A multi-path key relay method, quantum key distribution device and system

Abstract

The application provides a multi-path key relay method, a quantum key distribution device and a system. Different multi-paths are selected for key relay, and relay key data of the multi-paths is mixed through convolution operation. A pre-agreed security key is added in an HMAC operation process to generate a shared key. Compared with a method of using a single-path relay route for key relay, the application fully utilizes network resources, improves the throughput of key relay, and can simultaneously improve the security and the speed of key relay.

Description

Technical Field

[0001] This invention belongs to the field of encrypted communication technology of quantum cryptography networks, and specifically relates to a multi-path key relay method, a quantum key distribution device and system. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Network terminals obtain a shared key through key relay, and using this shared key to encrypt data is one of the main methods for achieving quantum key encrypted communication in quantum cryptography networks. Currently, single-path relay routing is the primary method for implementing key relay.

[0004] The general method for single-path relay routing is as follows: First, each key relay node obtains the network topology used to determine the key relay routing path through a topology update method. Then, the relay node uses the network topology to calculate the shortest route from itself to the destination node. It then encrypts its relay key data using a quantum key shared with the next node and sends it to the next node. The next node decrypts the encrypted data to obtain the relay key data.

[0005] The drawback of single-path relay routing is that the relay key data is exposed to every relay node. The security of the relay key becomes overly dependent on the security of the relay nodes; that is, if any relay node on the routing path is insecure, the relay key becomes insecure. Furthermore, like classic network data routing, key relay routing also suffers from relay path congestion. Single-path relay routing algorithms cannot achieve or even approach the maximum throughput of network key relay.

[0006] With the construction and development of quantum cryptography networks, their network structure is becoming increasingly complex, and their multi-connectivity is getting better and better. Single-path relay routing cannot make full use of the current network environment and cannot fully improve the network's throughput and key relay speed in terms of key relay.

[0007] Therefore, many researchers have turned their attention to multi-path relay. However, according to the inventors, current multi-path relay routing cannot simultaneously meet the requirements of both key relay security and increased key relay capacity. Taking patent CN 105827397 A as an example, it discloses a quantum key distribution system, method, and apparatus based on trusted relays. This patent scheme, based on a mesh topology formed by interconnected routing devices, performs key negotiation along multiple paths between the sending and receiving quantum key distribution devices. It uses a pre-set strategy to determine whether the shared keys obtained from the multi-path negotiation need to be merged and performs the corresponding merging operation. However, this patent scheme cannot simultaneously address both key relay security and increased key relay capacity. It either reduces the actual number of keys generated by using XOR operations to increase security, or it increases the number of relay keys through multi-path key relay while ignoring the insecurity caused by the untrustworthiness of individual relay nodes. Summary of the Invention

[0008] To address the aforementioned problems, this invention proposes a multi-path key relay method, a quantum key distribution device, and a system. This invention can simultaneously improve the security and speed of key relay.

[0009] According to some embodiments, the present invention adopts the following technical solution:

[0010] The primary objective of this invention is to provide a multi-path key relay method. This method utilizes Fast Fourier Transform (FFT) to thoroughly mix the keys from multiple relay paths through convolution operations. Even if an attacker obtains partial relay keys by attacking some relay paths, it will be difficult to extract partial key information from the key data, thus ensuring the security of the key relay. Simultaneously, the FFT operation increases the speed of convolution operations, accelerating the calculation of key generation. This achieves a balance between key relay security, key relay speed, and the amount of relay keys.

[0011] A multipath key relay method includes the following steps:

[0012] Select multiple different paths for key relay, and mix the relay key data from multiple paths through convolution operation;

[0013] A pre-negotiated security key is added during the HMAC operation to generate a shared key.

[0014] As an alternative implementation method, the specific process of selecting multiple different paths for key relay includes: selecting multiple key relay paths that do not have a common relay node, obtaining the corresponding relay keys for each path, and ensuring that each relay key is of equal length.

[0015] As an alternative implementation method, the specific process of mixing relay key data from multiple paths through convolution operations includes: sequentially concatenating each relay key data to generate key data, and performing a fast Fourier transform on the key data.

