A quantum secure local area network networking system and method

Abstract

The present application discloses a networking system and method for a quantum secure local area network. Since the quantum secure local area network includes an access base station and a user terminal, the user terminal can be connected to the access base station, and the access base station will allocate a network access identifier for the user terminal and send the network access identifier to the user terminal, thereby realizing the communication connection between the access base station and the user terminal, and providing a hardware foundation for the subsequent use of the quantum secure local area network for quantum communication. In addition, the access base station also obtains and saves the first correspondence between the network access identifier of the user terminal and the IP address of the user terminal, which is conducive to the subsequent transmission and reception of data with the user terminal based on the first correspondence and the network access identifier of the user terminal receiving data, realizing the transmission and reception of data by the user terminal through the quantum secure local area network, and ensuring quantum secure communication between various devices in the quantum secure local area network.

Description

Technical Field

[0001] The present application relates to the field of quantum communication security technology, and in particular to a networking system and method for a quantum secure local area network. Background Art

[0002] Existing network security faces increasingly complex and evolving threats, and traditional encryption algorithms are gradually showing their vulnerability in the face of emerging computing technologies. Since traditional encryption methods, such as RSA and elliptic curve encryption, rely on the difficulty of mathematical problems, the rise of quantum computers in recent years has posed an urgent threat to traditional encryption systems, pushing traditional encryption algorithms to the brink of danger. Cracking traditional encryption algorithms will make sensitive information, business secrets and personal privacy vulnerable to attack. Therefore, a more powerful security measure is urgently needed to deal with emerging computing technologies, especially the threats posed by quantum computers.

[0003] In order to meet this challenge, the introduction and application of quantum security technology has become the direction of innovation and development, which is of revolutionary importance to communication security. Quantum security technology is based on the superposition and non-cloning principles of quantum states, and uses key distribution technology to encrypt data once and for all, providing a higher level of security for data, thus making it possible to achieve absolute security of data transmission.

[0004] However, successfully integrating this cutting-edge quantum security technology with user terminals into a network is a complex task that requires overcoming various technical and implementation barriers. For example, key distribution technology usually requires the use of dedicated optical fibers for key transmission instead of traditional cables or wireless connections, resulting in the need to upgrade or modify the existing LAN infrastructure to adapt to the new requirements. Summary of the invention

[0005] The present application provides a quantum secure local area network networking system and method for enabling a user terminal to perform quantum secure communication through the established quantum secure local area network.

[0006] In a first aspect, the present application provides a method for establishing a quantum secure local area network, the method comprising:

[0007] Network topology planning: determining various types of quantum security devices contained in the quantum security local area network and the connection relationship between various types of quantum security devices, wherein each type of quantum security device includes at least one access base station, a key center and a network management device, wherein the key center and the network management device are both connected to the at least one access base station, and any access base station is used for key relay, management of user terminals accessing the access base station, and allocation of network access identifiers to user terminals accessing the access base station, wherein the key center is used to generate and distribute keys for the quantum security local area network, and the network management device is used to manage and monitor the quantum security local area network to ensure network communication of the quantum security local area network;

[0008] Configure network reachability strategy: the network access identification of any user terminal includes the quantum secure local area network information, access base station information and user terminal information, the quantum secure local area network information in the network access identification of each user terminal accessing the same quantum secure local area network is consistent, the access base station information in the network access identification of each user terminal accessing the same access base station is consistent, and the user terminal information in the network access identification of each user terminal accessing the same quantum secure local area network is different. When the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identification of the key receiving terminal, the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the key receiving terminal. The access base station information in the network access identification of the receiving end is used to determine whether the key receiving end is connected to the access base station. If it is determined that the key receiving end is connected to the access base station, the destination IP address of the key receiving end is determined based on the user terminal information in the network access identification of the key receiving end, so as to send the key to the key receiving end. If it is determined that the key receiving end is not connected to the access base station, the IP address of the access base station accessed by the key receiving end is determined based on the access base station information in the network access identification of the key receiving end, so as to send the key to the key receiving end through the access base station accessed by the key receiving end.

[0009] In a second aspect, the present application also provides a networking system for a quantum secure local area network, the system comprising: at least one access base station, a key center, and a network management device; wherein the key center and the network management device are both connected to the at least one access base station;

[0010] The access base station is used for key relay, management of user terminals accessing the access base station, and allocation of network access identifiers to user terminals accessing the access base station;

[0011] The key center is used to generate and distribute keys for the quantum secure local area network;

[0012] The network management device is used to manage and monitor the quantum secure local area network to ensure network communication of the quantum secure local area network.

[0013] The beneficial effects of this application are as follows:

[0014] 1. Since the network access identification contains the quantum secure LAN information, access base station information and user terminal information, the uniqueness and security of the user terminal's identity in the network is ensured, and the quantum secure LAN information in the network access identification of the user terminal accessing the same quantum secure LAN is consistent, and the access base station information in the network access identification of the user terminal accessing the same access base station is consistent. The user terminal information in the network access identification of different user terminals in the same quantum secure LAN is different, thereby maintaining the consistency and compliance of the network.

