tampered with during transmission. When the key center sends the encryption key to the quantum security base station, it can also send the first hash value to the quantum security base station. When the quantum security base station sends the encrypted encryption key to the quantum security terminal, it will also send the first hash value to the quantum security terminal. After the quantum security terminal obtains the encrypted encryption key and the first hash value, it decrypts the encrypted encryption key to obtain the encryption key. Then, according to the decrypted encryption key and the preset hash algorithm, the second hash value of the encryption key is determined. The quantum security terminal determines whether the encryption key passes the integrity check based on whether the first hash value and the second hash value are consistent. If it is determined that the encryption key passes the integrity check, the encrypted supplementary key can be decrypted according to the encryption key to obtain the supplementary key. If it is determined that the encryption key fails the integrity check, a request to obtain the encryption key may be resent to the quantum security base station.

[0137] In an example, if the key information also includes information of the supplementary key, after decrypting the encrypted supplementary key according to the encryption key and obtaining the supplementary key, and before supplementing the key according to the supplementary key, the method further includes:

[0138] Sending notification information carrying information about the supplementary key to the quantum secure base station to notify the quantum secure base station to download the supplementary key from the key distribution base station.

[0139] Since the quantum security base station needs to have a key paired with the key in the quantum security terminal, the subsequent key relay can be forwarded. Therefore, in the present application, after obtaining the supplementary key, the quantum security terminal can send a notification message carrying the information of the supplementary key to the quantum security base station to notify the quantum security base station to download the supplementary key from the key distribution base station. Exemplarily, the key information obtained by the quantum security terminal may also include the information of the supplementary key. After the quantum security terminal obtains the encryption key and decrypts the encrypted supplementary key according to the encryption key, the information of the supplementary key can be sent to the quantum security base station, so that the quantum security base station can download the supplementary key from the key distribution base station according to the information of the supplementary key after receiving the information of the supplementary key.

[0140] For example, the staff can pre-connect the key distribution machine that stores the key to the key distribution base station connected to the quantum security base station, so that the key distribution base station can obtain at least one set of keys and the information corresponding to each set of keys from the key distribution machine. Among them, the key distribution base station connected to the quantum security base station does not have the function of generating keys, and can be connected to the key distribution machine, and the quantum security base station does not have the authority to connect to the key distribution machine. After the quantum security base station obtains the communication information carrying the information of the supplementary key sent by the quantum security terminal, the supplementary key can be downloaded from the key distribution base station according to the information of the supplementary key.

[0141] Embodiment 3:

[0142] To ensure the security of the obtained supplementary key, based on the above embodiments, in this application, the key supplementation according to the supplementary key includes:

[0143] Performing integrity check on the supplementary key;

[0144] If the supplementary key passes the integrity check, a consistency check is performed between the supplementary key and the supplementary key downloaded from the quantum secure base station;

[0145] If it is determined that the supplementary key passes the consistency check, key supplementation is performed according to the supplementary key.

[0146] In the present application, the quantum security terminal can perform an integrity check on the obtained supplementary key to determine whether the supplementary key has been tampered with, deleted, etc. during the download process, thereby ensuring the security of the obtained supplementary key. After the supplementary key is integrity checked, it can be determined whether the supplementary key passes the integrity check. If the supplementary key passes the integrity check, it means that the supplementary key has not been tampered with, and then the supplementary key is checked for consistency with the supplementary key downloaded by the quantum security base station, thereby ensuring that the key of the quantum security terminal can be paired with the key in the quantum security base station. If the supplementary key does not pass the integrity check, it means that the supplementary key may have been tampered with, and then the supplementary key can be re-acquired. For example, a key supplement request is re-sent to the quantum security base station, or the supplementary key is re-acquired by manually supplementing the key.

[0147] If the supplementary key passes the consistency check with the supplementary key downloaded from the quantum security base station, it means that the quantum security terminal and the quantum security base station have successfully completed key pairing, and the key is supplemented according to the supplementary key; if the supplementary key fails to pass the consistency check with the supplementary key downloaded from the quantum security base station, it means that the quantum security terminal and the quantum security base station cannot complete key pairing, and the supplementary key is obtained again.

[0148] It should be noted that the process of consistency verification between the quantum security base station and the quantum security terminal belongs to the prior art and will not be described in detail here. Exemplarily, the quantum security terminal can determine whether the supplementary key of the quantum security terminal is consistent with the supplementary key downloaded by the quantum security base station based on whether the hash value corresponding to the supplementary key is consistent with the hash value corresponding to the supplementary key downloaded by the quantum security base station. If it is determined that the supplementary key of the quantum security terminal is consistent with the supplementary key downloaded by the quantum security base station, it is determined that the supplementary key downloaded by the quantum security terminal passes the consistency check; if it is determined that the supplementary key of the quantum security terminal is inconsistent with the supplementary key downloaded by the quantum security base station, it is determined that the supplementary key downloaded by the quantum security terminal does not pass the consistency check. Among them, the hash algorithm used to determine the hash value corresponding to the supplementary key downloaded by the quantum security terminal is consistent with the hash algorithm used to determine the hash value of the supplementary key downloaded by the quantum security base station.

[0149] Embodiment 4:

[0150] The key management method provided by this application is described in detail below through specific embodiments. Figure 2 A schematic diagram of a quantum security key distribution process provided in an embodiment of the present application, taking the execution subject as a quantum security terminal as an example, the process includes:

[0151] S201: If it is determined that the quantum security base station has not been accessed, an access request is sent to the quantum security base station.

[0152] The access request carries device identification information.

[0153] S202: Receive access feedback information sent by the quantum security base station.

[0154] S203: Determine whether the access feedback information carries information that the quantum secure base station supports online key distribution. If so, determine that the quantum secure base station supports online key distribution, and execute S204; otherwise, determine that the quantum secure base station does not support online key distribution, and execute S206.

[0155] S204: If it is determined that the number of used keys reaches a preset threshold, a key supplement request is generated and sent to the quantum security base station.

