A key relay method for quantum secure network

Abstract

The present invention discloses a key relay method for a quantum security network, the method comprising: when a transmitting end generates key information to be relayed, the key information to be relayed and a quantum key used for encryption are calculated by a first verification algorithm to obtain a checksum C1; during relaying, only a quantum key index used to indicate a quantum key index relationship is transmitted between the transmitting end and a relay node; after receiving the key information, the relay node takes out the corresponding quantum key according to the quantum key index, and then calculates the received key information and the taken out quantum key by the first verification algorithm to obtain a checksum C1 ′ , by verifying the checksum C1 ′ Whether it is the same as the checksum C1 is used to determine whether the key relay is abnormal; at the same time, in this process, since only the quantum key index is transmitted from the sender to the relay node, the real quantum key is not transmitted, which reduces the possibility of its leakage and further ensures the security of the relayed quantum key.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a key relay method for a quantum security network. Background Art

[0002] The rapid development of information and communication technology has led to an increasing demand for information security by countries, institutions and individuals. In the main application scenarios of information and communication technology, such as various terminal devices, network connections connecting various devices, data centers operating in cloud computing and other modes, and various emerging cryptographic applications represented by blockchain, there is a possibility of being attacked by quantum computing. Therefore, all kinds of application scenarios have the application demand of quantum security technology.

[0003] The quantum security terminal is designed based on the concept of information protection. Its security is guaranteed by quantum encryption technology. The processes of receiving, generating and sending data in the quantum security terminal are all in a fully protected environment.

[0004] When a quantum security terminal conducts quantum security communication, on the one hand, it must send user data encrypted by quantum keys through a local area network or the Internet, and on the other hand, it must relay the quantum keys used for encryption through a quantum security network. During the relay process, the quantum key is sent from the sender to the relay node, and then forwarded by the relay node to the receiver; the quantum key is relayed in plain text between the sender, the relay node, and the receiver; once the above quantum key is abnormal during the transmission process, it will affect the correct relay of the key, thereby reducing the reliability and security of the quantum security network. For this reason, it is necessary to protect the relay of the above quantum key. Summary of the invention

[0005] In order to solve the above problems, the present invention discloses a key relay method for a quantum security network.

[0006] The present application provides a key relay method for a quantum security network, the method comprising:

[0007] The sending end and the relay node share a first key set;

[0008] The sending end generates key information to be relayed, calculates the key information and the quantum key used for encryption by a first verification algorithm to obtain a checksum C1, and sends the key information and the checksum C1 to the relay node; the key information includes a quantum key index for indicating the quantum key index relationship, and the quantum key is selected from the first key set;

[0009] The relay node receives the key information and the checksum C1, extracts the quantum key from the first key set of the relay node according to the quantum key index in the key information, and uses a first verification algorithm to calculate the received key information and the extracted quantum key to obtain a checksum C′1, and verifies whether the checksum C′1 is the same as the checksum C1. If the verification result is the same, the extracted quantum key is sent to the receiving end; otherwise, the key relay is stopped.

[0010] In the above scheme, the method further comprises:

[0011] The relay node calculates the retrieved quantum key by using a second verification algorithm to obtain a checksum C2, and sends the checksum C2 to the receiving end;

[0012] The receiving end receives the checksum C2, calculates the received quantum key through a second verification algorithm to obtain a checksum C′2, and verifies whether the checksum C′2 is identical to the checksum C2. If they are identical, it indicates that the received quantum key is correct; otherwise, it indicates that an error occurs in the received quantum key.

[0013] In the above scheme, the method further comprises:

[0014] The relay node shares a second key set with the receiving end;

[0015] The relay node encrypts the extracted quantum key and checksum C2 using a key in its second key set to form a key relay ciphertext, generates a transmission key index, and the transmission key index is used to indicate an index relationship of the key for encrypting the extracted quantum key and checksum C2, and then sends the key relay ciphertext and the transmission key index to the receiving end;

[0016] The receiving end receives the key relay ciphertext and the transmission key index, and determines a decryption key in the second key set of the receiving end according to the transmission key index to decrypt the key relay ciphertext to obtain the quantum key and the checksum C2.