[0015] 2. When the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, the access base station can determine that the key receiving terminal is connected to the access base station based on the information in the network access identifier of the key receiving terminal, and determine the destination IP address of the key receiving terminal based on the user terminal information, thereby sending the key to the key receiving terminal, which ensures the accurate transmission of the key.

[0016] 3. When the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, the access base station can determine that the key receiving terminal is not connected to the access base station based on the information in the network access identifier of the key receiving terminal, and then determine the IP address of the access base station accessed by the key receiving terminal according to the access base station information in the network access identifier, so as to send the key to the key receiving terminal through the access base station with the IP address, which helps to ensure that the key can be reliably transmitted even when the user terminal moves or changes the access base station.

[0017] 4. Through the quantum secure local area network, quantum secure communication access to the user terminal can be achieved, which improves the security of communication between user terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of the networking process of a quantum secure local area network provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of the structure of a quantum secure local area network provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the structure of another quantum secure local area network system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0022] In order to enable the user end to perform quantum secure communication through the established quantum secure local area network, the embodiments of the present application provide a networking system and method for a quantum secure local area network.

[0023] Embodiment 1:

[0024] Figure 1 A schematic diagram of a quantum secure local area network networking process provided in an embodiment of the present application, the process includes:

[0025] S101: Network topology planning: Determine various types of quantum security devices included in the quantum security local area network and the connection relationship between various types of quantum security devices, wherein each type of quantum security device includes at least one access base station, a key center and a network management device, wherein the key center and the network management device are both connected to the at least one access base station, and any access base station is used for key relay, management of user terminals accessing the access base station, and allocation of network access identifiers to user terminals accessing the access base station, wherein the key center is used for generating and distributing keys for the quantum security local area network, and the network management device is used for managing and monitoring the quantum security local area network to ensure network communication of the quantum security local area network.

[0026] In this application, the networking of the quantum secure local area network requires first planning the network of the quantum secure local area network, so as to design and deploy various types of quantum secure devices contained in the quantum secure local area network and the connection relationship of various types of quantum secure devices according to the network topology. Among them, when planning the network topology of the quantum secure local area network, one or more demand planning can also be considered, such as the coverage of the quantum secure local area network, the number of user terminals to be served by the quantum secure local area network, the functions to be provided by the quantum secure local area network, etc., which can be set according to the actual situation during the specific implementation process, and are not specifically limited here.

[0027] It should be noted that the network topology of the quantum secure local area network can be planned through algorithms and required demand information. For example, a network topology generation model is trained in advance based on a large amount of different demand information and network topologies under different demand information, and then the network topology corresponding to the current demand information is determined based on the trained network topology generation model and the input demand information. It is also possible to pre-configure network topology templates under different demand information and required demand information to plan the network topology of the quantum secure local area network.

[0028] In the present application, each type of quantum security device included in the quantum security local area network may include at least one access base station. For any access base station, through the access base station, the quantum encrypted data (recorded as ciphertext data) communicated between user terminals and the quantum key can be sent through different network paths, that is, the ciphertext data is sent through the traditional network, and the key is sent through the quantum security local area network, which ensures the security of key relay.

[0029] In order to achieve accurate transmission of key relay, any access base station in the quantum secure local area network can also be used to allocate a network access identifier to the user terminal accessing the access base station, so that each user terminal accessing the quantum secure local area network corresponds to a network access identifier, and the network access identifiers of different user terminals are different, so as to ensure that the network access identifier can uniquely represent a user terminal in the quantum secure local area network, and the access base station can accurately relay the key based on the network access identifier of the user terminal. Exemplarily, the access base station pre-stores a network access identifier allocation rule, and the access base station can allocate a corresponding network access identifier to the user terminal accessing the access base station based on the network access identifier allocation rule. By allocating a network access identifier to the user terminal accessing the access base station through the access base station, it can be achieved that the network access identifiers corresponding to different user terminals in the quantum secure local area network are different and standardized, and the access base station can relay the key of the user terminal based on the network access identifier of the user terminal.

[0030] It should be noted that the network access identifier can be expressed in the form of numbers, strings, etc., or in other forms. When setting it specifically, any form that can uniquely identify the access base station can be used in this application.

[0031] In the present application, the access base station can also manage the user terminals accessing the access base station to ensure the legitimacy and security of the user terminals accessing the quantum secure local area network and prevent illegal devices from accessing the quantum secure local area network.

[0032] In the present application, the quantum secure local area network may also include a network management device, which is connected to each access base station in the quantum secure local area network, and is used to manage and monitor the quantum secure local area network through the network management device to ensure the network communication of the quantum secure local area network. In other words, through the network management device, a platform is provided for the quantum secure local area network to monitor and manage the network communication of the quantum secure local area network.

[0033] The user terminal accessed to the quantum secure local area network can use the quantum secure communication service provided by the quantum secure local area network through the quantum secure local area network established by the present application. In other words, the user terminal accessed to the quantum secure local area network can perform quantum secure communication through the quantum secure local area network. Exemplarily, the user terminal can quantum encrypt the data to be sent through the quantum key provided by the quantum secure local area network, and relay the quantum key to the opposite device through the quantum secure local area network. In another exemplary embodiment, the user terminal can obtain the key sent by the opposite user terminal through the quantum secure local area network, and then based on the key, perform quantum decryption on the ciphertext data corresponding to the key, thereby obtaining the decrypted data. Through the quantum secure local area network provided by the present application, the security of the user terminal sending and receiving data during the communication process can be achieved, and a safe and stable quantum secure communication service can be provided for the user terminal, reducing the cost required to achieve quantum secure communication between any two user terminals.

