A multi-level key QKD transmission system and method based on wavelength division multiplexing

Abstract

The present invention discloses a multi-level key QKD transmission system and method based on wavelength division multiplexing, which belongs to the field of laser technology. The system includes Alice control terminal, pulse transmission line, information processing plate and Bob user terminal; Alice control terminal sends optical pulse train to information processing plate; the information processing plate encrypts information in blocks according to the importance, and then puts it into different optical fiber channels for transmission to Bob user terminal, each piece of information is assigned a separate key, and the high-level key can obtain the low-level key, which can improve the security of the system and the transmission efficiency; at the same time, an administrator key is generated; wherein, all information and keys are encrypted according to the corresponding key algorithm; in addition, the design of multi-level keys can further protect information from being eavesdropped, even if the low-level key is stolen, the remaining information can be protected, and it is difficult for an eavesdropper to obtain all the valid information, which is conducive to enhancing the confidentiality of the information.

Description

Technical Field

[0001] The present invention belongs to the technical field of secure communications, and in particular relates to a multi-level key QKD transmission system and method based on wavelength division multiplexing. Background Art

[0002] Quantum Key Distribution (QKD) refers to the use of the characteristics of quantum entanglement to enable the two communicating parties to share a random and secure key to achieve information encryption and decryption, where the two communicating parties refer to the sender and the receiver. Post-quantum cryptography, also known as quantum computing-resistant cryptography, is a cryptographic algorithm that can resist attacks by quantum computers on existing cryptographic algorithms.

[0003] Confidential communication is a communication system that encrypts the code stream of the transmitted information source at the sending end and performs decryption authentication at the receiving end to prevent the information from being interfered with or eavesdropped. It can ensure the security and integrity of the information transmitted by both parties. At present, confidential communication generally adopts the RSA (Rivest-Shamir-Adleman) public key system. The security of this RSA public key system is guaranteed by the complexity of the algorithm and the limited computing power of the computer. The ever-increasing mathematical computing power and the rapid development of quantum computers have always threatened the security of the existing RSA public key system. As a reliable key distribution system, quantum key distribution is guaranteed by quantum properties such as the Heisenberg uncertainty principle and the no-cloning theorem in quantum mechanics. Combined with the one-time encryption method, it can ensure the absolute security of communication.

[0004] In traditional key management schemes, in order to improve security and prevent keys from being leaked by individual authorized users, a multi-signature method is usually adopted, that is, multiple authorized users use their own keys to sign information in turn. However, the whole information processing process is very lengthy when multiple authorized users sign information in turn. In addition, each authorized user holds his own key. When any user loses his key or refuses to use his key for some reason, it is possible to delay or prevent the transaction.

[0005] The existing QKD networks mainly use two technologies: one is the QKD network based on optical nodes, where the optical nodes can be splitters, optical switches, wavelength division multiplexers or other optical passive devices; the other is the QKD network based on trusted relays, the difficulty of which lies in maintaining the reliability of the relays. Compared with the second QKD network, the QKD network based on optical nodes does not need to guarantee the absolute reliability of the optical nodes. The quantum key distribution network based on splitters has the advantages of good security and easy implementation, but it also has a very obvious disadvantage, that is, its network expansion will seriously affect the single-user key generation rate and transmission distance.

[0006] In order to improve the key generation rate, the existing technology introduces wavelength division multiplexing technology into the QKD protocol. After adopting wavelength division multiplexing technology, different wavelengths can be used to transmit multiple optical signals on one optical fiber. Wavelength division multiplexing technology can also further improve the transmission capacity of optical fiber to meet the rapid growth of communication security needs. However, this existing technology combined with wavelength division multiplexing technology cannot achieve the management of the entire life cycle of key generation, distribution, decryption, transmission and destruction, resulting in the key being easily stolen during the transmission process, and the security of key management is low.

[0007] Therefore, there is an urgent need for a multi-level key QKD transmission system and method based on wavelength division multiplexing to solve the above problems. Summary of the invention

[0008] In response to the problems in the related technology, the present invention proposes a multi-level key QKD transmission system and method based on wavelength division multiplexing to overcome the above-mentioned technical problems existing in the existing related technology. The present invention helps to further protect information from eavesdropping by setting multi-level keys. Even if the low-level keys are stolen, the remaining information can be protected. It is difficult for an eavesdropper to obtain all the valid information, which further enhances the confidentiality of the information.