[0156] After the quantum security base station obtains the key supplement request, it can send a query request to the network management device. After receiving the query request, the network management device allocates a key center to the quantum security base station according to the load, working status and other allocation strategies of each key center, and sends the address of the allocated key center to the quantum security base station. For example, the network management device allocates the key center with the lowest load to the quantum security base station, and sends the address of the allocated key center to the quantum security base station. After the quantum security base station determines the key center, it sends the key supplement request to the key center, so that the key center can allocate a key to the quantum security terminal according to the information carried in the key supplement request.

[0157] When the key center determines the supplementary key, the key center can generate allocation information according to the address of the key center and the information of the supplementary key allocated to the quantum security terminal, and determine the encryption key used to encrypt the supplementary key according to the preset encryption ratio. Then, the allocation information and the encryption key are sent to the quantum security base station, so that the allocation information and the encryption key are sent to the quantum security terminal through the quantum security base station.

[0158] After the quantum security base station obtains the distribution information and the encryption key, it encrypts the encryption key and the distribution information according to the key paired with the quantum security terminal, and sends the encrypted distribution information and the encrypted encryption key to the quantum security terminal.

[0159] The allocation information includes the address of the key center and the information of the supplementary key in the key center.

[0160] S205: Receive the encrypted allocation information and the encrypted encryption key sent by the quantum security base station.

[0161] The quantum security terminal obtains the address of the key center and the information of the supplementary key based on the allocation information, and then sends a download request carrying the information of the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal.

[0162] After the quantum security base station sends the allocation information, it can also download the supplementary key from the key center according to the allocation information.

[0163] S206: Decrypt the encrypted distribution information and the encrypted encryption key to obtain the distribution information and the encryption key.

[0164] Exemplarily, the quantum security terminal obtains a key index corresponding to a key used to encrypt the distribution information and the encryption key, and obtains a key according to the key index and a pre-saved key pool. According to the key, the encrypted distribution information and the encrypted encryption key are decrypted to obtain the distribution information and the encryption key.

[0165] The key pool stores the key and the key index corresponding to the key.

[0166] S207: According to the allocation information, obtain the encrypted supplementary key from the key center and execute S209.

[0167] S208: If it is determined that the number of used keys reaches a preset threshold, the input encrypted supplementary key and key information are received, and an acquisition request carrying the key information is sent to the quantum security base station, so that the quantum security base station obtains the encryption key from the key distribution base station according to the key information and encrypts the encryption key and sends it to the quantum security terminal.

[0168] Among them, the input encrypted supplementary key and key information can be obtained by connecting to the key distribution machine.

[0169] It should be noted that the key information also includes the information of the supplementary key. After receiving the key information, the quantum security base station can download the supplementary key from the key distribution base station according to the information of the supplementary key contained in the key information. Among them, the supplementary key in the key distribution base station is also obtained by connecting to the key distribution machine.

[0170] S209: Decrypt the encrypted supplementary key according to the encryption key to obtain the supplementary key.

[0171] S210: Perform integrity check on the supplementary key.

[0172] S211: If the supplementary key passes the integrity check, the supplementary key is checked for consistency with the supplementary key downloaded from the quantum security base station.

[0173] S212: If it is determined that the supplementary key passes the consistency check, the key in the quantum security terminal is supplemented according to the supplementary key.

[0174] Embodiment 5:

[0175] The present application also provides a quantum secure key distribution method, which is applied to a quantum secure base station. Figure 3 A schematic diagram of another quantum secure key distribution process provided in an embodiment of the present application, the process includes:

[0176] S301: Sending a key supplement request sent by a quantum security terminal to a key center, so that the key center allocates a supplement key to the quantum security terminal.

[0177] S302: Sending allocation information and an encrypted encryption key to the quantum security terminal; wherein the allocation information and the encryption key are obtained from the key center, the allocation information includes the address of the key center, and information of the supplementary key allocated to the quantum security terminal in the key center, and the encryption key is used to encrypt the supplementary key.

[0178] It should be noted that the principle of solving the problem by the quantum security base station has been explained in the above embodiments 1-4. For details, please refer to the contents in the above embodiments, and the repeated parts will not be repeated here.

[0179] In this embodiment, the quantum secure key distribution method is applied to a quantum secure base station, which can be an intelligent device, such as a global quantum secure device, an isolation zone device, etc., or a server, such as an application server, a business server, etc.

[0180] In some possible implementations, the sending the allocation information and the encrypted encryption key to the quantum security terminal includes:

[0181] receiving the allocation information and the encryption key sent by the key center;

[0182] Encrypting the encryption key to obtain the encrypted encryption key;

[0183] The allocation information and the encrypted encryption key are sent to the quantum security terminal.

[0184] In some possible implementations, the sending the allocation information and the encrypted encryption key to the quantum security terminal includes:

[0185] Receiving the encryption key information and the distribution information sent by the key center;

[0186] Obtaining a first key, and encrypting the encryption key information and the allocation information according to the first key to obtain a first encrypted ciphertext;

[0187] Sending the first encrypted ciphertext and a first key index corresponding to the first key to the quantum security terminal;

[0188] Receiving an acquisition request carrying the information of the encryption key sent by the quantum security terminal, and sending the acquisition request to the key center;

[0189] Receive the encryption key sent by the key center, encrypt the encryption key, and send the encrypted encryption key to the quantum security terminal.

[0190] In some possible implementations, obtaining the encrypted encryption key includes:

[0191] Acquire a second key paired with the quantum security terminal;

[0192] The encryption key is encrypted according to the second key to obtain the encrypted encryption key.

[0193] In some possible implementations, the method further comprises:

[0194] The second key index corresponding to the second key is sent to the quantum security terminal, so that the quantum security terminal determines the second key according to the second key index and a pre-saved key pool; wherein the key pool stores the key and the key index corresponding to the key; and the encrypted encryption key is decrypted according to the second key to obtain the encryption key.