[0017] In the above scheme, before the relay node sends the key relay ciphertext and the transmission key index to the receiving end, it also calculates the transmission key index and the key corresponding to the transmission key index by a third verification algorithm to obtain a checksum C3, and then sends the checksum C3 to the receiving end;

[0018] The receiving end receives the checksum C3, and uses the third verification algorithm to calculate the key corresponding to the transmission key index and the transmission key index to obtain the checksum C′3, and verifies whether the checksum C′3 is the same as the checksum C3. If the verification result is the same, it indicates that the key relay is correct; otherwise, it indicates that an error occurs in the key relay.

[0019] In the above scheme, if the relay node includes multiple ones, the sending end also carries the location identifier of the receiving end when sending the key information, and the relay node determines the next-hop relay node according to the location identifier.

[0020] In the above solution, the location identifier is the network access ID of the receiving end, and the network access ID includes an address identifier for indicating the geographical location of the receiving end.

[0021] In the above scheme, if the relay node includes an edge device between a local area network or a wide area network, a third key set is shared between the previous hop edge device and the next hop edge device;

[0022] The previous-hop edge device receives the key relay information, encrypts the key relay information by using the key in the third key set to form a first key relay ciphertext, and generates a first key index, where the first key index is used to indicate the index relationship of the key for encrypting the key relay information; then uses the fourth verification algorithm to calculate the first key index and the key for encrypting the key relay information to obtain a checksum C4; queries and determines the next-hop edge device according to the location identifier, and then sends the checksum C4, the first key index, and the first key relay ciphertext to the next-hop edge device;

[0023] The next-hop edge device receives the checksum C4, the first key index and the first key relay ciphertext; searches and retrieves the key used to encrypt the key relay information according to the first key index, uses the fourth verification algorithm to calculate the retrieved key used to encrypt the key relay information and the first key index to obtain the checksum C′4, verifies whether the checksum C′4 is the same as the checksum C4, if they are the same, continues the key relay; otherwise, stops the key relay.

[0024] In the above scheme, when the sending end sends the encrypted data formed by encrypting the plaintext with the quantum key to the receiving end, the plaintext is also calculated by the fifth verification algorithm to obtain the checksum C5, and the encrypted data and the checksum C5 are sent to the receiving end via the Internet; the receiving end receives the encrypted data and the checksum C5, calculates the plaintext obtained after decryption to obtain the checksum C′5, and verifies whether the checksum C′5 is the same as the checksum C5. If the verification result is the same, it indicates that the encrypted data is decrypted correctly; otherwise, it indicates that an error occurs in the decryption of the encrypted data.

[0025] In the above scheme, the key information and key relay ciphertext also carry the encryption algorithm and encryption ratio when the quantum key encrypts the plaintext.

[0026] In the above scheme, the previous-hop edge device also sends a first encryption algorithm and a first encryption ratio for encrypting the key relay information to the next-hop edge device, and the previous-hop edge device calculates the checksum C4 by calculating the first key index, the key for encrypting the key relay information, the first encryption algorithm, and the first encryption ratio;

[0027] The next-hop edge device obtains the checksum C4 by calculating the retrieved key used to encrypt the key relay information and the received first key index, the first encryption algorithm, and the first encryption ratio.

[0028] Compared with the prior art, the beneficial effects of the present invention are as follows: the method of the present application pre-shares the first key set between the sending end and the relay node; during relaying, the sending end calculates the key information and the quantum key to be relayed to obtain the checksum C1, and the relay node uses the key index in the received key information to retrieve the quantum key from the first key set stored therein, and then calculates the checksum C′1 for the retrieved quantum key and the received key information through the corresponding verification algorithm, and by verifying whether C′1 is the same as C1, it can be determined whether the key relay is abnormal; at the same time, in this process, only the quantum key index is transmitted between the sending end and the relay node, and the real quantum key is not transmitted, which reduces the possibility of its leakage, thereby further ensuring the security of the relayed quantum key. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a schematic diagram of the process of Example 2 of the present application;

[0030] Figure 2 This is a schematic diagram of the process of Example 3 of the present application;

[0031] Figure 3 This is a schematic diagram of the process of Example 4 of the present application;