[0016] As an alternative implementation method, the specific process of performing a fast Fourier transform on the key data includes:

[0017] The key data is lengthened, and then a Fast Fourier Transform is performed on the lengthened data.

[0018] Generate or receive random numbers, extend their length, and perform a Fast Fourier Transform on the extended random numbers;

[0019] Multiply the results of the two length expansions in digits, and then perform an inverse fast Fourier transform on the result.

[0020] A portion of the data is extracted from the inverse fast Fourier transform result as the final key.

[0021] As an alternative implementation, the specific process of adding a pre-negotiated security key during the HMAC operation includes: dividing the data generated by the fast Fourier transform into several data with the same length as the preset HMAC operation result data, and performing HMAC operation on each of the divided data with respect to the security key.

[0022] As an alternative implementation method, the specific process of generating a shared key includes: the source node and the destination node concatenate the obtained HMAC operation results in the same order to obtain a shared key.

[0023] More specifically:

[0024] A multipath key relay method, described from the source node end, includes the following steps:

[0025] Negotiate a security key with the destination node;

[0026] Select multiple paths for key relay;

[0027] The relay key data of the multiple paths are connected in the same order as the destination node to generate key data;

[0028] Perform a Fast Fourier Transform on the key data to generate a second data set of the same length as the key data.

[0029] The second data is divided into several data with the same length as the preset HMAC operation result data, and an HMAC operation with respect to the security key is performed on each of the divided data.

[0030] The HMAC operation results are concatenated in the same order as the destination node to generate a shared key.

[0031] As an alternative implementation method, the specific process of negotiating a security key includes: the source node selects multiple key relay paths that do not have a common relay node, obtains the corresponding relay keys respectively, and each key is of equal length.

[0032] As an alternative implementation method, the specific process of performing a fast Fourier transform on the key data includes:

[0033] The key data is lengthened, and then a Fast Fourier Transform is performed on the lengthened data.

[0034] Generate a random number, extend its length, perform a Fast Fourier Transform on the extended random number, and send the random number to the destination node;

[0035] Multiply the results of the two length expansions in digits, and then perform an inverse fast Fourier transform on the result.

[0036] A portion of the data is extracted from the inverse fast Fourier transform result and used as the second data.

[0037] A multipath key relay method, described from the destination node perspective, includes the following steps:

[0038] Negotiate the security key with the source node;

[0039] Obtain the multiple key relay paths selected by the source node;

[0040] The relay key data of the path is connected in the same order as the source node to generate key data;

[0041] Perform a Fast Fourier Transform on the key data to generate a second data set of the same length as the key data.

[0042] The second data is divided into several data with the same length as the preset HMAC operation result data, and an HMAC operation with respect to the security key is performed on each of the divided data.

[0043] The HMAC operation results are concatenated in the same order as the source nodes to generate a shared key.

[0044] As an alternative implementation method, the specific process of performing a fast Fourier transform on the key data includes:

[0045] The key data is lengthened, and then a Fast Fourier Transform is performed on the lengthened data.

[0046] Receive the random number sent by the source node, extend its length, and perform a fast Fourier transform on the extended random number;

[0047] Multiply the results of the two length expansions in digits, and then perform an inverse fast Fourier transform on the result.

[0048] A portion of the data is extracted from the inverse fast Fourier transform result and used as the second data.

[0049] A multipath key relay method includes the following steps:

[0050] The source node and the destination node negotiate the security key;

[0051] The source node selects multiple paths for key relay;

[0052] The source node and the destination node perform connection operations on the relay key data of the multiple paths in the same order to generate key data;

[0053] The source node and the destination node perform a Fast Fourier Transform on the key data to generate second data of the same length as the key data.

[0054] The source node and the destination node divide the second data into several data sets with the same length as the preset HMAC operation result data, and perform HMAC operation on the security key for each group of data sets.

[0055] The source node and the destination node concatenate the HMAC operation results in the same order to generate a shared key.

[0056] As an alternative implementation method, the specific process of negotiating a security key includes: the source node selects multiple key relay paths that do not have a common relay node, obtains the corresponding relay keys respectively, and each key is of equal length.