[0009] The technical solution of the present invention is implemented as follows: a multi-level key QKD transmission system based on wavelength division multiplexing includes an Alice control terminal, a pulse transmission line and a Bob user terminal, and also includes an information processing section;

[0010] The pulse transmission line includes a first optical fiber and a plurality of second optical fibers; the Alice control terminal is connected to the information processing board via the first optical fiber, and the information processing board is connected to the Bob user terminal via the plurality of second optical fibers;

[0011] The Alice control terminal includes a multi-wavelength pulse generation device; the multi-wavelength pulse generation device is used to generate an optical pulse train and send it to the information processing section, and the optical pulse train includes n optical signals with different wavelengths carrying different information; the information processing section is used to receive and detect multiple optical signals carrying different information; the different information is sorted from low to high according to the importance level as: the first information, the second information,..., the (n - 1)th information, and the nth information; where n is a positive integer;

[0012] The Alice control terminal classifies the optical signals into multiple levels according to the importance level of the information, and then numbers the classified optical signals from low to high in sequence as: the first optical signal, the second optical signal,..., the (n - 1)th optical signal, and the nth optical signal, and forms a sequence set A1, denoted as A1 = {1, 2,..., n - 1, n};

[0013] The information processing section encrypts the optical signals in the sequence set A1 in the following order: encrypts the first optical signal alone to obtain the key Keys_1, packs the second optical signal and the key Keys_1 together for encryption to obtain the key Keys_2,..., packs the nth optical signal and the key Keys_n - 1 together for encryption to obtain the key Keys_n; sorts the obtained multiple keys from low to high in sequence as: Keys_1 < Keys_2 <... < Keys_n - 1 < Keys_n, and forms a sequence set A2, denoted as A2 = {Keys_1, Keys_2,..., Keys_n - 1, Keys_n}, and Keys_n is the highest-level key;

[0014] Preferably, the key algorithms used by the information processing section to encrypt the optical signals in the sequence set A1 include, but are not limited to, SM2 algorithm, SM3 algorithm, SM4 algorithm, RSA algorithm, ECC algorithm, and ECDSA algorithm;

[0015] At the same time, the information processing section generates an administrator key Keys_Ad and assigns it to the administrator account, where the level of the administrator key Keys_Ad is higher than the level of the key Keys_n;

[0016] Among the n information carried by the n optical signals sent by the Alice control terminal, there is target information required by the Bob user terminal; it is set that the mth information is the target information, the mth information corresponds to the mth optical signal, and the key Keys_m corresponding to the mth optical signal is the access key, where the mth information is any one of the n information, m is a positive integer, and 1 ≤ m ≤ n;

[0017] The information processing module sends part of the key in the number set A2 to Bob's client through the second optical fiber, and the other part of the key in the number set A2 is stored in the information processing module;

[0018] The Bob client verifies the received first part of the key with the pass key Keys_m one by one, and if the verification fails, the communication line between the Bob client and the information processing block is locked; after the verification fails, the Bob client requests the administrator key Keys_Ad from the information processing block through a public channel; after the information processing block receives the request from the Bob client, the administrator account unlocks the communication line locked after the verification fails with the administrator key Keys_Ad; after the communication line is unlocked, the Bob client continues to receive all the remaining keys except the first part of the key, and verifies them one by one until the verification succeeds;

[0019] After successful verification, Bob's client terminal decrypts the key used for successful verification and obtains an optical signal of a level corresponding to the key used for successful verification and a key one level lower than the key used for successful verification; Bob's client terminal obtains target information from the optical signal of a level corresponding to the key used for successful verification, and Bob's client terminal then filters the remaining optical signals except the optical signal carrying the target information and stops verification.