[0034] The quantum key can be determined based on a quantum random number. Since the quantum random number used to determine the quantum key each time is random and different, the final quantum key is also random and different, ensuring that the quantum key is only determined when it is used and cannot be predicted, so that the security of the data to be sent can achieve absolute security in theory. In addition, the quantum encryption does not have the reversibility of traditional encryption algorithms and the predictability of decryption results. Even through brute force cracking, it is impossible to accurately know the plaintext content of the quantum encrypted data.

[0035] It should be noted that the user terminal can be a user terminal, such as a quantum security all-in-one machine, a quantum security privacy computer, etc., or it can be a quantum security computer, such as a security server, an application server, etc.

[0036] Considering that the user end connected to the quantum secure local area network will consume the locally stored quantum keys when performing quantum encryption and decryption, resulting in an insufficient number of quantum keys. Based on this, in the present application, the quantum secure local area network may also include a key center to replenish the quantum keys in a timely manner through the key center, thereby ensuring the stability of quantum secure communication.

[0037] S102: Configure network reachability strategy: the network access identifier of any user terminal includes the quantum secure local area network information, access base station information and user terminal information, the quantum secure local area network information in the network access identifiers of each user terminal accessing the same quantum secure local area network is consistent, the access base station information in the network access identifiers of each user terminal accessing the same access base station is consistent, and the user terminal information in the network access identifiers of each user terminal accessing the same quantum secure local area network is different. When the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal. The access base station information in the network access identifier of the key receiving end is used to determine whether the key receiving end is connected to the access base station. If it is determined that the key receiving end is connected to the access base station, the destination IP address of the key receiving end is determined based on the user terminal information in the network access identifier of the key receiving end, so as to send the key to the key receiving end. If it is determined that the key receiving end is not connected to the access base station, the IP address of the access base station accessed by the key receiving end is determined based on the access base station information in the network access identifier of the key receiving end, so as to send the key to the key receiving end through the access base station accessed by the key receiving end.

[0038] In order to ensure that the communication between the user terminals connected to the quantum secure local area network is reachable, in this application, when establishing the quantum secure local area network, it is also necessary to configure the network reachability strategy of the quantum secure local area network. Exemplarily, the network reachability strategy can be configured based on the network access identification of each user terminal, so that the quantum secure local area network can be distinguished from the traditional network, so that the key is relayed through the quantum secure local area network, and the ciphertext data is transmitted through the traditional network, so that the key and the ciphertext data are transmitted to the opposite device through different networks respectively, and the key and the ciphertext data are guaranteed to be independent and isolated during the transmission process. Exemplarily, when user terminal A sends a key relay to user terminal B, the user terminal will send the key and the network access identification of user terminal B to the access base station. After the access base station receives the key and the network access identification of user terminal B that receives the key, it will send the key relay to user terminal B according to the network access identification of user terminal B.

[0039] In a possible implementation, the network access identifier of the user terminal may include quantum secure local area network information, access base station information, and user terminal information. The quantum secure local area network information in the network access identifiers of each user terminal accessing the same quantum secure local area network is consistent, the access base station information in the network access identifiers of each user terminal accessing the same access base station is consistent, and the user terminal information in the network access identifiers of each user terminal accessing the same quantum secure local area network is different. Different quantum secure local area networks can be distinguished by the quantum secure local area network information, different access base stations in a quantum secure local area network can be distinguished by the access base station information, and different user terminals in a quantum secure local area network can be distinguished by the user terminal information.

[0040] Optionally, the network access identification of the user terminal may include operator information, country information, and region information. Among them, the operator indicates the operator to which the quantum secure local area network accessed by the user terminal is connected, the country information indicates the country to which the quantum secure local area network accessed by the user terminal belongs, and the region information indicates the larger-level network division to which the quantum secure local area network accessed by the user terminal belongs, and a region includes at least one quantum secure local area network. The operator information in the network access identification of each user terminal accessed to the same operator is consistent, the country information in the network access identification of each user terminal accessed to the same country is consistent, and the region information in the network access identification of each user terminal accessed to the same region is consistent. The quantum secure local area networks under different operators can be distinguished through the operator information, the quantum secure local area networks under different countries can be distinguished through the country information, and the quantum secure local area networks under different regions can be distinguished through different regions. Exemplarily, the network access identification of a certain user terminal is ABCDE. Among them, D can represent the access base station information, and the information of different access base stations in the same quantum secure local area network is different; C represents the quantum secure local area network information, and the quantum secure local area network information corresponding to different quantum secure local area networks is different; B represents the regional information of the region to which the quantum secure local area network belongs, and the regional information corresponding to different regions in the same quantum secure network is different; A represents the operator to which the quantum secure local area network accessed by the user terminal is connected, and the operator information corresponding to different operators is different.

[0041] It should be noted that the specific fields included in the user terminal's network access identification are set according to actual needs. If you want to manage different user terminals at as many levels as possible, the network access identification can include more fields. If you want to reduce the resources consumed in allocating user terminal network access identifications, the network access identification can include fewer fields.