[0032] Figure 4 This is a diagram of a local area network system consisting of a sending end and a receiving end in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0034] Embodiment 1: A key relay method for a quantum secure network, the method comprising:

[0035] The first key set is shared between the transmitting end and the relay node, that is, the transmitting end and the relay node both store the same key set; wherein the first key set includes a plurality of quantum keys, and the quantum keys are generated by a quantum true random number generator;

[0036] The sending end generates key information to be relayed, calculates the key information and the quantum key used for encryption by a first verification algorithm to obtain a checksum C1, and sends the key information and the checksum C1 to the relay node; wherein the quantum key to be relayed refers to the quantum key used by the sending end to encrypt data;

[0037] The key information includes a quantum key index for indicating the quantum key index relationship, and the quantum key is selected from the first key set; only the key index is sent between the sending end and the relay node, and the real quantum key for encrypting data is not sent, so the security of communication between the two can be guaranteed;

[0038] When the sending end communicates with the receiving end, the quantum key in the first key set previously paired with the relay node is used to encrypt the data to be sent to form encrypted data; wherein the encrypted data is sent to the receiving end through the Internet device, and the quantum key used for encryption, i.e., the quantum key to be relayed, is relayed to the receiving end through the relay node. After receiving the encrypted data and the relayed quantum key, the receiving end uses them to decrypt the data to obtain the data plaintext;

[0039] The transmitting end and the receiving end in this embodiment are terminals or systems using quantum encryption technology, which encrypt the transmitted data by using quantum random numbers; for example, the system involved in the patent application document with Chinese patent application number CN201510325943.6 and the name of mobile terminal security system and method based on quantum true random numbers, and the quantum terminal mentioned in the patent application document with Chinese patent application number CN201611255339.1;

[0040] Another example Figure 4The local area network system shown in the figure includes an access base station B1, an access base station B2, a border base station, a key generator, a gateway and user terminals P1-P4, wherein the key generator is a random number generator for generating true random numbers as quantum keys, the access base station B1, the access base station B2, the border base station and the key center can be servers, the user terminals P1-P4 represent quantum security terminals, the key generator generates quantum keys and sends them to the key center, which is distributed by the key center to the access base station B1, the access base station B2 and the user terminals P1-P4, user terminals P1 and P3 are connected to access base station B1, and user terminals P2 and P4 are connected to access base station B2; when user terminals P1 and P2 communicate in a local area network, the quantum key is relayed through the path of user terminal P1→access base station B1→access base station B2→user terminal P2; when communicating between local area networks, the quantum key is relayed through the path of user terminal P1→access base station B1→border base station→border base station of the next-hop local area network→access base station of the opposite end→receiving end;

[0041] The relay node receives the key information and the checksum C1, takes out the quantum key from the first key set of the relay node according to the quantum key index in the key information, and uses the first verification algorithm to calculate the received key information and the taken out quantum key to obtain the checksum C′1, verifies whether the checksum C′1 is the same as the checksum C1, and if the verification result is the same, sends the taken out quantum key to the receiving end, and if the verification result is different, stops the key relay; the checksum C1 is obtained by the sending end calculating the real encrypted quantum key and the key information together, so when the relay node performs verification, it needs to first determine the quantum key to be relayed by the sending end according to the quantum key index in the key information, and then calculate it with the received key information to verify whether the key relay between the two is correct.

[0042] After the relay node determines the quantum key according to the quantum key index, in order to ensure that no abnormal relay error occurs during the quantum key relay between the relay node and the next-hop edge device or the receiving end, before sending the quantum key to the receiving end, the relay node further calculates the extracted quantum key through a second verification algorithm to obtain a checksum C2, and sends the second verification algorithm and the checksum C2 to the receiving end;

[0043] The receiving end receives the second verification algorithm and the checksum C2, calculates the received quantum key through the second verification algorithm to obtain the checksum C′2, and determines whether the received quantum key is correct based on whether the checksum C′2 is the same as the checksum C2.

