A method for symmetric quantum key agreement, and a quantum key network distribution system

Abstract

The application discloses a symmetric quantum key negotiation method, comprising the following steps: a first node randomly selects a key in an idle state from a quantum key pool P 12 of the first node, modifies the state of the key in the quantum key pool P 12 to a negotiation state, and initiates a key negotiation request; when a second node receives the key negotiation request sent by the first node, the second node finds the state of the corresponding key in a quantum key pool P 21 of the second node based on the key identifier in the key negotiation request; if the state of the key in the quantum key pool P 21 is the negotiation state, only the key negotiation request with a higher priority is reserved, and the state of the corresponding key is modified; the first node receives a response state returned by the second node, and modifies the state of the key based on the response state; one pair of quantum keys is obtained through one negotiation, the parallel execution efficiency of obtaining quantum keys or storing quantum keys in a quantum trusted relay process or a key service is improved, and the key loss in the trusted relay process is reduced.

Description

Technical Field

[0001] This invention belongs to the field of quantum communication technology, and more specifically, it relates to a method for negotiating symmetric quantum keys and a quantum key network distribution system. Background Technology

[0002] QKD quantum technology uses single-photon quantum states as carriers to distribute symmetric quantum keys end-to-end based on the principles of quantum mechanics. It is the only theoretically proven information-theoretically secure (also known as unconditionally secure) key distribution method to date.

[0003] Quantum key distribution (QKD) utilizes the properties of quantum mechanics to ensure the security of communication, enabling two parties to generate and share a random, secure key. In quantum key distribution networks, due to limitations in transmission distance and deployment cost, trusted quantum key relay mechanisms have become a common method for enabling long-distance node sharing of quantum keys.

[0004] In practical quantum communication network operations, relay and quantum key service functions can fail if both the local and peer ends simultaneously request the same pair of quantum keys, especially if the synchronization mechanism is not properly implemented. In high-load quantum communication networks, frequent key request failures can cause system instability and, in severe cases, lead to the collapse of the entire system. Summary of the Invention

[0005] This invention provides a method for negotiating symmetric quantum keys, aiming to improve the above-mentioned problems.

[0006] This invention is implemented as follows: a method for negotiating a symmetric quantum key, characterized in that the method includes the following steps:

[0007] (1) The quantum key pool P of the first node 12 With the second node quantum key pool P 21 The key state is divided into idle state, negotiation state, use state and destruction state, and the initial quantum key state is idle state;

[0008] (2) The first node retrieves data from its own quantum key pool P. 12 A key in an idle state is randomly selected from the quantum key pool P, and this key is used in the quantum key pool P. 12 The status in the key is changed to negotiation status, and a key negotiation request is initiated.

[0009] (3) When the second node receives the key negotiation request sent by the first node, it uses the key identifier in its own quantum key pool P based on the key identifier in the key negotiation request. 21 Find the status of the corresponding key in the database;

[0010] (4) If the key is in the quantum key pool P 21 When the status is in the negotiation state, only the key negotiation request with the highest priority is retained, and the status of the corresponding key is modified accordingly.

[0011] (5) The first node receives the response status returned by the second node and modifies the status of the key accordingly based on the response status;

[0012] Quantum key pool P 21 Quantum key pool P 12 For the same quantum key pool.

[0013] Furthermore, in the quantum key pool P 21 When the state is in the negotiation state, the following steps are executed:

[0014] (41) If the key negotiation request sent by the first node has a higher priority than that of the second node, then the second node returns a response status of successful negotiation to the first node, and stores the key in the quantum key pool P. 21 The status in the file has been changed to "in use".

[0015] (42) If the key negotiation request sent by the first node has a lower priority than that of the second node, then the response status returned by the second node to the first node is negotiation failure, and the key is in the quantum key pool P. 21 The state in the middle remains unchanged.

[0016] Furthermore, if the key is in the quantum key pool P 21 When the key is in an idle state, store the key in the quantum key pool P. 21 The status in the middle is changed to "in use", and a key negotiation success is returned to the first node.

[0017] Furthermore, if the first node receives a response indicating successful negotiation, it stores the key in the quantum key pool P. 12 The state in the key pool is changed to the usage state; if the response state received by the first node is negotiation failure, then the key in the quantum key pool P is not modified. 12 The state in.