[0042] Based on the fields included in the network access identifier in the above embodiment, when configuring the network reachability strategy of the quantum secure local area network, the user terminal connected to the quantum secure local area network can be configured to send the network access identifier of the key receiving terminal and the key to the access base station connected to the user terminal when acting as a sending terminal. After receiving the key sent by the user terminal and the network access identifier of the key receiving terminal, the access base station can determine the forwarding strategy of the key according to the fields included in the network access identifier of the key receiving terminal and the preset field processing order. Among them, the field processing order can be quantum secure local area network information first, then access base station information, and finally user terminal information. In other words, the field processing order can be set from large to small according to the granularity corresponding to the level to which each field belongs.

[0043] The network communication between the user terminals connected to the quantum secure local area network is reachable, and the user terminals that are not connected to the quantum secure local area network should not communicate with the user terminals of the quantum secure local area network. Based on this, when processing the network access identification of the key receiving terminal, the access base station in the quantum secure local area network can first process the quantum secure local area network information in the network access identification to determine whether the key receiving terminal is connected to the quantum secure local area network. If the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identification of the key receiving terminal, the access base station can continue to process the access base station information in the network access identification of the key receiving terminal according to the preset field processing order. If the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identification of the key receiving terminal, the access base station can refuse to relay the key to the key receiving terminal.

[0044] In a possible implementation manner, the access base station determines that the key receiving terminal accesses the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, including:

[0045] If the quantum secure local area network information of the quantum secure local area network is consistent with the quantum secure local area network information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is connected to the quantum secure local area network.

[0046] Different quantum secure local area networks correspond to different quantum secure local area network information. The access base station can determine whether the key receiving terminal is connected to the quantum secure local area network according to whether the quantum secure local area network information in the network access identifier of the key receiving terminal is the quantum secure local area network information corresponding to the quantum secure local area network accessed by the access base station. Exemplarily, the access base station can determine whether the quantum secure local area network information in the network access identifier of the key receiving terminal is consistent with the quantum secure local area network information corresponding to the quantum secure local area network accessed by the access base station. If the access base station determines that the quantum secure local area network information corresponding to the quantum secure local area network is consistent with the quantum secure local area network information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is connected to the quantum secure local area network; if the access base station determines that the quantum secure local area network information corresponding to the quantum secure local area network is inconsistent with the quantum secure local area network information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is not connected to the quantum secure local area network.

[0047] Different user terminals can access different access base stations in the quantum secure local area network and perform key relay through the access base stations. Based on this, when the access base station determines that the key receiving terminal is connected to the quantum secure local area network, it can continue to process the access base station information in the network access identification of the key receiving terminal according to the preset field processing order, and determine whether the key receiving terminal is connected to the access base station according to the access base station information in the network access identification of the key receiving terminal. If the access base station determines that the key receiving terminal is connected to the access base station based on the access base station information in the network access identification of the key receiving terminal, the access base station can continue to process the user terminal information in the network access identification of the key receiving terminal according to the preset field processing order. If the access base station determines that the key receiving terminal is connected to the access base station based on the access base station information in the network access identification of the key receiving terminal, the access base station can determine the IP address of the access base station to which the key receiving terminal is connected according to the access base station information.

[0048] In a possible implementation manner, the access base station determines whether the key receiving terminal is connected to the access base station based on the access base station information in the network access identifier of the key receiving terminal, including:

[0049] If the access base station information of the access base station is consistent with the access base station information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is connected to the access base station;

[0050] Otherwise, it is determined that the key receiving end is connected to the access base station.

[0051] Different access base stations within the same quantum secure local area network correspond to different access base station information. The access base station can determine whether the key receiving terminal is connected to the access base station based on whether the access base station information in the network access identifier of the key receiving terminal is the access base station information corresponding to the access base station. Exemplarily, the access base station can determine whether the access base station information in the network access identifier of the key receiving terminal is consistent with the access base station information corresponding to the access base station. If the access base station determines that the access base station information corresponding to the access base station is consistent with the access base station information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is connected to the access base station; if the access base station determines that the access base station information corresponding to the access base station is inconsistent with the access base station information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is not connected to the access base station.

[0052] Based on the above embodiment, the access base station stores the corresponding relationship between the access base station information of each access base station in the quantum secure local area network and the IP address of each access base station. When the access base station determines that the key receiving end is connected to the quantum secure local area network and is not connected to the access base station, the access base station can determine the IP address corresponding to the access base station information in the network access identifier of the key receiving end based on the corresponding relationship between the access base station information of each access base station and the IP address of each access base station, and then relay the key and the network access identifier of the key receiving end to the access base station of the IP address according to the IP address, so as to relay the key to the key receiving end through the access base station of the IP address.

[0053] Based on the above embodiment, the access base station stores the correspondence between the information of each user terminal under the access base station in the quantum secure local area network and the IP address of each user terminal. When the access base station determines that the key receiving terminal is connected to the quantum secure local area network and is connected to the access base station, the access base station can determine the IP address corresponding to the user terminal information in the network access identifier of the key receiving terminal based on the correspondence between the information of each user terminal under the access base station and the IP address of each user terminal, and then relay the key and the network access identifier of the key receiving terminal to the key receiving terminal according to the IP address.