[0044] In order to ensure the security of key transmission between the relay node and the receiving end, the method further includes:

[0045] The relay node shares a second key set with the receiving end, that is, the receiving end and the node it connects to also perform key pairing in advance, and the same second key set is stored in both; the second key set is similar to the first key set, and is also composed of multiple quantum true random numbers;

[0046] When the verification result of the checksum C′1 is the same as the checksum C1, the relay node encrypts the extracted quantum key and the checksum C2 using the key in its second key set to form a key relay ciphertext, generates a transmission key index, and the transmission key index is used to indicate the index relationship of the key for encrypting the extracted quantum key and the checksum C2, and sends the key relay ciphertext and the transmission key index to the receiving end;

[0047] The receiving end receives the key relay ciphertext and the transmission key index, determines the decryption key in the second key set of the receiving end according to the transmission key index, so as to decrypt the key relay ciphertext to obtain the quantum key and the checksum C2; that is, when relaying the key between the relay node and the receiving end, the quantum key, that is, the transmission key, is also used for encrypted transmission, thereby further ensuring the security of the transmission process.

[0048] In order to ensure the reliability of key relay between the relay node and the receiving end, before the relay node sends the key relay ciphertext and the transmission key index to the receiving end, the relay node also calculates the transmission key index and the key corresponding to the transmission key index by a third verification algorithm to obtain a checksum C3, and then sends the checksum C3 to the receiving end;

[0049] The receiving end receives the checksum C3, and uses the third check algorithm to calculate the key corresponding to the transmission key index and the transmission key index to obtain the checksum C′3, and judges whether the key relay is correct based on whether the checksum C′3 is the same as the checksum C3; that is, when the checksum C′3 is the same as the checksum C3, it indicates that the key relay between the two is correct, otherwise the key relay is incorrect.

[0050] In order to improve the reliability of quantum key relaying across the Internet, when the relay node includes an edge device between a local area network or a wide area network, that is, the key relay process passes through an edge device between a local area network or a wide area network, a third key set is shared between the previous hop edge device and the next hop edge device;

[0051] The previous-hop edge device receives the key relay information from the previous-hop relay node, encrypts the key relay information by using the key in the third key set to form a first key relay ciphertext, and generates a first key index, where the first key index is used to indicate the index relationship of the key for encrypting the key relay information; then uses a fourth check algorithm to calculate the first key index and the key for encrypting the key relay information to obtain a checksum C4; queries and determines the next-hop edge device according to the location identifier, and then sends the checksum C4, the first key index, and the first key relay ciphertext to the next-hop edge device;

[0052] The next-hop edge device receives the checksum C4, the first key index, and the first key relay ciphertext; searches and retrieves the key used to encrypt the key relay information according to the first key index, calculates the retrieved key used to encrypt the key relay information and the first key index using the fourth verification algorithm to obtain the checksum C′4, verifies whether the checksum C′4 is the same as the checksum C4, and if so, continues the key relay, otherwise stops the key relay;

[0053] by Figure 4 Taking the LAN system shown as an example, when two LANs communicate, the above-mentioned checksum C′4 and checksum C4 are verified between the boundary base station of the previous LAN and the boundary base station of the next LAN to improve the reliability of quantum key relay across the Internet.

[0054] If the relay node includes multiple ones, the sending end also carries the location identifier of the receiving end when sending the key information, and the relay node determines the next-hop edge device according to the location identifier. In this embodiment, the location identifier is the network access ID of the receiving end, and the network access ID includes an address identifier for indicating the geographical location of the receiving end. The previous-hop relay node queries the routing table according to the received network access ID to obtain the next-hop relay node, so as to perform the next step of key relay;

[0055] Among them, the network access ID is a logical division based on geography and networking. The quantum security networks located in different geographical locations are divided uniformly from large to small, so that each quantum security network has a globally unique network location identifier. The devices in each quantum security network are uniformly numbered based on the network location identifier, and there is a globally unique identifier for the network device. Each network device has a unified coding identifier for the users connected to it. Then, each quantum security terminal is a quantum security terminal under a network device under a network location identifier, which means that this quantum security user terminal has a globally unique network location identity identifier, namely the network access ID.