[0020] In the present invention, the wavelength may be set to be proportional to the level of the optical signal; or the wavelength may be set to be inversely proportional to the level of the optical signal;

[0021] In the information processing block, the lowest level key Keys_1 includes the first information, the key Keys_2 includes the second information and the key Keys_1... and so on, the highest level key Keys_n includes the nth information and the key Keys_n-1; and it is set that the highest level key Keys_n can obtain the information carried by all the optical signals of the information processing block;

[0022] The present invention sets a multi-level key. When the user makes multiple wrong operations or is attacked by illegal elements, the information processing module will protect itself, that is, the communication line will be automatically locked and can only be unlocked by the administrator key Keys_Ad to further protect the information from being eavesdropped. Even if the low-level key is stolen, the remaining information can be protected. It is difficult for an eavesdropper to obtain all the valid information, thereby further enhancing the confidentiality of the information.

[0023] Furthermore, the information processing module includes a key management module and an information storage module;

[0024] The keys in the number sequence set A2 and the administrator key Keys_Ad are sent to the key management module for storage; the key encryption algorithms of the keys in the number sequence set A2 and the administrator key Keys_Ad are the same or different;

[0025] The key management module then sends part of the keys in the sequence set A2 to Bob's client through the second optical fiber, and the other part of the keys in the sequence set A2 is directly decrypted by the key management module;

[0026] The information processing section defines information with an importance level lower than or equal to level k as low-level information, and information with an importance level higher than level k as high-level information; where k is a positive integer, and 1≤k <n;

[0027] The key management module first decrypts the key corresponding to the low-level information in the sequence set A2 to obtain the low-level information, and sends the low-level information to the information storage module for storage. The Bob client directly obtains the low-level information from the information storage module.

[0028] The key management module then sends the key corresponding to the high-level information in the sequence set A2 to Bob's client through different second optical fibers; Bob's client verifies the keys obtained from the key management module one by one; after successful verification, Bob's client decrypts the key used for successful verification, and obtains an optical signal of the level corresponding to the key used for successful verification and a key one level lower than the key used for successful verification; Bob's client obtains target information from the optical signal of the level corresponding to the key used for successful verification; Bob's client then decrypts the key one level lower than the key used for successful verification step by step, and indirectly obtains low-level information.

[0029] Further, the information processing block includes an optical storage, a first beam splitter and a wavelength division multiplexer connected in sequence;

[0030] The wavelength division multiplexer is connected to Bob's client via a transmission link; the transmission link includes a first link, a second link, ... and an nth link; each of the links is provided with a second beam splitter;

[0031] In each of the links, the input end of the second beam splitter is connected to the wavelength division multiplexer through a third optical fiber; the two output ends of the second beam splitter are respectively connected to the first branch and the second branch;

[0032] The first branch includes a first variable optical attenuator, a pulse delayer, a second optical fiber delay line, a second phase modulator, an erbium-doped fiber amplifier and a gain equalizer connected in sequence;

[0033] The second branch includes a second variable optical attenuator, a first photodetector and a channel measuring instrument connected in sequence; the output end of the channel measuring instrument and the output end of the second phase modulator are both connected to the input end of the erbium-doped fiber amplifier;

[0034] The second beam splitter is connected to the same node as the first branch and the second branch; the first branch is used to modulate the wavelength of the optical signal to load phase information, and the second branch is used to provide reference information for the first branch and monitor the aggregate channel or single channel power inside the node;

[0035] The first photoelectric detector is used to monitor the signal-to-noise ratio of the optical signal in the entire node; the channel measuring instrument is used to monitor the power of the aggregated channel or single channel in the node;

[0036] The Alice control terminal is connected to the optical storage via a first optical fiber, and the gain equalizer is connected to the Bob user terminal via a plurality of second optical fibers.

[0037] Further, the key management module includes the optical memory, the first beam splitter, the wavelength division multiplexer, the third optical fiber, the second beam splitter, the first variable optical attenuator, the pulse delayer, the second optical fiber delay line, the second phase modulator, the erbium-doped fiber amplifier and the gain equalizer connected in sequence;

[0038] The optical memory, the first beam splitter, the wavelength division multiplexer, the third optical fiber, the second beam splitter, the second variable optical attenuator, the first photodetector, the channel meter, the erbium-doped fiber amplifier and the gain equalizer are sequentially connected to form the information storage module.