[0054] The beneficial effects of this application are as follows:

[0055] 1. Since the network access identification contains the quantum secure LAN information, access base station information and user terminal information, the uniqueness and security of the user terminal's identity in the network is ensured, and the quantum secure LAN information in the network access identification of the user terminal accessing the same quantum secure LAN is consistent, and the access base station information in the network access identification of the user terminal accessing the same access base station is consistent. The user terminal information in the network access identification of different user terminals in the same quantum secure LAN is different, thereby maintaining the consistency and compliance of the network.

[0056] 2. When the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, the access base station can determine that the key receiving terminal is connected to the access base station based on the information in the network access identifier of the key receiving terminal, and determine the destination IP address of the key receiving terminal based on the user terminal information, thereby sending the key to the key receiving terminal, which ensures the accurate transmission of the key.

[0057] 3. When the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, the access base station can determine that the key receiving terminal is not connected to the access base station based on the information in the network access identifier of the key receiving terminal, and then determine the IP address of the access base station accessed by the key receiving terminal according to the access base station information in the network access identifier, so as to send the key to the key receiving terminal through the access base station with the IP address, which helps to ensure that the key can be reliably transmitted even when the user terminal moves or changes the access base station.

[0058] 4. Through the quantum secure local area network, quantum secure communication access to the user terminal can be achieved, which improves the security of communication between user terminals.

[0059] Embodiment 2:

[0060] In order to ensure the stable operation of the quantum secure local area network, based on the above embodiment, in this application, the network management device is used to manage and monitor the quantum secure local area network, including:

[0061] In response to the input configuration operation, save the configuration files corresponding to the at least one access base station and the user terminal accessing the quantum secure local area network respectively;

[0062] Through each of the configuration files, network communication of the quantum secure local area network is ensured.

[0063] The network management device stores configuration files of each access base station in the quantum secure local area network and each user terminal connected to the quantum secure local area network. Through the stored configuration files, each access base station in the quantum secure local area network and each user terminal connected to the quantum secure local area network can be guided to allocate and configure their own data, thereby realizing network communication of the quantum secure local area network.

[0064] Exemplarily, for any access base station in the quantum secure local area network, the staff can configure the configuration data of the access base station by inputting a configuration operation into the network management device, thereby realizing the management of each access base station in the quantum secure local area network. Among them, the configuration data may include the name of the access base station and the quantum secure local area network identifier and network access identifier allocation rule to which the access base station belongs. The access base station in the subsequent quantum secure local area network can obtain the configuration file of the access base station through the connected network management device, and configure the relevant data of the access base station based on the configuration file. For example, the access base station sends a registration request according to the IP address of the configured network management device. Among them, the registration request carries the base station identifier of the access base station. After the network management device obtains the registration request, it determines whether the configuration data corresponding to the base station identifier carried in the registration request is stored locally. If it is determined that the configuration data corresponding to the base station identifier is stored locally, it means that the access base station identified by the base station identifier is an access base station in the quantum secure local area network, and the network management device can send the configuration data of the access base station to the access base station. If it is determined that the configuration data corresponding to the base station identifier is not saved locally, it means that the access base station identified by the base station identifier is not an access base station in the quantum secure local area network, and the network management device can refuse to respond to the access base station.

[0065] For another example, the staff can also configure the configuration data of the user terminal connected to the quantum secure local area network by inputting configuration operations into the network management device, such as the link relationship of the user terminal, the listening port information of the user terminal, etc., so as to realize the management of each user terminal connected to the quantum secure local area network. The user terminal connected to the quantum secure local area network can subsequently obtain the configuration file of the user terminal through the connected network management device, and configure the relevant data of the user terminal based on the configuration file.

[0066] In one example, when each access base station in a quantum secure local area network and each user terminal connected to the quantum secure local area network need to perform a version upgrade, the network management device can obtain the version update file required for the device that needs the version upgrade, for example, manually input the version update file to the network management device, or download the version update file from other devices. The network management device sends the version update file to the device that needs the version upgrade according to the IP address and port number of the device that needs the version upgrade. After the device that needs the version upgrade obtains the version update file, it can automatically perform a version update according to the version update file, or perform a version update after receiving an update instruction sent by the network management device.

[0067] In a possible implementation, the network management device is used to manage and monitor the quantum secure local area network, including:

[0068] Acquire and monitor the link status of the at least one access base station and the link corresponding to the user terminal respectively.

[0069] The network management device can also obtain data fed back by each access base station in the quantum secure local area network and each user terminal connected to the quantum secure local area network, such as link status, equipment load information, operating status of the access base station, etc., and process the acquired data, such as data analysis, data statistics, etc., so as to facilitate the management of each access base station in the quantum secure local area network and each user terminal connected to the quantum secure local area network. For example, for any access base station in the quantum secure local area network, the access base station can actively report data to the network management device, such as periodic reporting, reporting at a preset time point, etc., or the access base station can passively report data based on the request of the network management device.