[0056] When the transmitting end sends the encrypted data formed by encrypting the plaintext with the quantum key to the receiving end, the transmitting end further calculates the plaintext by using the fifth verification algorithm to obtain a checksum C5, and sends the encrypted data and the checksum C5 to the receiving end via the Internet;

[0057] The receiving end receives the encrypted data and the checksum C5, calculates the checksum C′5 for the plaintext obtained after decryption, and determines whether the encrypted data is decrypted correctly according to whether the checksum C′5 is the same as the checksum C5;

[0058] The real encrypted quantum key is calculated and verified during the key relay process, and is also calculated and verified during encrypted data transmission. That is, the verification of the above checksum C2 and checksum C5 ensures the reliability of encrypted data decryption;

[0059] The key information and key relay ciphertext also carry the encryption algorithm and encryption ratio when the quantum key encrypts the plaintext. In quantum encryption technology, the quantum key and the data to be encrypted are usually encrypted in a 1:1 ratio, but the encryption ratio is sometimes changed to save the key. Therefore, in the key relay process, it is sometimes necessary to transmit the encryption ratio information and the corresponding encryption algorithm to facilitate subsequent decryption.

[0060] The previous-hop edge device also sends a first encryption algorithm and a first encryption ratio for encrypting the key relay information to the next-hop edge device, and the previous-hop edge device calculates a checksum C4 by calculating the first key index, the key for encrypting the key relay information, the first encryption algorithm, and the first encryption ratio;

[0061] The next-hop edge device calculates the checksum C′4 by taking out the key used to encrypt the key relay information and the received first key index, the first encryption algorithm and the first encryption ratio;

[0062] The above-mentioned first verification algorithm, second verification algorithm, third verification algorithm, fourth verification algorithm and fifth verification algorithm can all use the same verification algorithm. In order to further improve the reliability and security of verification, different verification algorithms can also be used; the verification algorithm can be reasonably set according to the equipment performance and user needs, for example, CRC-32, Adler-32, Flethcer-32, etc., which are not limited here.

[0063] Example 2: See Figure 4In this embodiment, the user terminal P1 and the user terminal P2 represent two quantum security terminals respectively, and both quantum security terminals are connected to the relay node, and the relay node includes the access base station B1 and the access base station B2; wherein, the user terminal P1 is accessed under the access base station B1, and the user terminal P2 is accessed under the access base station B2, and the user terminal P1 and the access base station B1 are paired with a first key set, and the user terminal P2 and the access base station B2 are paired with a second key set; when the user terminal P1 and the user terminal P2 communicate, it is necessary to relay the quantum key in the path of P1→B1→B2→P2; for details, refer to the process of the following steps S101-S109;

[0064] S101: Obtain the destination identifier of the relay key, that is, the network ID (denoted as RID), which here refers to the RID of the user terminal P2;

[0065] S102: The user terminal P1 generates key information to be relayed, calculates the key information and the quantum key using a first verification algorithm to obtain a checksum C1, and sends the key information and the checksum C1 to the access base station B1; wherein the key information includes: a key index, an encryption algorithm, an encryption ratio, and an RID corresponding to the quantum key;

[0066] The encryption algorithm and encryption ratio here are the encryption algorithm and encryption ratio corresponding to when the user end P1 uses the quantum key to encrypt the plaintext; after receiving the relayed quantum key, the user end P2, as the receiving end, combines the encryption algorithm and encryption ratio corresponding to the encryption to decrypt the ciphertext;

[0067] S103: The access base station B1 receives the key information and the checksum C1, extracts the quantum key from the first key set paired with the user terminal P1 according to the key index in the key information, and calculates the extracted quantum key and the received key information by using the first check algorithm to obtain the checksum C1';

[0068] S104: Access base station B1 to verify whether the checksum C1' is the same as the checksum C1, if they are the same, execute steps S105-S109, if they are not the same, stop relaying;

[0069] S105: The access base station B1 calculates the extracted quantum key using the second verification algorithm to obtain the checksum C2, queries and determines the next hop access base station B2 according to the RID in the key information, and sends the key relay information and the checksum C2 to the access base station B2; wherein the key relay information includes the extracted quantum key, encryption algorithm, encryption ratio and RID;