[0195] In some possible implementations, the method further comprises:

[0196] If the encryption key confirmation information sent by the quantum security terminal is received, a download request carrying the information of the supplementary key is sent to the key center of the address, so that the key center sends the supplementary key to the quantum security base station;

[0197] receiving the supplemental key;

[0198] The key paired with the quantum security terminal is supplemented according to the supplementary key.

[0199] In some possible implementations, before sending the key supplement request sent by the quantum security terminal to the key center, the method further includes:

[0200] Sending first access feedback information to the quantum security terminal; wherein the first access feedback information carries information that the quantum security base station supports online key distribution.

[0201] In some possible implementations, before sending the key supplement request sent by the quantum security terminal to the key center, the method further includes:

[0202] If second access feedback information is sent to the quantum security terminal and an acquisition request carrying key information sent by the quantum security terminal is received, the encryption key is acquired from the key distribution base station according to the key information; wherein the second access feedback information carries information that the quantum security base station does not support online key distribution, and the key information includes information of the encryption key;

[0203] The encryption key is encrypted and sent to the quantum security terminal, so that the quantum security terminal decrypts the encrypted encryption key to obtain the encryption key, decrypts the encrypted supplementary key according to the encryption key to obtain the supplementary key, and supplements the key according to the supplementary key.

[0204] In some possible implementations, the method further comprises:

[0205] If notification information carrying the information of the supplementary key sent by the quantum security terminal is received, the supplementary key is downloaded from the key distribution base station according to the information of the supplementary key.

[0206] In some possible implementations, the method further comprises:

[0207] Performing integrity check on the supplementary key;

[0208] If the supplementary key passes the integrity check, performing a consistency check on the supplementary key and the supplementary key obtained by the quantum security terminal;

[0209] If it is determined that the supplementary key passes the consistency check, the key paired with the quantum security terminal and stored in the quantum security base station is supplemented according to the supplementary key.

[0210] The beneficial effects of this application are as follows:

[0211] 1. When the key center allocates a supplementary key to the quantum security terminal, it will also allocate an encryption key to the supplementary key. After receiving the download request from the quantum security terminal, the key center can encrypt the supplementary key and send it to the quantum security terminal according to the encryption key. This ensures that the supplementary key is not transmitted in plain text during network transmission, avoiding security issues such as the supplementary key being stolen or tampered with, thus ensuring the security of the quantum security key distribution process and improving the security of subsequent quantum security communications.

[0212] 2. Since the encryption key is also sent to the quantum security terminal by the quantum security base station in an encrypted manner, the security of the encryption key is guaranteed, and security issues such as the encryption key being stolen and tampered with are avoided, thereby improving the security of the subsequent decryption of the encrypted supplementary key based on the encryption key, further improving the security and stability of the quantum security key distribution process.

[0213] 3. No special optical fiber connection or hardware system such as the transmitter that controls free space is required, which reduces the cost and internal security risks of key distribution, avoids the security of key distribution being reduced due to the security issues of the hardware system itself, and expands the application scenarios of key distribution.

[0214] Embodiment 6:

[0215] The present application also provides a quantum secure key distribution method, which is applied to a key center. Figure 4 A schematic diagram of another quantum secure key distribution process provided in an embodiment of the present application, the process includes:

[0216] S401: Receive a key supplement request sent by a quantum security base station; wherein the key supplement request is used to instruct the key center to allocate a key to a quantum security terminal.

[0217] S402: Allocate a supplementary key to the quantum security terminal, and determine an encryption key used to encrypt the supplementary key.

[0218] S403: Sending the allocation information and the encryption key to the quantum secure base station; wherein the allocation information includes the address of the key center and the information of the supplementary key.

[0219] S404: Receive a download request carrying the information of the supplementary key sent by the quantum security terminal.

[0220] S405: Based on the encryption key, encrypt the supplementary key and send it to the quantum security terminal.

[0221] It should be noted that the principle of solving the problem by the key center has been explained in the above embodiments 1-4. For details, please refer to the contents in the above embodiments, and the repeated parts will not be repeated here.

[0222] In this embodiment, the quantum secure key distribution method is applied to a key center, which can be an intelligent device, such as a global quantum secure device, an isolation area device, etc., or a server, such as an application server, a business server, etc.

[0223] In some possible implementations, the sending the allocation information and the encryption key to the quantum secure base station includes:

[0224] Sending the encryption key information and the allocation information to the quantum secure base station;

[0225] Receiving a request for obtaining information carrying the encryption key sent by the quantum secure base station;

[0226] The encryption key is sent to the quantum secure base station.

[0227] In some possible implementations, receiving a download request carrying the information of the supplementary key sent by the quantum secure base station;

[0228] The supplementary key is sent to the quantum security base station.

[0229] The beneficial effects of this application are as follows:

[0230] 1. When the key center allocates a supplementary key to the quantum security terminal, it will also allocate an encryption key to the supplementary key. After receiving the download request from the quantum security terminal, the key center can encrypt the supplementary key and send it to the quantum security terminal according to the encryption key. This ensures that the supplementary key is not transmitted in plain text during network transmission, avoiding security issues such as the supplementary key being stolen or tampered with, thus ensuring the security of the quantum security key distribution process and improving the security of subsequent quantum security communications.

[0231] 2. Since the encryption key is also sent to the quantum security terminal by the quantum security base station in an encrypted manner, the security of the encryption key is guaranteed, and security issues such as the encryption key being stolen and tampered with are avoided, thereby improving the security of the subsequent decryption of the encrypted supplementary key based on the encryption key, further improving the security and stability of the quantum security key distribution process.

[0232] 3. No special optical fiber connection or hardware system such as the transmitter that controls free space is required, which reduces the cost and internal security risks of key distribution, avoids the security of key distribution being reduced due to the security issues of the hardware system itself, and expands the application scenarios of key distribution.

[0233] Embodiment 7:

[0234] This application also provides a quantum secure key distribution system, Figure 5 A structural diagram of a key supplement system provided in an embodiment of the present application, the system includes a quantum security terminal 51 that implements the methods described in the above embodiments 1-4, a quantum security base station 52 that implements the method described in the above embodiment 5, and a key center 53 that implements the above embodiment 6.