[0057] As an alternative implementation method, the specific process of performing a fast Fourier transform on the key data includes:

[0058] The source node extends the length of the key data and performs a Fast Fourier Transform on the extended data; the destination node performs the same transformation.

[0059] The source node generates a random number and extends its length. Then, it performs a Fast Fourier Transform on the extended random number. The source node sends the random number to the destination node, which performs the same transformation.

[0060] The source node and the destination node multiply the results of the two length expansions in digits, and then perform an inverse fast Fourier transform on the multiplied result.

[0061] The source node and the destination node each extract a portion of data from the inverse fast Fourier transform result as the second data.

[0062] As a further defined implementation, the destination node and source node keep the random number unchanged when transforming the multipath relay key.

[0063] As a further defined implementation, the length is extended by padding with zeros at the end.

[0064] As an alternative implementation, the HMAC operation is HMAC-MD5.

[0065] A second objective of this invention is to provide a quantum key distribution device that negotiates a shared key with a peer quantum key distribution device using the aforementioned key relay method.

[0066] A quantum key distribution device includes a processor and a computer-readable storage medium, the processor being used to implement various instructions; the computer-readable storage medium being used to store multiple instructions adapted for loading by the processor and executing steps in the multipath key relay method described above.

[0067] A quantum key distribution device, comprising:

[0068] This module is used to select different multiple paths for key relay and to mix the relay key data of multiple paths through convolution operations.

[0069] A module used to add a pre-negotiated security key during HMAC operations to generate a shared key.

[0070] A quantum key distribution device, comprising:

[0071] The first module used for negotiating the security key;

[0072] The second module is used to perform concatenation operations on relay key data from multiple key relay paths to generate key data.

[0073] The third module is used to perform a fast Fourier transform on the key data to generate second data of the same length as the key data;

[0074] The fourth module is used to divide the second data into several data with the same length as the preset HMAC operation result data, and to perform HMAC operation on each of the divided data with respect to the security key.

[0075] The fifth module is used to concatenate the obtained HMAC operation results in the same order as the peer to generate a shared key.

[0076] As an alternative implementation, the third module includes:

[0077] This module is used to extend the length of key data and perform a fast Fourier transform on the extended data.

[0078] A module used to generate or receive random numbers, extend their length, and perform a fast Fourier transform on the extended random numbers.

[0079] This module is used to multiply the results of two length expansions in digits and perform an inverse fast Fourier transform on the result.

[0080] This module is used to extract a portion of the data from the inverse fast Fourier transform result as the second data.

[0081] The third objective of this invention is to provide a key distribution system that utilizes quantum key distribution equipment, routing equipment, and data equipment to achieve multi-path key distribution and data interaction, while also taking into account the security, speed, and amount of relay keys of key relay.

[0082] A key distribution system includes several quantum key distribution devices, routing devices, and data devices, wherein each quantum key distribution device is connected to at least two routing devices, each quantum key distribution device is connected to at least one data device, and the routing devices are interconnected to form a network topology.

[0083] The quantum key distribution device is used to select multiple different paths for key relay, mix the relay key data of multiple paths through convolution operation, and add a pre-negotiated security key during the HMAC operation to generate a shared key.

[0084] A key distribution system includes several quantum key distribution devices, routing devices, and data devices, wherein each quantum key distribution device is connected to at least two routing devices, each quantum key distribution device is connected to at least one data device, and the routing devices are interconnected to form a network topology.

[0085] The quantum key distribution device is used to negotiate a security key with the peer quantum key distribution device. It uses multiple different paths to relay keys with the peer quantum key distribution device. The relay key data of each path are connected in the same order to generate key data. The key data is subjected to a fast Fourier transform to generate second data of the same length as the key data. The second data is divided into several data with the same length as the preset HMAC operation result data. HMAC operation with respect to the security key is performed on each group of data. The obtained HMAC operation results are connected in the same order as the peer quantum key distribution device to generate a shared key.

[0086] As an alternative implementation, the multiple paths refer to multiple paths that do not share a common relay node.

[0087] As an alternative implementation, the quantum key distribution device is also used to receive different paths and random numbers sent by the peer quantum key distribution device.

[0088] As an alternative implementation, the routing device is used to relay keys and forward encrypted data, and also to receive paths sent by the quantum key distribution device.