[0070] S106: The access base station B2 receives the key relay information and the checksum C2, removes the RID from the key relay information to form a key relay package, encrypts the key relay package by using the key paired with the user terminal P2 to form a key relay ciphertext, and generates an index of the key used to encrypt the key relay package, i.e., the encryption key index; then uses a third check algorithm to calculate the encryption key index, the encryption key, the encryption algorithm and the encryption ratio for encrypting the key relay package to obtain the checksum C3, and sends the key relay ciphertext, the encryption key index, the encryption algorithm and the encryption ratio for encrypting the key relay package, and the checksum C3 to the user terminal P2;

[0071] The encryption algorithm and encryption ratio here refer to the encryption algorithm and encryption ratio used when the access base station B2 encrypts the key relay packet;

[0072] S107: The user terminal P2 receives the key relay ciphertext, the encryption key index, the encryption algorithm and encryption ratio for encrypting the key relay package, and the checksum C3; searches and retrieves the encryption key according to the encryption key index, and calculates the retrieved encryption key, the received encryption key index, and the encryption algorithm and encryption ratio for encrypting the key relay package using a third check algorithm to obtain the checksum C3';

[0073] S108: Verify whether the checksum C3' is the same as the checksum C3. If they are the same, execute step S109. Otherwise, the key relay fails and the operation stops.

[0074] S109: The user terminal P2 decrypts the key relay ciphertext according to the extracted encryption key to obtain a key relay package, calculates the decrypted quantum key through the second verification algorithm to obtain the checksum C2', and verifies whether the checksum C2' is the same as the checksum C2. If they are the same, it means that the relayed key is correct, otherwise, the relayed key is wrong.

[0075] In the scheme of the above-mentioned embodiment 2, steps S101-S105 ensure the reliability of the relay of the key information and the retrieved quantum key between the user terminal P1 and the access base station B1 by verifying whether the checksum C1' is the same as the checksum C1; steps S106-S109, on the one hand, encrypt the key relay information to be transmitted to improve the security of the transmission process, and on the other hand, ensure the reliability of the encryption key transmitted between the access base station B2 and the user terminal P2 for encrypting the quantum key to be relayed by verifying whether the checksum C3 is the same as the checksum C3'; thereafter, the user terminal P2 verifies whether the checksum C2 of the quantum key in the relay packet is the same as the checksum C2' to determine whether the quantum key itself is relayed correctly.

[0076] Example 3: See Figure 2The relay node in this embodiment includes at least one edge device of a local area network or a wide area network, wherein the edge device includes a border base station; the quantum key relay process passes through the border base station, and in order to ensure the correctness of the quantum key relay, a check and comparison is also performed between the border base station and the next relay node or the next border base station; see the process of steps S201-S209 for details;

[0077] S201: If the quantum key relay passes through a border base station;

[0078] S202: The previous-hop boundary base station receives the key relay information from the access base station in the previous local area network; encrypts the key relay information by using the key paired with the next-hop boundary base station to form a first key relay ciphertext, and generates the index of the key used to encrypt the key relay information, i.e., the first key index; then uses the fourth verification algorithm to calculate the first key index, the first key corresponding to the first key index, the first encryption algorithm for encrypting the key relay information, and the first encryption ratio to obtain a checksum C4; queries and determines the next-hop boundary base station according to the RID, and sends the checksum C4, the first key index, the first encryption algorithm, the first encryption ratio, and the first key relay ciphertext to the next-hop boundary base station;

[0079] Key pairing is also performed between border base stations. During the transmission of key relay information, the paired key is used for encryption to further improve security.