[0235] It should be noted that the principle of solving the problem by the quantum secure key distribution system has been explained in the above embodiments. For details, please refer to the contents in the above embodiments, and the repeated parts will not be repeated here.

[0236] The following is an explanation of the workflow of the quantum secure key distribution system provided by this application through a specific embodiment. Figure 6 A schematic diagram of the specific workflow of the quantum secure key distribution system provided for this application, the process includes:

[0237] S601: The quantum security terminal determines that it has not accessed the quantum security base station and sends an access request to the quantum security base station.

[0238] S602: After receiving the access request, if the quantum security base station determines that the quantum security terminal is allowed to access the quantum security base station, first access feedback information is sent to the quantum security terminal.

[0239] The first access feedback information carries information that the quantum security base station supports online key distribution.

[0240] S603: After receiving the first access feedback information, if the quantum security terminal determines that the number of used keys reaches a preset threshold, it generates a key supplement request and sends it to the quantum security base station.

[0241] S604: After receiving the key supplement request, the quantum security base station determines the key center that currently allocates keys to the quantum security terminal, and sends the key supplement request to the key center.

[0242] After the quantum security base station obtains the key supplement request, it can send a query request to the network management device. After receiving the query request, the network management device allocates a key center to the quantum security base station according to the load, working status and other allocation strategies of each key center, and sends the address of the allocated key center to the quantum security base station. For example, the network management device allocates the key center with the lowest load to the quantum security base station, and sends the address of the allocated key center to the quantum security base station. After the quantum security base station determines the key center, it sends the key supplement request to the key center, so that the key center can allocate a key to the quantum security terminal according to the information carried in the key supplement request.

[0243] S605: After receiving the key supplement request, the key center allocates a supplement key and an encryption key used to encrypt the supplement key to the quantum security terminal, generates allocation information according to the address of the key center and the information of the supplement key allocated to the quantum security terminal, and sends the allocation information and the encryption key information to the quantum security base station.

[0244] S606: After receiving the allocation information and the encryption key information, the quantum security base station encrypts the allocation information and the encryption key information according to the first key paired with the quantum security terminal, obtains a first encrypted ciphertext, and sends the first encrypted ciphertext and the first key index corresponding to the first key to the quantum security terminal.

[0245] S607: The quantum security terminal receives the first encrypted ciphertext and the first key index, obtains the first key according to the first key index, decrypts the first encrypted ciphertext according to the first key, and obtains the allocation information and the encryption key information.

[0246] S608: The quantum security terminal sends a request for obtaining information carrying the encryption key to the quantum security base station.

[0247] S609: The quantum security base station sends the received acquisition request to the key center.

[0248] S610: The key center obtains the encryption key according to the information of the encryption key carried in the received acquisition request, determines the first hash value of the encryption key according to a preset hash algorithm, and sends the encryption key and the first hash value to the quantum security base station.

[0249] S611: The quantum security base station encrypts the received encryption key and the first hash value and sends them to the quantum security base station.

[0250] S612: The quantum security terminal decrypts the received encrypted encryption key and the encrypted first hash value to obtain the encryption key and the first hash value.

[0251] S613: The quantum security terminal determines the second hash value of the decrypted encryption key according to a preset hash algorithm, and determines whether the encryption key passes the integrity check according to the first hash value and the second hash value.

[0252] S614: If it is determined that the encryption key passes the integrity check, the quantum security terminal sends encryption key confirmation information to the quantum security base station.

[0253] S615: If it is determined that the encryption key passes the integrity check, the quantum security terminal sends a first download request to the key center according to the acquired allocation information.

[0254] It should be noted that S615 can be executed before S614, can be executed after S614, or can be executed simultaneously with S614. In the present application, the execution order of S615 and S614 is not limited.

[0255] S616: After the key center obtains the first download request, it encrypts the supplementary key according to the encryption key and sends the encrypted supplementary key to the quantum security terminal.

[0256] S617: After obtaining the encryption key confirmation information, the quantum security base station sends a second download request to the key center according to the allocation information.

[0257] S618: After receiving the second download request, the key center sends the supplementary key to the quantum security base station.

[0258] It should be noted that S617 to S618 may be executed in any step after S614 and are not specifically limited here.

[0259] S619: The quantum security terminal obtains the encrypted supplementary key, and decrypts the encrypted supplementary key according to the encryption key to obtain the supplementary key.

[0260] S620: The quantum security terminal performs integrity verification on the supplementary key.

[0261] S621: If it is determined that the supplementary key passes the integrity check, the quantum security terminal performs a consistency check on the supplementary key and the supplementary key downloaded from the quantum security base station.

[0262] S622: The quantum security terminal determines that the supplementary key passes the consistency check, and then supplements the key of the quantum security terminal according to the supplementary key.

[0263] When the quantum security terminal supplements the key in the quantum security terminal according to the supplementary key, the supplementary key can be checked for integrity. If the supplementary key passes the integrity check, it means that the supplementary key has not been tampered with. Then the supplementary key is checked for consistency with the supplementary key downloaded from the quantum security base station, thereby ensuring that the key of the quantum security terminal can be paired with the key in the quantum security base station. If the supplementary key fails the integrity check, it means that the supplementary key may have been tampered with, and the supplementary key can be re-acquired. For example, a key supplement request is re-sent to the quantum security base station, or the supplementary key is re-acquired by manually supplementing the key.

[0264] If the supplementary key passes the consistency check with the supplementary key downloaded from the quantum security base station, it means that the quantum security terminal and the quantum security base station have successfully completed key pairing, and the key is supplemented according to the supplementary key; if the supplementary key fails to pass the consistency check with the supplementary key downloaded from the quantum security base station, it means that the quantum security terminal and the quantum security base station cannot complete key pairing, and the supplementary key is obtained again.

[0265] Figure 7 A schematic diagram of the workflow of another quantum secure key distribution system provided in this application, the process includes:

[0266] S701: The quantum security terminal determines that it has not accessed the quantum security base station and sends an access request to the quantum security base station.