[0089] As an alternative implementation, the relay keys for each path are of equal length.

[0090] As an alternative implementation, the quantum key distribution device is also used to extend the length of the key data and perform a fast Fourier transform on the extended data.

[0091] As an alternative implementation, the quantum key distribution device is also used to generate or receive random numbers, extend their length, and perform a fast Fourier transform on the extended random numbers.

[0092] As an alternative implementation, the quantum key distribution device is also used to perform positional multiplication of the result of key data length expansion and random number data length expansion, and to perform inverse fast Fourier transform on the multiplied result.

[0093] As an alternative implementation, the quantum key distribution device is also used to extract a portion of the data from the inverse fast Fourier transform result as the second data.

[0094] As a further defined implementation, the quantum key distribution device is configured to maintain the random number unchanged when transforming multipath relay keys.

[0095] As a further defined implementation, the quantum key distribution device extends its length by padding with trailing zeros.

[0096] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0097] Compared with the method of key relay using single-path relay routing, the present invention makes full use of network resources and improves the throughput of key relay by using multi-path key relay.

[0098] This invention utilizes Fast Fourier Transform (FFT) and the convolution operation of multi-path relay key data fully mixes the relay key data of each key relay path, improving the speed of convolution operation, accelerating the generation speed of the final key, and ensuring an increase in the number of relay keys.

[0099] This invention incorporates new key information into the HMAC operation process, making it impossible for attackers to obtain information about the security key, let alone the final key information, thereby increasing the security of the relay key.

[0100] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0101] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0102] Figure 1 This is a schematic diagram of the multi-path key relay method in Embodiment 1;

[0103] Figure 2 This is a schematic diagram of the quantum key distribution device in Example 6;

[0104] Figure 3 This is a schematic diagram of the key distribution system structure in Example 7. Detailed implementation method:

[0105] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0106] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0107] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0108] As described in the background section, the prior art has the following drawbacks:

[0109] The security of relay keys in single-path relay routing relies excessively on the security of relay nodes; single-path relay routing cannot make full use of the current network environment and cannot adequately improve the network's throughput and speed in key relay.

[0110] Current multipath relay cannot simultaneously address both the security of key relay and the need to increase the number of key relays.

[0111] To this end, this invention proposes a multi-path key relay method, device, and system based on FFT (Fast Fourier Transform) and HMAC (Key-Associated Hash Message Authentication Code) to simultaneously improve the security and speed of key relay.

[0112] The following describes different embodiments.

[0113] Example 1:

[0114] like Figure 1 As shown, a multi-path key relay method is used to simultaneously improve the security and speed of key relay, including the following steps:

[0115] Step 1) The source node (or initial node, the same below) and the destination node of the key relay negotiate a security key K;

[0116] Step 2) The source node selects multiple paths for key relay;

[0117] Step 3) The source node and the destination node perform connection operations on the relay key data of the multiple paths in the same order to generate key data R;

[0118] Step 4) The source node and the destination node perform FFT on the data R respectively to generate data R' of the same length as the original data;

[0119] Step 5) Select an HMAC operation with a result length of L bits. The source and destination nodes divide R' into several L-bit data. Using the selected HMAC operation, perform an HMAC operation on each of the divided data with respect to the security key K.

[0120] Step 6) The source node and the destination node connect the HMAC operation results in the same order to generate a shared key.

[0121] In step 1), the method for the source node and the destination node to negotiate the security key K is as follows: the source node selects k key relay paths (k>1) without a common relay node, and obtains relay keys K0, K1, ..., K1 respectively. k-1 Since all keys are of equal length, we can let K = MD5(K0^K1^…^K). k-1 That is, first set each relay key K0, K1, ..., K k-1 Perform an XOR operation, then perform an MD5 operation on the resulting XOR value to obtain a hash value of K.