[0080] S203: The next-hop boundary base station receives the checksum C4, the first key index, the first encryption algorithm, the first encryption ratio, and the first key relay ciphertext; determines the first key used for encryption according to the first key index, and calculates the first key and the received first key index, the first encryption algorithm, and the first encryption ratio to obtain the checksum C4';

[0081] S204: Verify whether the checksum C4' is the same as the checksum C4, if they are the same, execute steps S205-S209, otherwise stop relaying;

[0082] S205: The next-hop boundary base station decrypts the first key relay ciphertext by using the first key to obtain the key relay information plaintext, queries and determines the next-hop access base station according to the RID, and sends the key relay information plaintext to the next-hop access base station;

[0083] S206: The next-hop boundary base station receives the key relay information plaintext, removes the RID from the key relay information plaintext to form a key relay package, encrypts the key relay package by using the key paired with the receiving end to form a second key relay ciphertext, and generates an index of the key used to encrypt the key relay package, i.e., a second key index; then uses a third check algorithm to calculate the second key index, the second key, the second encryption algorithm for encrypting the key relay package, and the second encryption ratio to obtain a checksum C3, and sends the second key relay ciphertext, the second key index, the second encryption algorithm, the second encryption ratio, and the checksum C3 to the receiving end;

[0084] S207: The receiving end receives the second key relay ciphertext, the second key index, the second encryption algorithm, the second encryption ratio and the checksum C3, searches and retrieves the second key according to the second key index, and calculates the retrieved second key and the received second key index, the second encryption algorithm and the second encryption ratio to obtain the checksum C3';

[0085] S208: Verify whether the checksum C3 is the same as the checksum C3', if they are the same, execute step S209, if they are not the same, stop the operation;

[0086] S209: The receiving end decrypts the second key relay ciphertext according to the retrieved second key to obtain the key relay package plaintext, calculates the decrypted quantum key using the second verification algorithm to obtain the checksum C2', and verifies whether the checksum C2' is the same as the checksum C2. If they are the same, it indicates that the relayed key is correct, otherwise, it indicates that the relayed key is wrong.

[0087] The above steps S202-S204 improve the reliability of quantum key relay across the Internet by verifying whether the check sum C4' is the same as the check sum C4, that is, the reliability of key relay between a border base station between two local area networks or wide area networks, or between a local area network border base station and a relay node of another local area network; steps S202-S204 are the relay process between the edge device, the relay node and the receiving end, wherein the key relay between the relay node and the receiving end is consistent with the scheme of Example 2.

[0088] Embodiment 4: In this embodiment, when a quantum security terminal as a sending end sends encrypted data formed by encrypting a plaintext with a quantum key to another quantum security terminal via the Internet, the quantum security terminal as a receiving end also calculates the encrypted data. After receiving the relayed quantum key, the quantum security terminal uses the quantum key to decrypt the encrypted data to obtain the plaintext, and then verifies and compares the plaintext to ensure the correctness of the decryption; see steps S301-S302 for details;

[0089] S301: When the sending end sends the encrypted data formed by encrypting the plaintext by the quantum key to the receiving end, the sending end also calculates the plaintext by the fifth verification algorithm to obtain the checksum C5, and sends the encrypted data and the checksum C5 to the receiving end via the Internet;

[0090] S302: The receiving end receives the encrypted data and the checksum C5, and uses the fifth checksum algorithm to calculate the plaintext obtained after decryption to obtain the checksum C5', and determines whether the encrypted data is decrypted correctly based on whether the checksum C5' is the same as the checksum C5.

Claims

1. A key relay method for a quantum secure network, characterized in that: The method comprises: a transmitting end and a relay node share a first key set; The sending end generates key information to be relayed, calculates the key information and the quantum key used for encryption by a first verification algorithm to obtain a checksum C1, and sends the key information and the checksum C1 to the relay node; the key information includes a quantum key index for indicating the quantum key index relationship, and the quantum key is selected from the first key set; The relay node receives the key information and the checksum C1, retrieves the quantum key from the first key set of the relay node according to the quantum key index in the key information, and calculates the received key information and the retrieved quantum key using a first check algorithm to obtain a checksum C1 ′ , verify the checksum C1 ′ and checking whether the result is the same as the checksum C1, if the verification result is the same, sending the extracted quantum key to the receiving end, otherwise, stopping the key relay; the method also includes: The relay node calculates the retrieved quantum key by using a second verification algorithm to obtain a checksum C2, and sends the checksum C2 to the receiving end; The receiving end receives the checksum C2, and calculates the received quantum key using a second check algorithm to obtain the checksum C2 ′ , verify the checksum C2 ′ Is it the same as the checksum C2? If it is verified to be the same, it means that the received quantum key is correct. Otherwise, it means that the received quantum key is wrong. The method further comprises: The relay node shares a second key set with the receiving end; The relay node encrypts the extracted quantum key and checksum C2 using a key in its second key set to form a key relay ciphertext, generates a transmission key index, and the transmission key index is used to indicate an index relationship of the key for encrypting the extracted quantum key and checksum C2, and then sends the key relay ciphertext and the transmission key index to the receiving end; The receiving end receives the key relay ciphertext and the transmission key index, and determines a decryption key in the second key set of the receiving end according to the transmission key index to decrypt the key relay ciphertext to obtain the quantum key and the checksum C2.