[0267] S702: After receiving the access request, if the quantum security base station determines that the quantum security terminal is allowed to access the quantum security base station, second access feedback information is sent to the quantum security terminal.

[0268] The second access feedback information carries information that the quantum security base station does not support online key distribution.

[0269] S703: After receiving the second access feedback information, the quantum security terminal determines that the number of used keys has reached a preset threshold, and receives the encrypted supplementary key manually filled by the staff and the encryption key information.

[0270] It should be noted that the staff can obtain the input encrypted supplementary key and encryption key information by connecting the quantum security terminal to the key distribution machine.

[0271] S704: The quantum security terminal sends a request for obtaining information carrying the encryption key to the quantum security base station.

[0272] S705: After receiving the acquisition request, the quantum security base station sends the acquisition request to the key distribution base station.

[0273] S706: The key distribution base station obtains the encryption key according to the received acquisition request, determines the first hash value of the encryption key according to a preset hash algorithm, and sends the encryption key and the first hash value to the quantum security base station.

[0274] S707: The quantum security base station encrypts the received encryption key and the first hash value and sends them to the quantum security base station.

[0275] S708: The quantum security terminal decrypts the received encrypted encryption key and the encrypted first hash value to obtain the encryption key and the first hash value.

[0276] S709: The quantum security terminal determines the second hash value of the decrypted encryption key according to a preset hash algorithm, and determines whether the encryption key passes the integrity check according to the first hash value and the second hash value.

[0277] S710: If it is determined that the encryption key passes the integrity check, the quantum security terminal sends a notification message carrying information about the supplementary key to the quantum security base station.

[0278] S711: The quantum security terminal decrypts the encrypted supplementary key according to the encryption key to obtain the supplementary key.

[0279] S712: After receiving the notification information carrying the information of the supplementary key, the quantum security base station can send a download request carrying the information of the supplementary key to the key distribution base station according to the information of the supplementary key.

[0280] S713: After receiving the download request, the key center sends the supplementary key to the quantum security base station.

[0281] It should be noted that S712 to S713 may be performed at any step between S711 and S715, and are not specifically limited here.

[0282] S714: The quantum security terminal performs integrity verification on the supplementary key.

[0283] S715: If it is determined that the supplementary key passes the integrity check, the quantum security terminal performs a consistency check on the supplementary key and the supplementary key downloaded from the quantum security base station.

[0284] S716: The quantum security terminal determines that the supplementary key passes the consistency check, and then supplements the key of the quantum security terminal according to the supplementary key.

[0285] When the quantum security terminal supplements the key in the quantum security terminal according to the supplementary key, the supplementary key can be checked for integrity. If the supplementary key passes the integrity check, it means that the supplementary key has not been tampered with. Then the supplementary key is checked for consistency with the supplementary key downloaded from the quantum security base station, thereby ensuring that the key of the quantum security terminal can be paired with the key in the quantum security base station. If the supplementary key fails the integrity check, it means that the supplementary key may have been tampered with, and the supplementary key can be re-acquired. For example, a key supplement request is re-sent to the quantum security base station, or the supplementary key is re-acquired by manually supplementing the key.

[0286] If the supplementary key passes the consistency check with the supplementary key downloaded from the quantum security base station, it means that the quantum security terminal and the quantum security base station have successfully completed key pairing, and the key is supplemented according to the supplementary key; if the supplementary key fails to pass the consistency check with the supplementary key downloaded from the quantum security base station, it means that the quantum security terminal and the quantum security base station cannot complete key pairing, and the supplementary key is obtained again.

[0287] Embodiment 8:

[0288] This application also provides a quantum secure key distribution device, Figure 8 A schematic diagram of the structure of a key supplement device provided in an embodiment of the present application, the device is applied to a quantum security terminal, the device includes:

[0289] A sending unit 71 is used to generate a key supplement request and send it to a quantum security base station;

[0290] A receiving unit 72 is used to obtain the allocation information sent by the quantum security base station and the encrypted encryption key; wherein the allocation information includes the address of the key center and the information of the supplementary key allocated to the quantum security terminal in the key center;

[0291] The processing unit 73 is used to decrypt the encrypted encryption key to obtain the encryption key;

[0292] The sending unit 71 is further configured to send a download request carrying information of the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal;

[0293] The receiving unit 72 is further configured to receive the encrypted supplementary key;

[0294] The processing unit 73 is further configured to decrypt the received encrypted supplementary key according to the encryption key, obtain the supplementary key, and perform key supplementation according to the supplementary key.

[0295] It should be noted that the principle of solving the technical problem of the quantum secure key distribution device provided in this embodiment is the same as the principle of solving the technical problem in the above embodiments 1-4, and the repeated parts will not be repeated.

[0296] Embodiment 9:

[0297] This application also provides a quantum secure key distribution device, Fig. 9 A schematic diagram of the structure of another key supplement device provided in an embodiment of the present application, the device is applied to a quantum security base station, the device includes:

[0298] A first sending module 81 is used to send the key supplement request sent by the quantum security terminal to the key center, so that the key center allocates a supplement key to the quantum security terminal;

[0299] The second sending module 82 is used to send allocation information and an encrypted encryption key to the quantum security terminal; wherein the allocation information and the encryption key are obtained from the key center, the allocation information includes the address of the key center, and the information of the supplementary key allocated to the quantum security terminal in the key center, and the encryption key is used to encrypt the supplementary key.

[0300] It should be noted that the principle of solving the technical problem of the quantum secure key distribution device provided in this embodiment is the same as the principle of solving the technical problem in the above-mentioned embodiment 5, and the repeated parts will not be repeated.