[0122] In this embodiment, the detailed process of step 4) is as follows:

[0123] A) Assume that the length of R is N, i.e., R = (R0, R1, R2, ..., R...). N-1 ), where R i ∈{0, 1}, i = 0, 1, 2, ..., N-1, the source node expands R to a length of 3N-2 by padding with trailing zeros, i.e., Ra = (R0, R1, R2, ..., R N-1 ,0,0,…,0), perform FFT transformation on Ra; the same transformation is performed on the destination node;

[0124] B) The source node generates a random number T of length (2N-1), i.e., T = (T0, T1, T2, ..., Tn). 2N-2 ), where T j ∈{0, 1}, j = 0, 1, 2, ..., 2N-2, and the length is extended to (3N-2) by padding with 0s at the end, i.e., T' = (T0, T1, T2, ..., T 2N-2 The source node sends T to the destination node, and the destination node performs the same transformation.

[0125] C) The source node and the destination node multiply the results of step A) and step B) respectively, and perform an inverse FFT transformation on the multiplied result;

[0126] D) The source node and the destination node respectively extract the (N-1)th to (2N-2)th bits from the result of step C) as the final key R'.

[0127] In step B) above, the source node sends T to the destination node only once. When the destination node and the source node transform the multipath relay key, they only need to keep T unchanged.

[0128] By using step 4), the keys of multi-path relays are fully mixed through convolution operations. Even if an attacker obtains part of the relay key by attacking some relay paths, it will be difficult to obtain part of the key information in R'. At the same time, the speed of convolution operations is increased by using FFT operations, which speeds up the calculation speed of key generation.

[0129] In this embodiment, the HMAC operation selected in step 5) can be HMAC-MD5. The result of the HMAC-MD5 operation is 512 bits. The data in R' is divided into groups of 512 bits each, and an HMAC operation is performed on each group of data using the key K. Since the attacker cannot know the information of K, they also cannot know the final generated key information.

[0130] Example 2:

[0131] In Embodiment 1, the steps are described from the perspective of both the source node and the destination node. This embodiment describes a multipath key relay method from the source node perspective, including the following steps:

[0132] Negotiate a security key with the destination node;

[0133] Select multiple paths for key relay;

[0134] The relay key data of the multiple paths are connected in the same order as the destination node to generate key data;

[0135] Perform a Fast Fourier Transform on the key data to generate a second data set of the same length as the key data.

[0136] The second data is divided into several data with the same length as the preset HMAC operation result data, and an HMAC operation with respect to the security key is performed on each of the divided data.

[0137] The HMAC operation results are concatenated in the same order as the destination node to generate a shared key.

[0138] In this embodiment, the specific process of negotiating the security key includes: the source node selects multiple key relay paths without a common relay node, obtains the corresponding relay keys respectively, each key is of equal length, the relay keys can be XORed, and the obtained XOR value is hashed to obtain the security key.

[0139] In this embodiment, the specific process of performing a Fast Fourier Transform on the key data includes:

[0140] The key data is lengthened, and then a Fast Fourier Transform is performed on the lengthened data.

[0141] Generate a random number, extend its length, perform a Fast Fourier Transform on the extended random number, and send the random number to the destination node;

[0142] Multiply the results of the two length expansions in digits, and then perform an inverse fast Fourier transform on the result.

[0143] A portion of the data is extracted from the inverse fast Fourier transform result and used as the second data.

[0144] Of course, in this embodiment, the extension length may differ from that in Embodiment 1 and may be changed depending on the conditions.

[0145] Example 3:

[0146] From the perspective of the destination node, a multipath key relay method includes the following steps:

[0147] Negotiate the security key with the source node;

[0148] Obtain the multiple key relay paths selected by the source node;

[0149] The relay key data of the path is connected in the same order as the source node to generate key data;

[0150] Perform a Fast Fourier Transform on the key data to generate a second data set of the same length as the key data.

[0151] The second data is divided into several data with the same length as the preset HMAC operation result data, and an HMAC operation with respect to the security key is performed on each of the divided data.

[0152] The HMAC operation results are concatenated in the same order as the source nodes to generate a shared key.

[0153] In this embodiment, the specific process of performing a Fast Fourier Transform on the key data includes:

[0154] The key data is lengthened, and then a Fast Fourier Transform is performed on the lengthened data.

[0155] Receive the random number sent by the source node, extend its length, and perform a fast Fourier transform on the extended random number;

[0156] Multiply the results of the two length expansions in digits, and then perform an inverse fast Fourier transform on the result.