[0018] Furthermore, the key identifier in the negotiation request consists of the ID identifier of the first node, the ID identifier of the second node, and the identifier sequence number of the key in the quantum key pool.

[0019] Furthermore, the priority of key negotiation requests is determined based on the time the negotiation request is sent, the service type of the negotiation request, or the node priority level.

[0020] This invention is implemented as follows: a quantum key distribution network system, the system comprising:

[0021] Multiple nodes, each with its own quantum key pool, which provides quantum keys to the corresponding node. Adjacent node quantum key pools are connected to a pair of quantum key distribution (QKD) devices. The QKD generates new quantum keys for the corresponding adjacent node quantum key pools. Key pools between non-adjacent node quantum keys are generated through relays.

[0022] Quantum key distribution (QKD) nodes communicate with each other via a quantum network, while nodes communicate with each other via optical waves.

[0023] Furthermore, in the case of direct quantum communication between node A and node C, the symmetric key distribution process between node A and node C is as follows:

[0024] The quantum key distribution (QKD) of control node A and the quantum key distribution (QKD) of node C generate the same quantum key, which is then stored in quantum key pool AC and quantum key pool CA, respectively. The state of the quantum key in quantum key pool AC and quantum key pool CA is then marked as idle.

[0025] Key pool AC and quantum key pool CA are the same quantum key pool.

[0026] Furthermore, when node A communicates with node C via relay node B, the specific process for generating the symmetric key between node A and node C is as follows:

[0027] Node A obtains the first shared key Kab between Node A and relay node B, and controls the quantum key distribution QKD to generate a quantum random number K. Based on the first shared key Kab, the quantum random number K is encrypted and sent to relay node B.

[0028] Relay node B decrypts the encrypted quantum random number K based on the first shared key Kab to obtain the quantum random number K, and then encrypts the quantum random number K based on the second shared key Kbc between node C and relay node B, and sends it to node C.

[0029] Node C decrypts the encrypted quantum random number K based on the second shared key Kbc, obtains the quantum random number K, adds the quantum random number K as the quantum key to the quantum key pool CA, and returns a relay request response to node A.

[0030] Node A stores the generated quantum random number K as a quantum key in the quantum key pool AC;

[0031] In this process, node A and relay node B negotiate and obtain the first shared key Kab based on the aforementioned symmetric quantum key negotiation method.

[0032] Node C and relay node B negotiate to obtain the second shared key Kbc based on the above-mentioned symmetric quantum key negotiation method.

[0033] Furthermore, the encryption and decryption process based on the first shared key Kab / the second shared key Kbc and the quantum random number K is as follows:

[0034] Node A XORs the first shared key Kab with the quantum random number K to form ciphertext. Relay node B XORs the ciphertext with the first shared key Kab to obtain the quantum random number K. Relay node B XORs the quantum random number K with the second shared key Kbc to form ciphertext. Node C XORs the ciphertext with the second shared key Kbc again to obtain the quantum random number K.

[0035] The symmetric quantum key negotiation method provided by this invention has the following beneficial technical effects:

[0036] (1) By obtaining a pair of quantum keys in one negotiation, the efficiency of obtaining or storing quantum keys in parallel execution in quantum trusted relay process or key service is improved, and key loss in trusted relay process is reduced.

[0037] (2) Key relay or service requests can be initiated at any node, ensuring that each quantum key trusted relay node and service node is equal in the quantum key network structure. Attached Figure Description

[0038] Figure 1 A timing interaction diagram of the symmetric quantum key negotiation method provided in the embodiments of the present invention;

[0039] Figure 2 This is a schematic diagram of the structure of a quantum key distribution network system provided in an embodiment of the present invention;

[0040] Figure 3 A timing diagram of quantum key distribution based on shared keys is provided for embodiments of the present invention;

[0041] Figure 4 A timing diagram of quantum key distribution based on relay node B provided for an embodiment of the present invention;

[0042] Figure 5 A flowchart illustrating the key writing process for node A, relay node B, and node C provided in an embodiment of the present invention;

[0043] Figure 6 This is a schematic diagram of quantum key state update provided for an embodiment of the present invention. Implementation

[0044] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0045] Figure 1 The timing interaction diagram of the symmetric quantum key negotiation method provided in the embodiments of the present invention specifically includes the following steps:

[0046] (1) The first node retrieves data from its own quantum key pool P. 12 A key in an idle state is randomly selected from the quantum key pool P, and this key is used in the quantum key pool P. 12 The status in the middle is changed to the negotiation status, and a key negotiation request (marked as SdReq) is initiated, which carries the key identifier.