[0301] Embodiment 10:

[0302] This application also provides a quantum secure key distribution device, Fig.10 A schematic diagram of the structure of another key supplement device provided in an embodiment of the present application, the device is applied to a key center, and the device includes:

[0303] The second receiving module 91 is used to receive a key supplement request sent by the quantum security base station; wherein the key supplement request is used to instruct the key center to allocate a key to the quantum security terminal;

[0304] A second processing module 92 is used to allocate a supplementary key to the quantum security terminal and determine an encryption key used to encrypt the supplementary key;

[0305] A third sending module 93 is used to send the allocation information and the encryption key to the quantum secure base station; wherein the allocation information includes the address of the key center and the information of the supplementary key;

[0306] The second receiving module 91 is used to receive a download request carrying the information of the supplementary key sent by the quantum security terminal;

[0307] The second processing module 92 is used to encrypt the supplementary key based on the encryption key;

[0308] The third sending module 93 is used to send the encrypted supplementary key to the quantum security terminal.

[0309] It should be noted that the principle of solving the technical problem of the quantum secure key distribution device provided in this embodiment is the same as the principle of solving the technical problem in the above-mentioned embodiment 6, and the repeated parts will not be repeated.

[0310] Embodiment 11:

[0311] Based on the above embodiments, the present application also provides a quantum security terminal. Fig.11 A schematic diagram of the structure of a quantum security terminal provided in an embodiment of the present application is shown in FIG. Fig.11 As shown, it includes: a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002, and the memory 1003 communicate with each other through the communication bus 1004;

[0312] The memory 1003 stores a computer program. When the program is executed by the processor 1001, the processor 1001 performs the following steps:

[0313] Generate a key supplement request and send it to the quantum security base station;

[0314] Obtaining the allocation information and the encrypted encryption key sent by the quantum security base station, and decrypting the encrypted encryption key to obtain the encryption key; wherein the allocation information includes the address of the key center and the information of the supplementary key allocated to the quantum security terminal in the key center;

[0315] Sending a download request carrying information of the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal;

[0316] The received encrypted supplementary key is decrypted according to the encryption key to obtain the supplementary key, and key supplementation is performed according to the supplementary key.

[0317] Since the principle of solving the problem by the above-mentioned quantum security terminal is similar to that of the quantum security key method, the implementation of the above-mentioned quantum security terminal can refer to Examples 1-4 of the method, and the repeated parts will not be repeated.

[0318] Embodiment 12:

[0319] Based on the above embodiments, the present application also provides a quantum security base station. Fig.12 A schematic diagram of the structure of another quantum security base station provided in an embodiment of the present application is shown in FIG. Fig.12 As shown, it includes: a processor 1101, a communication interface 1102, a memory 1103 and a communication bus 1104, wherein the processor 1101, the communication interface 1102, and the memory 1103 communicate with each other through the communication bus 1104;

[0320] The memory 1103 stores a computer program. When the program is executed by the processor 1101, the processor 1101 performs the following steps:

[0321] Sending the key supplement request sent by the quantum security terminal to the key center, so that the key center allocates a supplement key to the quantum security terminal;

[0322] Sending distribution information and an encrypted encryption key to the quantum security terminal; wherein the distribution information and the encryption key are obtained from the key center, the distribution information includes the address of the key center, and information of the supplementary key allocated to the quantum security terminal in the key center, and the encryption key is used to encrypt the supplementary key.

[0323] Since the principle of solving the problem by the above-mentioned quantum secure base station is similar to that of the quantum secure key method, the implementation of the above-mentioned quantum secure base station can refer to Example 5 of the method, and the repeated parts will not be repeated.

[0324] Embodiment 13:

[0325] Based on the above embodiment, the embodiment of the present application further provides a key center, Fig.13 A schematic diagram of the structure of another key center provided in an embodiment of the present application is shown in FIG. Fig.13 As shown, it includes: a processor 1201, a communication interface 1202, a memory 1203 and a communication bus 1204, wherein the processor 1201, the communication interface 1202, and the memory 1203 communicate with each other through the communication bus 1204;

[0326] The memory 1203 stores a computer program. When the program is executed by the processor 1201, the processor 1201 performs the following steps:

[0327] Receiving a key supplement request sent by a quantum security base station; wherein the key supplement request is used to instruct the key center to allocate a key to the quantum security terminal;

[0328] Allocating a supplementary key to the quantum security terminal and determining an encryption key used to encrypt the supplementary key;

[0329] Sending the allocation information and the encryption key to the quantum secure base station; wherein the allocation information includes the address of the key center and the information of the supplementary key;

[0330] Receiving a download request carrying the information of the supplementary key sent by the quantum security terminal;

[0331] Based on the encryption key, the supplementary key is encrypted and sent to the quantum security terminal.

[0332] Since the principle of solving the problem by the above key center is similar to that of the quantum security key method, the implementation of the above key center can refer to Example 6 of the method, and the repeated parts will not be repeated.

[0333] Embodiment 14:

[0334] On the basis of the above embodiments, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program runs on the processor, the processor implements the following steps when executing:

[0335] Generate a key supplement request and send it to the quantum security base station;

[0336] Obtaining the allocation information and the encrypted encryption key sent by the quantum security base station, and decrypting the encrypted encryption key to obtain the encryption key; wherein the allocation information includes the address of the key center and the information of the supplementary key allocated to the quantum security terminal in the key center;

[0337] Sending a download request carrying information of the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal;

[0338] The received encrypted supplementary key is decrypted according to the encryption key to obtain the supplementary key, and key supplementation is performed according to the supplementary key.

[0339] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the quantum secure key distribution method, the implementation of the above-mentioned computer-readable storage medium can refer to Examples 1-4 of the method, and the repeated parts will not be repeated.

[0340] Embodiment 15:

[0341] On the basis of the above embodiments, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program runs on the processor, the processor implements the following steps when executing:

[0342] Sending the key supplement request sent by the quantum security terminal to the key center, so that the key center allocates a supplement key to the quantum security terminal;

[0343] Sending distribution information and an encrypted encryption key to the quantum security terminal; wherein the distribution information and the encryption key are obtained from the key center, the distribution information includes the address of the key center, and information of the supplementary key allocated to the quantum security terminal in the key center, and the encryption key is used to encrypt the supplementary key.

[0344] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the quantum secure key distribution method, the implementation of the above-mentioned computer-readable storage medium can refer to Example 5 of the method, and the repeated parts will not be repeated.