[0039] When the information processing block receives the optical pulse train, the optical memory stores the optical signal sent by the Alice control terminal, the first beam splitter divides the input optical signal into n paths, and the wavelength division multiplexer simultaneously transmits n optical signals of different wavelengths on one optical fiber and sends them to each of the links respectively;

[0040] In each of the links, the third optical fiber transmits the optical signal to the second beam splitter, and the second beam splitter divides the optical signal into two optical signals, one of which is transmitted to the first branch, and the other is transmitted to the second branch; in the first branch, the first variable optical attenuator adjusts the intensity of the optical signal, and the second phase modulator adjusts the phase of the optical signal; the pulse delayer and the second optical fiber delay line are used to delay the optical signal returned from Bob's user end until it arrives at the node together with the optical signal returned from the second branch; in the second branch, the second variable optical attenuator is used to adjust the intensity of the optical signal, the first photodetector detects the optical signal, and the channel meter is used to test the intensity of the optical signal; the erbium-doped fiber amplifier is used to increase the intensity of the input optical signal; and the gain equalizer is used to adjust the waveform balance of the input optical signal.

[0041] Preferably, the wavelength division multiplexer adopts a reconfigurable optical differential multiplexer, an optical power adjustable wavelength division multiplexer or a WSS wavelength selective switch.

[0042] Preferably, the optical memory adopts a non-saturated bipolar semiconductor memory, a semi-random access memory or a readable and writable magneto-optical disk memory.

[0043] Further, the multi-wavelength pulse generating device comprises a single light source multi-wavelength pulse laser and a wavelength selector connected in sequence;

[0044] The Alice control end also includes an optical path circulator, a coupler, a pre-optical amplifier, an unbalanced interferometer, and a first optical switch connected in sequence;

[0045] The output end of the wavelength selector is connected to the input end of the optical circulator; the Alice control end also includes a first detection device and a second detection device; the two input ends of the coupler are respectively connected to the second detection device and the optical circulator; the first detection device is connected to a single-light-source multi-wavelength pulse laser;

[0046] The unbalanced interferometer comprises a long arm and a short arm; wherein the long arm of the unbalanced interferometer comprises a first optical fiber delay line, a first phase modulator and a polarization beam splitter connected in sequence; the short arm of the unbalanced interferometer is connected to the output end of the pre-optical amplifier and the other input end of the polarization beam splitter; the polarization beam splitter is used to separate the input optical signal according to different polarization directions;

[0047] The optical pulse train output by the single-source multi-wavelength pulse laser first passes through the wavelength selector, optical circulator and coupler in sequence, and then is injected into the unbalanced interferometer through the pre-optical amplifier;

[0048] The single-light-source multi-wavelength pulse laser emits multiple optical signals, the wavelength selector selects different wavelengths for the multiple optical signals, and the optical path circulator transmits the multiple optical signals unidirectionally to the coupler; the first detection device detects the time when the multiple optical signals are sent from the Alice control end, and the second detection device detects the time when the multiple optical signals return from the Bob user end to the Alice control end; the coupler transmits the optical signal, the pre-optical amplifier amplifies the input optical signal to increase the signal strength, and the first optical fiber delay line then compensates the input optical signal for delay; the first phase modulator realizes the level division of the optical signal by adjusting the phase of the optical signal; the optical signal output by the first phase modulator and the optical signal output by the short arm are combined in the polarization beam splitter, and the combined optical signal is sent to the information processing block via the first optical switch; the first optical switch is also used to lock the communication line between the Alice control end and the information processing block.

[0049] The Bob client terminal includes a beam combiner, a second optical switch and a filter connected in sequence; the Bob client terminal also includes a second photodetector connected to the beam combiner; the beam combiner and the second optical switch are connected via a fourth optical fiber, and the second optical switch and the filter are also connected via a fifth optical fiber; the fourth optical fiber and the fifth optical fiber are both single-mode optical fibers SMF;

[0050] The first optical switch is connected to the information processing board via a first optical fiber, and the information processing board is connected to the beam combiner via a plurality of second optical fibers;

[0051] The beam combiner receives the optical signal sent by the information processing module, and the second photodetector is used to detect the phase information of the optical signal to obtain the key, and then compares and verifies the obtained key with the pass key; when the verification fails, the second optical switch locks the communication line between the Bob client and the information processing module; when the verification succeeds, the target information and the lower-level key are decrypted, and the filter then filters the remaining optical signals except the optical signal carrying the target information.