[0070] Embodiment 3:

[0071] If the access base station directly forwards the key relay to the key receiving end, the key receiving end needs to save the quantum key paired with the sending end and the key index corresponding to the quantum key, so that it can determine the quantum key corresponding to the key index according to the key index sent by the sending end, and then perform quantum decryption on the ciphertext data corresponding to the quantum key according to the quantum key. Although this method can also achieve quantum secure communication, it requires the key receiving end to save the quantum key paired with the sending end and the key index corresponding to the quantum key for different sending ends, which consumes a large amount of storage space of the key receiving end and increases the storage pressure of the key receiving end. Therefore, based on the above embodiments, in the present application, the access base station can also be used to save the quantum key and the key index corresponding to the quantum key, and the quantum key is paired with the user end connected to the access base station. After the sending end can directly send the key index to the access base station, the access base station determines the quantum key (recorded as the decryption key) corresponding to the key index sent by the sending end based on the saved quantum key paired with the sending end and the key index corresponding to the quantum key, and sends the decryption key to the key receiving end, so that the key receiving end does not need to save a large number of quantum keys for different sending ends. The key receiving end only needs to save the quantum key paired with the access base station it is connected to, which greatly saves the storage space of each user end in the quantum secure local area network and reduces the storage pressure of each user end.

[0072] In a possible implementation manner, the access base station managing a user terminal accessing the access base station includes:

[0073] In response to the access authentication information sent by the user terminal, the user terminal is authenticated by the access authentication information, and after the identity authentication passes, the user terminal is allowed to access the access base station.

[0074] For a user terminal to be added to the quantum secure local area network, the user terminal may send access authentication information to the access base station. The access authentication information may carry the identity information of the user terminal. After receiving the access authentication information, the access base station may verify the access authentication information to authenticate the identity of the user terminal. If the access base station determines that the identity authentication of the user terminal has passed, the user terminal is allowed to access the access base station; if the access base station determines that the identity authentication of the user terminal has not passed, the user terminal is denied access to the access base station to deny the user terminal from being added to the quantum secure local area network.

[0075] Embodiment 4:

[0076] During the process of quantum secure communication, the user terminals and access base stations in the quantum secure local area network will continuously consume the locally stored quantum keys. Based on this, on the basis of the above embodiments, in this application, the key center is required to replenish the quantum keys stored in the user terminals in a timely manner to ensure the stability of quantum secure communication.

[0077] In one example, the key distributed by the key center can be supplemented to the user terminal and the access base station in the quantum secure local area network in an offline manner. For example, by connecting the user terminal to the key distribution machine, the key stored in the key distribution machine is distributed to the user terminal.

[0078] In another example, the key distributed by the key center can also be supplemented to the user terminal and access base station in the quantum secure local area network in an online manner. For example, the key center distributes the key to the user terminal online, and the user terminal can directly download the key from the key center.

[0079] Among them, the key center can obtain the key stored in the key distribution machine by connecting to the key distribution machine, or obtain the key through a key-generating device, for example, obtaining the key through a quantum random number generator.

[0080] Exemplarily, each type of quantum security device further includes: a quantum random number generator, which is used to generate quantum random numbers for the quantum secure local area network, so that the key center supplements the key for the quantum secure local area network according to the quantum random numbers.

[0081] In the present application, the quantum secure local area network may also include a quantum random number generator, which can generate quantum random numbers and store the quantum random numbers in a key center, so that the key center can determine the distributed key based on the quantum random numbers. Exemplarily, after the quantum random number generator generates the quantum random number, it can actively store the quantum random number in the key center, or it can transmit the generated quantum random number to the key center after receiving an acquisition request from the key center. Based on this, when building a quantum secure local area network, the quantum random number generator and the key center can be built into the quantum secure local area network.

[0082] Among them, the quantum random number generator can generate quantum random numbers in real time, or it can generate quantum random numbers according to a preset period. Of course, the quantum random number generator can also generate quantum random numbers after receiving a generation instruction. In the specific implementation process, it can be flexibly set according to actual needs, and no specific limitation is made here.

[0083] Embodiment 5:

[0084] In order to realize the access of a general terminal that does not have quantum encryption and decryption functions to a quantum secure local area network, on the basis of the above embodiments, in the present application, the various types of quantum security devices also include: a security server, the security server is connected to the access base station, the security server is used to access the general terminal and provide quantum encryption and decryption functions for the general terminal; wherein the general terminal does not have quantum encryption and decryption functions.

[0085] Considering that there are some user terminals (referred to as universal terminals) that do not have quantum encryption and decryption functions, a higher level of technology is also required to ensure the security of the data sent and received by the universal terminals. Based on this, in the present application, various types of quantum security devices in the quantum security local area network may also include a security server, which can be connected to the access base station in the quantum security local area network and used to access the universal terminal to provide quantum encryption and decryption functions for the universal terminal. Exemplarily, the security server can receive the data to be encrypted from the universal terminal, and then encrypt the data to be encrypted based on the quantum key to obtain the ciphertext data. The security server sends the ciphertext data to the receiving end, and relays the key corresponding to the ciphertext data to the receiving end through the access base station accessed by the security server, thereby realizing the application of quantum security communication technology to the universal terminal, and there is no need to modify the universal terminal, so as to achieve compatibility between the quantum security local area network and the universal terminal, reduce the modification cost, and provide quantum security communication for the universal terminal through the quantum security local area network.