[0345] Embodiment 16:

[0346] On the basis of the above embodiments, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program runs on the processor, the processor implements the following steps when executing:

[0347] Receiving a key supplement request sent by a quantum security base station; wherein the key supplement request is used to instruct the key center to allocate a key to the quantum security terminal;

[0348] Allocating a supplementary key to the quantum security terminal and determining an encryption key used to encrypt the supplementary key;

[0349] Sending the allocation information and the encryption key to the quantum secure base station; wherein the allocation information includes the address of the key center and the information of the supplementary key;

[0350] Receiving a download request carrying the information of the supplementary key sent by the quantum security terminal;

[0351] Based on the encryption key, the supplementary key is encrypted and sent to the quantum security terminal.

[0352] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to that of the quantum secure key distribution method, the implementation of the above-mentioned computer-readable storage medium can refer to Example 6 of the method, and the repeated parts will not be repeated.

[0353] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on two or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0354] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A quantum secure key distribution method, characterized in that: The method is applied to a quantum security terminal, and the method comprises: Generate a key supplement request and send it to the quantum security base station; Obtaining the allocation information and the encrypted encryption key sent by the quantum security base station, and decrypting the encrypted encryption key to obtain the encryption key; wherein the allocation information includes the address of the key center and the information of the supplementary key allocated to the quantum security terminal in the key center; Sending a download request carrying information of the supplementary key to the key center at the address, so that the key center encrypts the supplementary key based on the encryption key and sends it to the quantum security terminal; Decrypting the received encrypted supplementary key according to the encryption key to obtain the supplementary key, and supplementing the key according to the supplementary key; The obtaining of the allocation information sent by the quantum secure base station and the encrypted encryption key includes: Receiving a first encrypted ciphertext sent by the quantum secure base station and a first key index corresponding to the first encrypted ciphertext; Determine a first key according to the first key index and a pre-stored key pool; the key pool stores keys and key indexes corresponding to the keys; Decrypting the first encrypted ciphertext according to the first key to obtain the allocation information and encryption key information carried by the first encrypted ciphertext; Sending an acquisition request carrying the information of the encryption key to the quantum security base station, so that the quantum security base station obtains the encryption key from the key center based on the information of the encryption key, and encrypts the encryption key and sends it to the quantum security terminal; Receiving the encrypted encryption key sent by the quantum security terminal; After determining the supplementary key and the encryption key, the key center determines the distribution information according to the information of the supplementary key, and then sends the information of the encryption key and the distribution information to the quantum security base station; after the quantum security base station obtains the distribution information and the information of the encryption key, it obtains the information of the encryption key and the key paired with the quantum security terminal, that is, the first key, and encrypts the distribution information and the encryption key information according to the first key and a preset quantum encryption algorithm to obtain an encrypted ciphertext, that is, a first encrypted ciphertext; the first encrypted ciphertext and the key index corresponding to the first key, that is, the first key index, are sent to the quantum security terminal; after the quantum security terminal obtains the first encrypted ciphertext and the first key index, it obtains the key index corresponding to the first key according to the first key index and the pre-stored key index. A quantum security terminal comprises a quantum security base station, a quantum security base station, a quantum security terminal, a quantum security terminal and a quantum security terminal. The quantum security base station comprises a quantum security terminal and a quantum security terminal. The quantum security terminal comprises a quantum security terminal and a quantum security terminal. The quantum security terminal comprises a quantum security terminal and a quantum security terminal. The quantum security terminal comprises a quantum security terminal and a quantum security terminal. The quantum security terminal comprises a quantum security terminal and a quantum security terminal. The quantum security terminal comprises a quantum security terminal and a quantum security terminal. The quantum security terminal comprises a quantum security terminal and a quantum security terminal.

2. The method according to claim 1, characterized in that The decrypting the encrypted encryption key to obtain the encryption key includes: Obtaining a second key index corresponding to the encrypted encryption key; Determine the second key according to the second key index and a pre-stored key pool; wherein the key pool stores the key and the key index corresponding to the key; The encrypted encryption key is decrypted according to the second key to obtain the encryption key.

3. The method according to claim 2, characterized in that After decrypting the encrypted encryption key to obtain the encryption key, and before sending a download request carrying the information of the supplementary key to the key center at the address, the method includes: Determine whether the encryption key passes the integrity check.

4. The method according to claim 3, characterized in that The method further comprises: Send encryption key confirmation information to the quantum secure base station to notify the quantum secure base station to download the supplementary key from the key center.

5. The method according to claim 1, characterized in that Before generating a key supplement request and sending it to the quantum security base station, the method further includes: Determine that the key in the quantum security terminal meets the preset supplementary requirements and that the quantum security base station supports online key distribution.

6. The method according to claim 5, characterized in that The method further comprises: If it is determined that the key in the quantum security terminal meets the preset supplementary requirements and the quantum security base station does not support online key distribution, then output a prompt message of the supplementary key, and receive the input encrypted supplementary key and key information; wherein the key information includes information of the encrypted key; Sending an acquisition request carrying the key information to the quantum secure base station, so that the quantum secure base station obtains the encryption key from the key distribution base station according to the key information and encrypts the encryption key and sends it to the quantum secure terminal; Decrypting the encrypted encryption key sent by the quantum secure base station to obtain the encryption key; Decrypting the encrypted supplementary key according to the encryption key to obtain the supplementary key; Key supplementation is performed according to the supplementary key.

7. The method according to claim 6, characterized in that If the key information also includes information of the supplementary key, after decrypting the encrypted supplementary key according to the encryption key to obtain the supplementary key, and before supplementing the key according to the supplementary key, the method further includes: Sending notification information carrying information about the supplementary key to the quantum secure base station to notify the quantum secure base station to download the supplementary key from the key distribution base station.

8. The method according to any one of claims 1 to 7, characterized in that: The step of supplementing the key according to the supplementary key includes: Performing integrity check on the supplementary key; If the supplementary key passes the integrity check, a consistency check is performed on the supplementary key and the supplementary key downloaded from the quantum secure base station; If it is determined that the supplementary key passes the consistency check, key supplementation is performed according to the supplementary key.