[0052] Preferably, the optical switches are semiconductor laser optical switches or built-in amplifying optical switches;

[0053] Each of the detection devices adopts a multi-wavelength single-photon detection device.

[0054] Preferably, the unbalanced interferometer adopts an unequal-arm Michelson interferometer with an automatic polarization compensation function;

[0055] The long arm and the short arm of the unbalanced interferometer are both made of polarization-maintaining optical fiber.

[0056] Preferably, the beam combiner is a high-power pump signal beam combiner or a signal light beam combiner.

[0057] Preferably, the filter is a bandpass filter, a Chebyshev filter or a Butterworth filter.

[0058] Furthermore, after the optical pulse string reaches the wavelength selector, the wavelength selector selects the wavelength using a secondary equidistant frequency interval method; the first photodetector is also used to detect whether there are other external optical signals in the line from Alice's control end to Bob's user end except for the optical signal screened by the wavelength selector. If other external optical signals are detected, it is determined that eavesdropping occurs.

[0059] Furthermore, the number of the second optical fibers is the same as the number of levels into which the optical signal is divided; the first optical fibers are shared optical fibers, and the second optical fibers are dedicated optical fibers.

[0060] A multi-level key QKD transmission method based on wavelength division multiplexing is applied to the above-mentioned multi-level key QKD transmission system based on wavelength division multiplexing, comprising the following steps:

[0061] Step S1: information classification, optical signal classification, optical signal encryption, key screening and coding, the steps are as follows:

[0062] Step S1a: Information classification; Alice control terminal sends an optical pulse train to the information processing module, wherein the optical pulse train includes a plurality of optical signals of different wavelengths carrying different information; the information processing module receives and detects the plurality of optical signals carrying different information; wherein the different information is sorted from low to high according to the importance: first information, second information, ..., n-1th information and nth information;

[0063] Step S1b: optical signal classification; the Alice control terminal classifies the optical signals into multiple levels according to the importance of the information, and then numbers the classified optical signals from low level to high level in sequence: the first optical signal, the second optical signal, ..., the n-1th optical signal and the nth optical signal, and forms a sequence set A1, which is recorded as A1 = {1, 2, ..., n-1, n};

[0064] Step S1c: Encrypt the optical signal; the information processing section encrypts the optical signals in the sequence set A1 in the following order: encrypt the first optical signal to obtain the key Keys_1, encrypt the second optical signal and the key Keys_1 together to obtain the key Keys_2,..., encrypt the (n - 1)th optical signal and the key Keys_n - 2 together to obtain the key Keys_n - 1, encrypt the nth optical signal and the key Keys_n - 1 together to obtain the key Keys_n; sort the obtained multiple keys in ascending order of level as: Keys_1 < Keys_2 <... < Keys_n - 2 < Keys_n - 1 < Keys_n, and form a sequence set A2, denoted as A2 = {Keys_1, Keys_2,..., Keys_n - 2, Keys_n - 1, Keys_n}, where Keys_n is the highest-level key;

[0065] Step S1d: Key screening and code generation; randomly screen the keys in the sequence set A2; then randomly select some data from the screened keys, determine whether there is eavesdropping, after determining that there is no eavesdropping,剔除 the selected data, and then perform data reconciliation and privacy amplification on the remaining data to obtain a secure key;

[0066] Step S1e: Generate the administrator key Keys_Ad; the information processing section generates an administrator key Keys_Ad and assigns it to the administrator account; the administrator key Keys_Ad, by default, uses the SM2 algorithm and is used to unlock the communication line between the Bob client and the information processing section; the level of the administrator key Keys_Ad is higher than the level of the key Keys_n;

[0067] Step S2: Keys between different levels: According to the key levels set in Step S1, the key levels are: Keys_Ad > Keys_n > Keys_n - 1 >... > Keys_l; the Bob client can only obtain one of the keys, decrypt it to obtain the target information and the lower-level key; among them, the Bob client directly obtains the low-level information from the information processing section, or obtains all the information content of the information processing section through the key Keys_n;

[0068] Step S3: If there is eavesdropping on the Alice control end, lock the communication line between the Alice control end and the information processing section; if the key verification of the Bob client fails, lock the communication line between the Bob client and the information processing section;

[0069] Step S4: Remaining information processing: After Bob obtains the target information at the user end, the key management module sends a key management instruction. After receiving the key management instruction, the filter starts to filter the remaining optical signals except the optical signals carrying the target information, and destroys or updates the keys and decryption information of the key management module and the information storage module.