[0086] Embodiment 6:

[0087] This application also provides a quantum secure local area network system. Figure 2 A schematic diagram of a quantum secure local area network provided in an embodiment of the present application, the system comprising: at least one access base station 21, a key center 22 and a network management device 23; wherein the key center 22 and the network management device 23 are both connected to the at least one access base station 21;

[0088] The access base station 21 is used for key relay, management of user terminals accessing the access base station 21, and allocation of network access identifiers to user terminals accessing the access base station 21;

[0089] The key center 22 is used to generate and distribute keys for the quantum secure local area network;

[0090] The network management device 23 is used to manage and monitor the quantum secure local area network to ensure network communication of the quantum secure local area network.

[0091] In a possible implementation, the system further includes: a quantum random number generator;

[0092] The quantum random number generator is connected to the key center 22 and is used to generate quantum random numbers for the quantum secure local area network, so that the key center 22 supplements the key for the quantum secure local area network according to the quantum random numbers.

[0093] In a possible implementation manner, the system further includes: a security server; wherein the security server is connected to the access base station 21;

[0094] The security server is used to access the universal terminal and provide quantum encryption and decryption functions for the universal terminal; wherein the universal terminal does not have quantum encryption and decryption functions.

[0095] In a possible implementation, the network management device 23 is specifically used to save configuration files corresponding to the at least one access base station 21 and the user terminal accessing the quantum secure local area network in response to the input configuration operation; and ensure the network communication of the quantum secure local area network through each of the configuration files.

[0096] In a possible implementation manner, the network management device 23 is specifically used to obtain and monitor the link status of the at least one access base station 21 and the link corresponding to the user terminal.

[0097] In a possible implementation, the access base station 21 is specifically configured to respond to access authentication information sent by a user terminal, authenticate the user terminal through the access authentication information, and allow the user terminal to access the access base station 21 after determining that the user terminal has passed the authentication.

[0098] In a possible implementation manner, the access base station 21 is specifically configured to determine that the key receiving terminal is connected to the quantum secure local area network if the quantum secure local area network information of the quantum secure local area network is consistent with the quantum secure local area network information in the network access identifier of the key receiving terminal.

[0099] In a possible implementation, the access base station 21 is specifically used to determine that the key receiving end is accessed to the access base station 21 if the access base station 21 information of the access base station 21 is consistent with the access base station 21 information in the network access identifier of the key receiving end; otherwise, determine that the key receiving end is accessed to the access base station 21.

[0100] Embodiment 7:

[0101] Figure 3 A schematic diagram of the structure of another quantum secure local area network system provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, the system includes: a network management device 31, an access base station 32, a key center 33, and a quantum random number generator 34.

[0102] The network management device 31 is connected to the access base station 32 and the key center 33 respectively, and is used to configure the configuration data of the access base station 32 and the key center 33 in the quantum secure local area network; wherein the configuration data includes device type, number of devices, link relationship between devices, encryption method, encryption ratio, etc.

[0103] The quantum random number generator 34 is connected to the key center 33 and is used to generate quantum random numbers and send them to the key center 33.

[0104] The key center 33 is connected to the access base station 32 and is used to generate and distribute keys for the quantum secure local area network.

[0105] The access base station 32 is used for key relay, management of user terminals accessing the access base station 32 , and allocation of network access identifiers to user terminals accessing the access base station 32 .

[0106] After the user terminal accesses the quantum secure local area network, quantum secure communication is carried out through the quantum secure local area network.

[0107] It should be noted that the principle of solving the problem by the networking system of the quantum secure local area network is similar to the principle of solving the problem by the networking method of the quantum secure local area network in the above embodiment. For details, please refer to the content of the above embodiment, and the repeated parts will not be repeated in detail.

Claims

1. A method for establishing a quantum secure local area network, characterized in that: The method comprises: S101: Determine a network topology of a quantum secure local area network; wherein the network topology includes various types of quantum secure devices included in the quantum secure local area network and connection relationships between various types of quantum secure devices; Wherein, each type of quantum security device includes: at least one access base station, a key center, a quantum random number generator and a network management device, and the key center and the network management device are both connected to the at least one access base station; The quantum random number generator is used to generate quantum random numbers for the quantum secure local area network, so that the key center can supplement the key for the quantum secure local area network according to the quantum random numbers; The key center is used to generate and distribute keys for user terminals connected to the quantum secure local area network; The network management device is used to manage and monitor the quantum secure local area network to ensure network communication of the quantum secure local area network; Any access base station is used for key relay, management of user terminals accessed to the access base station, and allocation of network access identifiers for user terminals accessed to the access base station; wherein the network access identifier of any user terminal includes the quantum secure local area network information, access base station information and user terminal information, the quantum secure local area network information is used to identify the quantum secure local area network accessed by the user terminal, the access base station information is used to identify the access base station accessed by the user terminal, the user terminal information is used to identify the user terminal, the quantum secure local area network information in the network access identifiers of each user terminal accessed to the quantum secure local area network is consistent, the access base station information in the network access identifiers of each user terminal accessed to the same access base station in the quantum secure local area network is consistent, and the user terminal information in the network access identifiers of each user terminal accessed to the quantum secure local area network is different; S102: Configuring a network reachability strategy for the quantum secure local area network so that any two user terminals connected to the quantum secure local area network can communicate with each other, thereby realizing networking of the quantum secure local area network that provides quantum security services to the user terminals; The network reachability strategy includes: When the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, the access base station determines whether the key receiving terminal is connected to the access base station based on the access base station information in the network access identifier of the key receiving terminal; wherein the access base station stores the corresponding relationship between the access base station information of each access base station in the quantum secure local area network and the IP address of each access base station; If it is determined that the key receiving end is connected to the access base station, determining the destination IP address of the key receiving end based on the user terminal information in the network access identifier of the key receiving end, so as to send the key to the key receiving end; If it is determined that the key receiving end is not connected to the access base station, the IP address of the access base station accessed by the key receiving end is determined based on the access base station information in the network access identifier of the key receiving end, so as to send the key to the key receiving end through the access base station accessed by the key receiving end.