[0157] A portion of the data is extracted from the inverse fast Fourier transform result and used as the second data.

[0158] Example 4:

[0159] In this embodiment, a quantum key distribution device is provided, including a processor and a computer-readable storage medium. The processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, which are adapted to be loaded by the processor and executed as steps in a multi-path key relay method described in Embodiment 2 or Embodiment 3.

[0160] Of course, it may also include at least two quantum key distribution devices, each of which includes a processor and a computer-readable storage medium. The processor is used to implement the instructions, and the computer-readable storage medium is used to store multiple instructions.

[0161] The instructions of one quantum key distribution device are adapted to be loaded by a processor and executed in a multipath key relay method according to Embodiment 2, and the instructions of the other quantum key distribution device are adapted to be loaded by a processor and executed in a multipath key relay method according to Embodiment 3.

[0162] Alternatively, two quantum key distribution devices may be used to perform the steps in a multipath key relay method as described in Embodiment 1.

[0163] Example 5:

[0164] A quantum key distribution device, characterized by comprising:

[0165] This module is used to select different multiple paths for key relay and to mix the relay key data of multiple paths through convolution operations.

[0166] A module used to add a pre-negotiated security key during HMAC operations to generate a shared key.

[0167] Example 6:

[0168] A quantum key distribution device, such as Figure 2 As shown, it includes:

[0169] The first module used for negotiating the security key;

[0170] The second module is used to perform concatenation operations on relay key data from multiple key relay paths to generate key data.

[0171] The third module is used to perform a fast Fourier transform on the key data to generate second data of the same length as the key data;

[0172] The fourth module is used to divide the second data into several data with the same length as the preset HMAC operation result data, and to perform HMAC operation on each of the divided data with respect to the security key.

[0173] The fifth module is used to concatenate the obtained HMAC operation results in the same order as the peer to generate a shared key.

[0174] In this embodiment, the third module includes:

[0175] This module is used to extend the length of key data and perform a fast Fourier transform on the extended data.

[0176] A module used to generate or receive random numbers, extend their length, and perform a fast Fourier transform on the extended random numbers.

[0177] This module is used to perform positional multiplication of the results of two length expansions and to perform an inverse fast Fourier transform on the result.

[0178] This module is used to extract a portion of the data from the inverse fast Fourier transform result as the second data.

[0179] Example 7:

[0180] Provide a key distribution system, such as Figure 3 As shown, it includes several quantum key distribution devices, routing devices and data devices. Each quantum key distribution device is connected to at least two routing devices and at least one data device. The routing devices are interconnected to form a network topology.

[0181] The quantum key distribution device is used to negotiate a security key with the peer quantum key distribution device. It uses multiple different paths to relay keys with the peer quantum key distribution device. The relay key data of each path are connected in the same order to generate key data. The key data is subjected to a fast Fourier transform to generate second data of the same length as the key data. The second data is divided into several data with the same length as the preset HMAC operation result data. HMAC operation with respect to the security key is performed on each group of data. The obtained HMAC operation results are connected in the same order as the peer quantum key distribution device to generate a shared key.

[0182] In this embodiment, multiple paths refer to multiple paths that do not share a common relay node.

[0183] In this embodiment, the quantum key distribution device is also used to receive different paths and random numbers sent by the peer quantum key distribution device.

[0184] In this embodiment, the quantum key distribution device is also used to extend the length of the key data and perform a fast Fourier transform on the extended data.

[0185] In this embodiment, the quantum key distribution device is also used to generate or receive random numbers, extend their length, and perform a fast Fourier transform on the extended random numbers.

[0186] In this embodiment, the quantum key distribution device is also used to perform bitwise multiplication of the result of key data length expansion and random number data length expansion, and to perform inverse fast Fourier transform on the result of the multiplication.

[0187] The quantum key distribution device is also used to extract a portion of the data from the inverse fast Fourier transform result as the second data.

[0188] The quantum key distribution device is configured to maintain the random number when transforming multipath relay keys.

[0189] The quantum key distribution device extends its length by padding with trailing zeros.