[0047] The quantum key pool P of the first node 12 With the second node quantum key pool P 21 The key state is divided into idle state, negotiation state, use state and destruction state. The initial quantum key state is idle state. (2) When the second node receives the key negotiation request sent by the first node, it uses the key identifier in its own quantum key pool P based on the key identifier in the key negotiation request. 21 Find the status of the corresponding key in the database;

[0048] (3) If the key is in the quantum key pool P 21 When the key is in an idle state, store the key in the quantum key pool P. 21 The status in the middle is changed to the usage status, and a key negotiation success is returned to the first node;

[0049] If the key is in the quantum key pool P 21 If the key is in any other state, such as not existing or in use, it indicates a business anomaly, and the key is in the quantum key pool P. 21 The state in the key is changed to the destroyed state, and the quantum key is deleted.

[0050] If the key is in the quantum key pool P 21 When the key is in a negotiation state, if the key is in a negotiation state, it means that the second node has also initiated a key negotiation request to the first node based on the key. Therefore, the two key negotiation requests initiated based on the key are in a conflict state. At this time, the priority information of the key negotiation requests is used to determine whether to agree to the key negotiation request sent by the first node. The specific method is as follows:

[0051] (31) If the key negotiation request sent by the first node has a higher priority than that of the second node, then the second node returns a response status of successful negotiation to the first node, and stores the key in the quantum key pool P. 21 The status in the file has been changed to "in use".

[0052] (32) If the key negotiation request sent by the first node has a lower priority than that of the second node, then the response status returned by the second node to the first node is negotiation failure, and the key is in the quantum key pool P.21 The state remains unchanged and is still in a negotiation state.

[0053] (4) The first node receives the response status (marked as RvResp) returned by the second node, and modifies the status of the key based on the response status. The specific operation is as follows:

[0054] If the first node receives a response indicating successful negotiation (marked as RvRespSucc), then the key is stored in the quantum key pool P. 12 The status in the file has been changed to "in use".

[0055] If the first node receives a response indicating negotiation failure (marked as RvRespFailed), then the key will not be modified in the quantum key pool P. 12 The state in,

[0056] If the response received by the first node is in another state (marked as RvRespAbnor), then the key is stored in the quantum key pool P. 12 The state in the data is changed to the destroyed state, and the quantum key is deleted.

[0057] In another embodiment of the present invention, the key identifier in the negotiation request includes the ID identifier of the first node, the ID identifier (PID) of the second node, and the identifier sequence number (SEQ) of the key in the quantum key pool, so that the first node and the second node can quickly find the corresponding key in their respective quantum key pools.

[0058] In another embodiment of the present invention, the priority of the key negotiation request is determined based on the sending time of the negotiation request, the service type of the negotiation request, or the node priority level, as follows:

[0059] (a) Set the key negotiation request sent earlier to high priority (PriH) and the key negotiation request sent later to low priority (PriL). When there is a conflict between two key negotiation requests sent by the first node and the second node, and the key negotiation request sent by the first node was sent earlier than that of the second node, the first node is considered to have a higher priority than the second node. In this case, the key negotiation request sent by the first node to the second node will be allowed, that is, the response status returned by the second node to the first node is that the key negotiation was successful; (b) Set the key negotiation request with the priority of the request service type to high priority and set the key negotiation request with the priority of the request service type to low priority; (c) Set the key negotiation request with the priority of the sending node to high priority and set the key negotiation request with the priority of the sending node to low priority.

[0060] In another embodiment of the invention, the quantum key pool P 12 Provides quantum keys for the first node; quantum key pool P21 Provide a quantum key for the second node, and place the generated symmetric quantum key between the first and second nodes into the quantum key pool P. 12 Quantum key pool P 21 At that time, the key is placed in the quantum key pool P. 12 Quantum key pool P 21 The status is marked as idle.

[0061] The symmetric quantum key negotiation method provided by this invention has the following beneficial technical effects:

[0062] (1) By obtaining a pair of quantum keys in one negotiation, the efficiency of obtaining or storing quantum keys in parallel execution in quantum trusted relay process or key service is improved, and key loss in trusted relay process is reduced.

[0063] (2) Key relay or service requests can be initiated at any node, ensuring that each quantum key trusted relay node and service node is equal in the quantum key network structure.