2. The method according to claim 1, characterized in that Each type of quantum security device further includes: a security server, which is connected to the access base station, and is used to access a universal terminal and provide quantum encryption and decryption functions for the universal terminal; wherein the universal terminal does not have quantum encryption and decryption functions.

3. The method according to claim 1, characterized in that The network management device is used to manage and monitor the quantum secure local area network, including: In response to the input configuration operation, save the configuration files corresponding to the at least one access base station and the user terminal accessing the quantum secure local area network respectively; Through each of the configuration files, network communication of the quantum secure local area network is ensured.

4. The method according to claim 1, characterized in that The network management device is used to manage and monitor the quantum secure local area network, including: Acquire and monitor the link status of the links corresponding to the at least one access base station and each of the user terminals accessing the quantum secure local area network.

5. The method according to claim 1, characterized in that The access base station manages a user terminal accessing the access base station, including: In response to the access authentication information sent by the user terminal, the user terminal is authenticated by the access authentication information, and after it is determined that the user terminal has passed the identity authentication, the user terminal is allowed to access the access base station.

6. The method according to claim 1, characterized in that The access base station determines, based on the quantum secure local area network information in the network access identifier of the key receiving terminal, that the key receiving terminal is accessed to the quantum secure local area network, including: If the quantum secure local area network information of the quantum secure local area network is consistent with the quantum secure local area network information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is connected to the quantum secure local area network.

7. The method according to claim 1, characterized in that The access base station determines, based on the access base station information in the network access identifier of the key receiving terminal, whether the key receiving terminal is connected to the access base station, including: If the access base station information of the access base station is consistent with the access base station information in the network access identifier of the key receiving terminal, it is determined that the key receiving terminal is connected to the access base station; Otherwise, it is determined that the key receiving end is connected to the access base station.

8. A quantum secure local area network system, characterized in that: The system is used to achieve communication between any two user terminals connected to the quantum secure local area network, and realize the networking of the quantum secure local area network that provides quantum secure services for the user terminals. The system includes: at least one access base station, a key center, a quantum random number generator, and a network management device; wherein the key center and the network management device are both connected to the at least one access base station, and any access base station stores the corresponding relationship between the access base station information of each access base station in the quantum secure local area network and the IP address of each access base station; The access base station is used for key relay, management of user terminals accessing the access base station, and allocation of network access identifiers for user terminals accessing the access base station; wherein the network access identifier of any user terminal includes the quantum secure local area network information, access base station information, and user terminal information, the quantum secure local area network information is used to identify the quantum secure local area network accessed by the user terminal, the access base station information is used to identify the access base station accessed by the user terminal, the user terminal information is used to identify the user terminal, the quantum secure local area network information in the network access identifiers of each user terminal accessing the quantum secure local area network is consistent, the access base station information in the network access identifiers of each user terminal accessing the same access base station in the quantum secure local area network is consistent, and the user terminal information in the network access identifiers of each user terminal accessing the quantum secure local area network is different; The key center is used to generate and distribute keys for the quantum secure local area network; The network management device is used to manage and monitor the quantum secure local area network to ensure network communication of the quantum secure local area network; The quantum random number generator is used to generate quantum random numbers for the quantum secure local area network, so that the key center can supplement the key for the quantum secure local area network according to the quantum random numbers; Among them, the system is configured with a network reachability strategy, and the network reachability strategy includes: when the access base station determines that the key receiving terminal is connected to the quantum secure local area network based on the quantum secure local area network information in the network access identifier of the key receiving terminal, the access base station determines whether the key receiving terminal is connected to the access base station based on the access base station information in the network access identifier of the key receiving terminal; if it is determined that the key receiving terminal is connected to the access base station, the destination IP address of the key receiving terminal is determined based on the user terminal information in the network access identifier of the key receiving terminal, so as to send the key to the key receiving terminal; if it is determined that the key receiving terminal is not connected to the access base station, the IP address of the access base station accessed by the key receiving terminal is determined based on the access base station information in the network access identifier of the key receiving terminal, so as to send the key to the key receiving terminal through the access base station accessed by the key receiving terminal.

9. The system according to claim 8, characterized in that The system further comprises: a security server; wherein the security server is connected to the access base station; The security server is used to access the universal terminal and provide quantum encryption and decryption functions for the universal terminal; wherein the universal terminal does not have quantum encryption and decryption functions.

Images