[0190] Of course, in this embodiment, the quantum key distribution device can be the device from Embodiment Six.

[0191] In this embodiment, the routing device is used to relay keys and forward encrypted data, and also to receive paths sent by the quantum key distribution device.

[0192] In this embodiment, the relay keys for each path are of equal length.

[0193] Example 8:

[0194] A key distribution system includes several quantum key distribution devices, routing devices, and data devices, wherein each quantum key distribution device is connected to at least two routing devices, each quantum key distribution device is connected to at least one data device, and the routing devices are interconnected to form a network topology.

[0195] The quantum key distribution device is used to select multiple different paths for key relay, mix the relay key data of multiple paths through convolution operation, and add a pre-negotiated security key during the HMAC operation to generate a shared key.

[0196] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0197] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0198] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0199] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0200] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0201] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A method for multi-path key relay, the method comprising: The method comprises the following steps: ​ selecting different multiple paths for key relaying: selecting multiple key relaying paths without common relay nodes, obtaining corresponding relay keys respectively, and the relay keys being equal in length; mixing the relay key data of the multiple paths through convolution operation: sequentially connecting the relay key data to generate key data, and performing fast Fourier transform on the key data to generate second data equal in length to the key data; In HMAC The pre-agreed security key is added in the operation process: the second data is divided into several data with the same length as the preset HMAC operation result data, and the divided data is operated on the security key. HMAC operation. The source node and the destination node respectively generate a shared key by using the obtained HMAC The operation results are connected in the same order to obtain the shared key.

2. A multi-path key relay method as claimed in claim 1, characterized by: The specific process of performing fast Fourier transform on the key data comprises: extending the length of the key data, and performing fast Fourier transform on the data after the length extension; generating or receiving a random number, extending the length of the random number, and performing fast Fourier transform on the random number after the length extension; multiplying the results of the two length extensions bit by bit, and performing inverse fast Fourier transform on the multiplied result; taking part of the inverse fast Fourier transform result as the second data.

3. A multi-path key relay method as claimed in claim 2, characterized by: The length extension is realized by zero padding at the end.

4. A multi-path key relay method as claimed in any one of claims 1-3, characterized by: The HMAC Operation is HMAC - MD 5.

5. A method for multi-path key relay, the method comprising: The method comprises the following steps: negotiating a security key with a destination node; selecting multiple key relaying paths without common relay nodes, obtaining corresponding relay keys respectively, and the relay keys being equal in length; connecting the relay key data of the multiple key relaying paths in the same order as the destination node to generate key data; performing fast Fourier transform on the key data to generate second data equal in length to the key data; dividing the second data into a plurality of data having a length identical to that of the first data, and performing a security key-related operation on each of the divided data. HMAC dividing the second data into a plurality of data having a length identical to that of the first data, and performing a security key-related operation on each of the divided data. HMAC dividing the second data into a plurality of data having a length identical to that of the first data, and The resulting HMAC The result of the operation is concatenated in the same order as the destination nodes to generate the shared key.

6. A method of multi-path key relay, the method comprising: The method comprises the following steps: negotiating a security key with a source node; obtaining multiple key relaying paths selected by the source node and without common relay nodes, obtaining corresponding relay keys respectively, and the relay keys being equal in length; connecting the relay key data of the multiple key relaying paths in the same order as the source node to generate key data; performing fast Fourier transform on the key data to generate second data equal in length to the key data; dividing the second data into a plurality of data having a length identical to that of the first data, and performing a security key-related operation on each of the divided data. HMAC dividing the second data into a plurality of data having a length identical to that of the first data, and performing a security key-related operation on each of the divided data. HMAC dividing the second data into a plurality of data having a length identical to that of the first data, and The resulting HMAC The result of the operation is concatenated in the same order as the source nodes to generate the shared key.