[0070] In the present invention, before performing step S1, system state initialization, system noise test and system noise test are performed first:

[0071] System status initialization: Check the hardware and software facilities of Alice's control terminal, information processing module and Bob's client to see if the equipment can operate normally and set the initial conditions;

[0072] System noise test: Under the premise that Alice control end does not transmit optical pulse trains, that is, when the number of optical pulse trains is zero, test the system noise level; further, determine whether the measured noise hinders the normal operation of the system. If so, it is necessary to reduce the channel crosstalk so that the QBER value is lower than the predetermined threshold, and modify the attenuation of each variable optical attenuator and / or the gain of each optical amplifier so that the classical channel power in the optical fiber is low enough to enable the system to work normally;

[0073] Fiber length test and pulse delay setting: According to the time domain method, Alice generates a group of strong pulse signals, sends them out through the first fiber delay line, measures the length of the first fiber delay line, and then sets the information processing block delay according to the length relationship of the optical fiber between the information processing block and Alice's control end; after setting the delay, Alice's control end transmits another group of strong pulses, which are attenuated by the information processing block and return to Alice's control end, and measures the arrival time. The round-trip time continuously adjusts the information processing block delay setting so that the pulses that arrive at each transmission link of the information processing block and then return arrive at Alice's control end almost at the same time;

[0074] Furthermore, the length measurement process of the first optical fiber delay line is as follows: a first detection device is set at the starting point of the first optical fiber delay line, and a second detection device is set at the end point of the first optical fiber delay line to receive a strong pulse signal; after each of the detection devices receives the strong pulse signal, the time difference between the starting point and the end point receiving the signal is measured to obtain the length of the first optical fiber delay line.

[0075] Furthermore, in step S1c, Alice's control end sends an optical pulse string to Bob's user end in frames, with a certain number of frames sent each time; after receiving the optical pulse string, Bob's user end modulates and attenuates it to the single-photon level through the information processing module and then returns it. The pulses returned from the information processing module through different optical fibers simultaneously arrive at Alice's control end and are loaded with the same phase information; the voltage required for modulating the pulse corresponds to the true random code generated before the pulse is sent. As the selection of their respective bases, Alice's control end and Bob's user end select different voltage modulation pulse phases according to their respective coding needs; Alice's control end records the detection response events of each of the detection devices, and publicly compares the base with Bob's user end. The information processing module then encrypts the information of the graded optical signal blocks to form a key.

[0076] Furthermore, the security keys obtained in step S1d are stored bit by bit, and each group of security keys includes a unique key ID, wherein the character length of the key ID is two bytes; the key ID is a unique identifier of each level of keys in the key storage module, and the key sending time is used as the key ID before the key.

[0077] Further, in step S3, Alice's control end is provided with a first optical switch. When the first photodetector detects that there are other external optical signals in the line except those screened out by the wavelength selector, that is, when eavesdropping occurs, the first optical switch automatically operates to lock the communication line, the optical storage device suspends operation, stops writing or reading, and the already running data is temporarily stored in the optical storage device, and the communication is abandoned, waiting for the administrator account to unlock the communication line with the administrator key Keys_Ad; Bob's user end is provided with a second optical switch, and the second optical switch operates after the key verification fails, locks the communication line, and waits for the administrator account to unlock it with the administrator key Keys_Ad.

[0078] Further, in step S4, the key management instruction includes a key destruction instruction and a key update instruction; when the key management module sends a key destruction instruction, the filter retains the optical signal carrying the target information, filters the optical signals of the remaining channels, and destroys the key and decryption information of the key management module and the information storage module;

[0079] When the key management module sends a key update instruction, the filter updates the key and decryption information of the key management module and the information storage module;

[0080] Furthermore, the key management module will send a key update instruction only after the Alice control terminal updates the information carried by the optical signal.