9. A quantum secure key distribution method, characterized in that: The method is applied to a quantum security base station, and the method comprises: Sending the key supplement request sent by the quantum security terminal to the key center, so that the key center allocates a supplement key to the quantum security terminal; Sending allocation information and an encrypted encryption key to the quantum security terminal; wherein the allocation information and the encryption key are obtained from the key center, the allocation information includes the address of the key center, and information of the supplementary key allocated to the quantum security terminal in the key center, and the encryption key is used to encrypt the supplementary key; The sending the allocation information and the encrypted encryption key to the quantum security terminal includes: receiving the allocation information and the encryption key sent by the key center; Encrypting the encryption key to obtain the encrypted encryption key; Sending the allocation information and the encrypted encryption key to the quantum security terminal; The sending of the allocation information and the encrypted encryption key to the quantum security terminal also includes: Receiving the encryption key information and the distribution information sent by the key center; Obtaining a first key, and encrypting the encryption key information and the allocation information according to the first key to obtain a first encrypted ciphertext; Sending the first encrypted ciphertext and a first key index corresponding to the first key to the quantum security terminal; Receiving an acquisition request carrying the information of the encryption key sent by the quantum security terminal, and sending the acquisition request to the key center; Receive the encryption key sent by the key center, encrypt the encryption key, and send the encrypted encryption key to the quantum security terminal.

10. The method according to claim 9, characterized in that Obtaining the encrypted encryption key includes: Acquire a second key paired with the quantum security terminal; The encryption key is encrypted according to the second key to obtain the encrypted encryption key.

11. The method according to claim 10, characterized in that The method further comprises: The second key index corresponding to the second key is sent to the quantum security terminal, so that the quantum security terminal determines the second key according to the second key index and a pre-saved key pool; wherein the key pool stores the key and the key index corresponding to the key; and the encrypted encryption key is decrypted according to the second key to obtain the encryption key.

12. The method according to claim 9, characterized in that The method further comprises: If the encryption key confirmation information sent by the quantum security terminal is received, a download request carrying the information of the supplementary key is sent to the key center of the address, so that the key center sends the supplementary key to the quantum security base station; receiving the supplemental key; The key paired with the quantum security terminal is supplemented according to the supplementary key.

13. The method according to claim 9, characterized in that Before sending the key supplement request sent by the quantum security terminal to the key center, the method further includes: Sending first access feedback information to the quantum security terminal; wherein the first access feedback information carries information that the quantum security base station supports online key distribution.

14. The method according to claim 13, characterized in that Before sending the key supplement request sent by the quantum security terminal to the key center, the method further includes: If second access feedback information is sent to the quantum security terminal and an acquisition request carrying key information sent by the quantum security terminal is received, the encryption key is acquired from the key distribution base station according to the key information; wherein the second access feedback information carries information that the quantum security base station does not support online key distribution, and the key information includes information of the encryption key; The encryption key is encrypted and sent to the quantum security terminal, so that the quantum security terminal decrypts the encrypted encryption key to obtain the encryption key, decrypts the encrypted supplementary key according to the encryption key to obtain the supplementary key, and supplements the key according to the supplementary key.

15. The method according to claim 14, characterized in that The method further comprises: If notification information carrying the information of the supplementary key sent by the quantum security terminal is received, the supplementary key is downloaded from the key distribution base station according to the information of the supplementary key.

16. The method according to claim 12 or 15, characterized in that The method further comprises: Performing integrity check on the supplementary key; If the supplementary key passes the integrity check, performing a consistency check on the supplementary key and the supplementary key obtained by the quantum security terminal; If it is determined that the supplementary key passes the consistency check, the key paired with the quantum security terminal and stored in the quantum security base station is supplemented according to the supplementary key.

17. A quantum secure key distribution method, characterized in that: The method is applied to a key center, and the method comprises: Receiving a key supplement request sent by a quantum security base station; wherein the key supplement request is used to instruct the key center to allocate a key to the quantum security terminal; Allocating a supplementary key to the quantum security terminal and determining an encryption key used to encrypt the supplementary key; Sending the allocation information and the encryption key to the quantum secure base station; wherein the allocation information includes the address of the key center and the information of the supplementary key; Receiving a download request carrying the information of the supplementary key sent by the quantum security terminal; Based on the encryption key, encrypt the supplementary key and send it to the quantum security terminal; Sending the allocation information and the encrypted encryption key to the quantum security terminal includes: receiving the allocation information and the encryption key sent by the key center; encrypting the encryption key to obtain the encrypted encryption key; sending the allocation information and the encrypted encryption key to the quantum security terminal; Sending distribution information and the encrypted encryption key to the quantum security terminal also includes: receiving the encryption key information and the distribution information sent by the key center; obtaining a first key, and encrypting the encryption key information and the distribution information according to the first key to obtain a first encrypted ciphertext; sending the first encrypted ciphertext and the first key index corresponding to the first key to the quantum security terminal; receiving an acquisition request for information carrying the encryption key sent by the quantum security terminal, and sending the acquisition request to the key center; receiving the encryption key sent by the key center, encrypting the encryption key, and sending the encrypted encryption key to the quantum security terminal.

18. The method according to claim 17, characterized in that The sending of the allocation information and the encryption key to the quantum secure base station comprises: Sending the encryption key information and the allocation information to the quantum secure base station; Receiving a request for obtaining information carrying the encryption key sent by the quantum secure base station; The encryption key is sent to the quantum secure base station.

19. The method according to claim 17, characterized in that The method further comprises: Receiving a download request carrying the information of the supplementary key sent by the quantum secure base station; The supplementary key is sent to the quantum security base station.

20. A key management system, characterized in that: The system includes a quantum security terminal for executing the method described in any one of claims 1 to 8, a quantum security base station for executing the method described in any one of claims 9 to 16, and a key center for executing the method described in any one of claims 17 to 19.

Images