7. A method for multi-path key relay, the method comprising: The method comprises the following steps: the source node and the destination node negotiate a security key; the source node selects multiple key relaying paths without common relay nodes, obtains corresponding relay keys respectively, and the relay keys are equal in length; the source node and the destination node respectively connect the relay key data of the multiple key relaying paths in the same order to generate key data; the source node and the destination node respectively perform fast Fourier transform on the key data to generate second data equal in length to the key data; The source node and the destination node respectively divide the second data into a plurality of data having a predetermined length, and perform a security key-related operation on each of the divided data. HMAC The operation result data has the same length as the data, and the source node and the destination node respectively perform a security key-related operation on each of the divided data. HMAC The operation result data has the same length as the data, and the source node and the destination node respectively perform a security key-related operation on each of the divided data. The source node and the destination node will get HMAC The operation results are connected in the same order to generate the shared key.

8. A multi-path key relay method as claimed in claim 7, characterized by: The specific process of performing fast Fourier transform on the key data comprises: the source node extends the length of the key data, and performs fast Fourier transform on the data after the length extension; the destination node also performs the same transformation; the source node generates a random number, extends the length of the random number, and performs fast Fourier transform on the random number after the length extension; the source node sends the random number to the destination node, and the destination node also performs the same transformation; the source node and the destination node respectively multiply the results of the two length extensions bit by bit, and perform inverse fast Fourier transform on the multiplied result. The source node and the destination node take out part of data from the inverse fast Fourier transform result as the second data.

9. A multi-path key relay method as claimed in claim 8, characterized by: The destination node and the source node keep the random number unchanged when transforming the multi-path relay key.

10. A quantum key distribution apparatus, characterized by: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9.

11. A quantum key distribution device, performing the steps of a multi-path key relay method as claimed in claim 1, characterized by: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. For use in The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. a module for incorporating a pre-negotiated security key in the operation to generate a shared key.

12. A quantum key distribution apparatus, characterized by: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. for dividing the second data into a plurality of data having the same length as that of the The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. operation result data, and performing a fourth module of operation on each of the divided data with respect to a security key. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. operation. for deriving a resulting The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The operation result is concatenated in the same order as the peer, generating a fifth module of the shared key.

13. A quantum key distribution apparatus as claimed in claim 12, characterized by: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9.

14. A key distribution system characterized by: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The quantum key distribution device is used for selecting different paths for key relay, and mixing the relay key data of the paths through convolution operation; and The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. A security key negotiated in advance is added in the operation process to generate a shared key.

15. A key distribution system as claimed in claim 14, characterized in that: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9.

16. A key distribution system as claimed in claim 14, characterized in that: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9.

17. A key distribution system characterized by: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The quantum key distribution device is used for negotiating a secure key with a peer quantum key distribution device, adopts different multiple paths to perform key relay with the peer quantum key distribution device, connects relay key data of each path in a same order to generate key data, performs fast Fourier transform on the key data to generate second data with a length same as that of the key data, divides the second data into a plurality of data with a length same as that of the preset The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. operation result data, performs a secure key operation on each divided data, and connects obtained operation results in a same order as that of the peer quantum key distribution device to generate a shared key. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. ​​ The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9.

18. A key distribution system as claimed in claim 17, characterized in that: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9.

19. A key distribution system as claimed in claim 17, characterized in that: The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9.

20. The key distribution system of claim 17, wherein: the key distribution server is further operable to: receive a request from the client to access the encrypted data; and send the client a key for decrypting the encrypted data. 20 The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key relay method in any one of claims 1-9. The computer readable storage medium is configured to store a plurality of instructions, and the instructions are adapted to be loaded and executed by the processor to implement the steps in the multi-path key 21. A key distribution system as claimed in claim 20, characterized in that: The quantum key distribution device is further configured to generate or receive a random number, and extend the length of the random number, and perform a fast Fourier transform on the extended random number.

22. A key distribution system as claimed in claim 21, characterized in that: The quantum key distribution device is further configured to multiply the result of the length extension of the key data and the result of the length extension of the random number, and perform an inverse fast Fourier transform on the multiplied result.

23. A key distribution system as claimed in claim 22, characterized in that: The quantum key distribution device is further configured to extract a part of data from the inverse fast Fourier transform result as the second data.

24. A key distribution system as claimed in claim 21 or 22, characterized by: The quantum key distribution device is configured to keep the random number unchanged when performing the transformation processing on the multi-path relay key.

25. A key distribution system as claimed in claim 20 or 21, characterized by: The quantum key distribution device extends the length by zero padding.

Images