[0064] Figure 2 This is a schematic diagram of a quantum key distribution system provided in an embodiment of the invention. For ease of explanation, only the parts relevant to the embodiments of the invention are shown. The system includes:

[0065] Multiple nodes, each with its own quantum key pool, provide quantum keys to the corresponding nodes. Adjacent node quantum key pools are connected to a pair of quantum key distribution (QKD) devices. The QKD generates new quantum keys for the corresponding adjacent node quantum key pools. Key pools between non-adjacent nodes are generated through relays. The QKDs are connected through quantum network communication, and the nodes are connected through optical wave communication (classical network communication).

[0066] In this embodiment of the invention, the symmetric key generation between the quantum key pool AC of node A and the quantum key pool CA of node C includes the following two cases:

[0067] (1) Quantum key distribution (QKD) at node A and quantum key distribution (QKD) at node C can directly communicate via quantum key distribution. The specific distribution process of the symmetric key is as follows:

[0068] The quantum key distribution (QKD) of control node A and the quantum key distribution (QKD) of node C generate the same quantum key, which is then stored in quantum key pool AC and quantum key pool CA, respectively. The state of the quantum key in quantum key pool AC and quantum key pool CA is then marked as idle.

[0069] (2) Quantum key distribution (QKD) nodes A and C cannot directly communicate via quantum key distribution (QKD). Communication between them requires a relay node B. The symmetric key distribution process is as follows: Figure 3 As shown, it includes the following steps:

[0070] Node A obtains the first shared key between Node A and relay node B, and controls the quantum key distribution QKD to generate a quantum random number K. Based on the first shared key Kab, the quantum random number K is encrypted and sent to relay node B.

[0071] Relay node B decrypts the encrypted quantum random number K based on the first shared key Kab to obtain the quantum random number K, and then encrypts the quantum random number K based on the second shared key Kbc between node C and relay node B, and sends it to node C.

[0072] Node C decrypts the encrypted quantum random number K based on the second shared key Kbc, obtains the quantum random number K, adds the quantum random number K as the quantum key to the quantum key pool CA, and returns a relay request response to node A.

[0073] Node A stores the generated quantum random number K as a quantum key in the quantum key pool AC.

[0074] In this embodiment of the invention, the first shared key Kab and the second shared key Kbc are obtained based on the above-mentioned symmetric quantum key negotiation method.

[0075] Furthermore, node A XORs the first shared key Kab with the quantum random number K to form ciphertext, and relay node B XORs the ciphertext with the first shared key Kab to obtain the quantum random number K. Similarly, relay node B XORs the quantum random number K with the second shared key Kbc to form ciphertext, and node C XORs the ciphertext with the second shared key Kbc again to obtain the quantum random number K.

[0076] The distribution timing diagram of the quantum key distribution system based on relay node B is as follows: Figure 4 Show, Figure 4 The shared key Kab is the first shared key, and the shared key Kbc is the second shared key. Figure 5 The quantum key writing process for node A, relay node B, and node C is as follows: AB key pool is the key pool between node A and relay node B, and exists in both node A and relay node B; BC key pool is the key pool between relay node B and node C, and exists in both node C and relay node B; AC key pool is the key pool between node A and node C, and exists in both node A and node C. The quantum keys in key pool AC and key pool CA are the same, thus forming a symmetric key.

[0077] The quantum key distribution system provided by this invention has the following advantages: (1) it can improve the operational stability of the quantum key distribution system in a high-load quantum communication network; (2) it can realize quantum communication between long-distance transmission nodes through relay nodes; and (3) it can achieve simple and efficient quantum key pool management.

[0078] The present invention has been described by way of example. Obviously, the specific implementation of the present invention is not limited to the above-described manner. Any non-substantial improvements made by adopting the inventive concept and technical solution of the present invention, or the direct application of the inventive concept and technical solution of the present invention to other occasions without modification, are all within the protection scope of the present invention.