2. The key relay method for a quantum secure network according to claim 1, characterized in that: Before the relay node sends the key relay ciphertext and the transmission key index to the receiving end, the relay node also calculates the transmission key index and the key corresponding to the transmission key index by a third verification algorithm to obtain a checksum C3, and then sends the checksum C3 to the receiving end; The receiving end receives the checksum C3, and uses a third check algorithm to calculate the key corresponding to the transmission key index and the transmission key index to obtain the checksum C3 ′ , verify the checksum C3 ′ Whether it is the same as the checksum C3, if the check result is the same, it means that the key relay is correct, otherwise, it means that an error occurs in the key relay.

3. The key relay method for a quantum secure network according to any one of claims 1 to 2, characterized in that: If the relay nodes include multiple ones, the sending end also carries the location identifier of the receiving end when sending the key information, and the relay node determines the next-hop relay node according to the location identifier.

4. The key relay method for a quantum secure network according to claim 3, characterized in that: The location identifier is the network access ID of the receiving end, and the network access ID includes an address identifier for indicating the geographical location of the receiving end.

5. The key relay method for a quantum secure network according to claim 3, characterized in that: If the relay node includes an edge device between a local area network or a wide area network, a third key set is shared between the previous hop edge device and the next hop edge device; The previous-hop edge device receives the key relay information, encrypts the key relay information by using the key in the third key set to form a first key relay ciphertext, and generates a first key index, where the first key index is used to indicate the index relationship of the key for encrypting the key relay information; then uses the fourth verification algorithm to calculate the first key index and the key for encrypting the key relay information to obtain a checksum C4; queries and determines the next-hop edge device according to the location identifier, and then sends the checksum C4, the first key index, and the first key relay ciphertext to the next-hop edge device; The next-hop edge device receives the checksum C4, the first key index and the first key relay ciphertext; The key used to encrypt the key relay information is searched and retrieved according to the first key index, and the checksum C4 is obtained by calculating the retrieved key used to encrypt the key relay information and the first key index using the fourth check algorithm. ′ , verify the checksum C4 ′ Check whether it is the same as the checksum C4. If so, continue key relaying; otherwise, stop key relaying.

6. The key relay method for a quantum secure network according to claim 1, characterized in that: When the transmitting end sends the encrypted data formed by encrypting the plaintext with the quantum key to the receiving end, the transmitting end further calculates the plaintext by using the fifth verification algorithm to obtain a checksum C5, and sends the encrypted data and the checksum C5 to the receiving end via the Internet; The receiving end receives the encrypted data and the checksum C5, and calculates the plaintext obtained after decryption to obtain the checksum C5 ′ , verify the checksum C5 ′ Whether it is the same as the checksum C5, if the verification result is the same, it means that the encrypted data is decrypted correctly, otherwise, it means that an error occurs in the decryption of the encrypted data.

7. The key relay method for a quantum secure network according to claim 1, characterized in that: The key information and key relay ciphertext also carry the encryption algorithm and encryption ratio when the quantum key encrypts the plaintext.

8. The key relay method for a quantum secure network according to claim 5, characterized in that: The previous-hop edge device also sends a first encryption algorithm and a first encryption ratio for encrypting the key relay information to the next-hop edge device, and the previous-hop edge device calculates a checksum C4 by calculating the first key index, the key for encrypting the key relay information, the first encryption algorithm, and the first encryption ratio; The next-hop edge device calculates the checksum C4 by taking out the key used to encrypt the key relay information and the received first key index, the first encryption algorithm and the first encryption ratio. ′ .

Images