Claims

1. A method for negotiating a symmetric quantum key, characterized in that, The method includes the following steps: (1) The first node retrieves its own quantum key pool P 12 A key in an idle state is randomly selected from the quantum key pool P, and this key is used in the quantum key pool P. 12 The status in the key is changed to negotiation status, and a key negotiation request is initiated. (2) When the second node receives the key negotiation request sent by the first node, it uses the key identifier in its own quantum key pool P based on the key identifier in the key negotiation request. 21 Find the status of the corresponding key in the database; (3) If the key is in the quantum key pool P 21 When the status is in the negotiation state, only the key negotiation request with the highest priority is retained, and the status of the corresponding key is modified accordingly. (4) The first node receives the response status returned by the second node and modifies the status of the key accordingly based on the response status; Quantum key pool P 21 Quantum key pool P 12 To construct symmetric keys for the same quantum key pool; The key is in the quantum key pool P 21 When the state is in the negotiation state, the following steps are executed: (31) If the key negotiation request sent by the first node has a higher priority than that of the second node, then the second node returns a response status of successful negotiation to the first node, and stores the key in the quantum key pool P. 21 The status in the file has been changed to "in use". (32) If the key negotiation request sent by the first node has a lower priority than that of the second node, then the response status returned by the second node to the first node is negotiation failure, and the key is in the quantum key pool P. 21 The state remains unchanged; If the first node receives a response indicating successful negotiation, the key is stored in the quantum key pool P. 12 The state in the key pool is changed to the usage state; if the response state received by the first node is negotiation failure, then the key in the quantum key pool P is not modified. 12 The state in; The key identifier in the negotiation request consists of the ID identifier of the first node, the ID identifier of the second node, and the identifier sequence number of the key in the quantum key pool.

2. The symmetric quantum key negotiation method as described in claim 1, characterized in that, If the key is in the quantum key pool P 21 When the key is in an idle state, store the key in the quantum key pool P. 21 The status in the middle is changed to "in use", and a key negotiation success is returned to the first node.

3. The symmetric quantum key negotiation method as described in claim 1, characterized in that, The priority of a key negotiation request is determined based on the time the negotiation request was sent, the service type of the negotiation request, or the node priority level.

4. A quantum key distribution network system, characterized in that, The system includes: Multiple nodes, each with its own quantum key pool, which provides quantum keys to the corresponding node. Adjacent node quantum key pools are connected to a pair of quantum key distribution (QKD) devices. The QKD generates new quantum keys for the corresponding adjacent node quantum key pools. Key pools between non-adjacent node quantum keys are generated through relays. Quantum key distribution (QKD) nodes communicate with each other via a quantum network, while nodes communicate with each other via optical waves. When node A communicates with node C via relay node B, the process of generating the symmetric key between node A and node C is as follows: Node A obtains the first shared key Kab between Node A and relay node B, and controls the quantum key distribution QKD to generate a quantum random number K. Based on the first shared key Kab, the quantum random number K is encrypted and sent to relay node B. Relay node B decrypts the encrypted quantum random number K based on the first shared key Kab to obtain the quantum random number K, and then encrypts the quantum random number K based on the second shared key Kbc between node C and relay node B, and sends it to node C. Node C decrypts the encrypted quantum random number K based on the second shared key Kbc, obtains the quantum random number K, adds the quantum random number K as the quantum key to the quantum key pool CA, and returns a relay request response to node A. Node A stores the generated quantum random number K as a quantum key in the quantum key pool AC; In this process, node A and relay node B negotiate to obtain the first shared key Kab based on the symmetric quantum key negotiation method described in any one of claims 1 to 3; Node C and relay node B negotiate to obtain a second shared key Kbc based on the symmetric quantum key negotiation method described in any one of claims 1 to 3.

5. The quantum key distribution system as described in claim 4, characterized in that, In direct quantum communication between node A and node C, the symmetric key distribution process between node A and node C is as follows: The quantum key distribution (QKD) of control node A and the quantum key distribution (QKD) of node C generate the same quantum key, which is then stored in quantum key pool AC and quantum key pool CA, respectively. The state of the quantum key in quantum key pool AC and quantum key pool CA is then marked as idle. Quantum key pool AC and quantum key pool CA are the same quantum key pool, forming a symmetric key.

6. The quantum key distribution system as described in claim 4, characterized in that, The encryption and decryption process based on the first shared key Kab, the second shared key Kbc, and the quantum random number K is as follows: Node A XORs the first shared key Kab with the quantum random number K to form ciphertext. Relay node B XORs the ciphertext with the first shared key Kab to obtain the quantum random number K. Relay node B XORs the quantum random number K with the second shared key Kbc to form ciphertext. Node C XORs the ciphertext with the second shared key Kbc again to obtain the quantum random number K.

Images