[0081] Beneficial effects of the present invention:

[0082] (1) The present invention provides a multi-level key QKD transmission system and method based on wavelength division multiplexing, wherein the system includes an Alice control terminal, a pulse transmission line, an information processing module and a Bob user terminal; the present invention combines wavelength division multiplexing technology to ensure the relative independence of each information and the key generation rate, and the key generation rate will not decrease with the increase of the key level; while using wavelength division multiplexing technology to improve the utilization rate of the transmission optical fiber, the key generation rate of the system can be further improved by reasonably selecting the average number of photons in the signal state;

[0083] (2) Compared with the prior art, the present invention uses a single-light-source multi-wavelength laser to replace a multi-light-source structure, thereby ensuring phase modulation stability and reducing system costs;

[0084] (3) The multi-level key QKD transmission system based on wavelength division multiplexing described in the present invention uses mature devices, the overall solution has high feasibility, and the key level can be increased, which has good scalability;

[0085] (4) The entire system of the present invention can realize the full life cycle management of key generation, distribution, decryption, transmission and destruction, ensuring that the key is not stolen during the transmission process, which is safe and controllable, and can also greatly enhance the security of key management;

[0086] (5) Moreover, the information processing module encrypts the information in blocks according to the importance, and then puts them into different optical fiber channels for transmission. Each piece of information is assigned a separate key, and a high-level key can obtain a low-level key, which can improve the security of the system and the transmission efficiency;

[0087] (6) In addition, the multi-level key design can further protect information from eavesdropping. Even if the low-level key is stolen, the remaining information can be protected. It is difficult for an eavesdropper to obtain all the valid information, which further enhances the confidentiality of the information. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] Figure 1 The overall structural block diagram of a multi-level key QKD transmission system based on wavelength division multiplexing of the present invention;

[0089] Figure 2 It is a specific structural diagram of a multi-level key QKD transmission system based on wavelength division multiplexing of the present invention;

[0090] Figure 3 A schematic diagram of the process of encrypting the optical signal in the number series set A1 by the information processing module of the present invention;

[0091] Figure 4 It is a structural diagram of the Alice control terminal of the present invention;

[0092] Figure 5 It is a structural schematic diagram of the information processing module of the present invention;

[0093] Figure 6 Another structural schematic diagram of the information processing module of the present invention;

[0094] Figure 7 It is a structural diagram of Bob's client of the present invention;

[0095] Figure 8 The present invention is a flowchart of a multi-level key QKD transmission method based on wavelength division multiplexing.

[0096] Marking Description:

[0097] 101, information processing section; 102, first optical fiber; 103, 104, 105, 106 - second optical fiber;

[0098] 201, single light source multi-wavelength pulse laser; 202, wavelength selector; 203, optical path circulator; 204, first detection device; 205, second detection device; 206, coupler; 207, pre-optical amplifier; 208, first optical fiber delay line; 209, first phase modulator; 210, polarization beam splitter; 211, long arm; 212, short arm; 213, first optical switch; 214, multi-wavelength pulse generator; 215, unbalanced interferometer;

[0099] 301, wavelength division multiplexer; 302, 313, 321, 332-third optical fiber; 303, 314, 322, 333-second beam splitter; 304, 315, 323, 334-first variable optical attenuator; 305, 316, 324, 335-pulse delayer; 306, 317, 325, 336-second optical fiber delay line; 307, 318, 326, 337-second phase modulator; 308, 3 19, 327, 338- Erbium-doped fiber amplifier; 309, 320, 328, 339- Gain equalizer; 310, 343, 329, 340- Second variable optical attenuator; 311, 344, 330, 341- First photodetector; 312, 345, 331, 342- Channel measuring instrument; 346, Optical storage; 347, First beam splitter; 348, Key management module; 349, Information storage module;

[0100] 401, beam combiner; 402, second optical switch; 403, fourth optical fiber; 404, filter; 405, fifth optical fiber; 406, second photodetector. DETAILED DESCRIPTION

[0101] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0102] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0103] like Figure 1-7 As shown, this embodiment provides a multi-level key QKD transmission system based on wavelength division multiplexing, including Alice control terminal, pulse transmission line and Bob user terminal, and also includes an information processing module 101;

[0104] The pulse transmission line includes a first optical fiber 102 and a plurality of second optical fibers 103; the Alice control terminal is connected to the information processing block 101 via the first optical fiber 102, and the information processing block 101 is connected to the Bob user terminal via the plurality of second optical fibers 103;

[0105] The Alice control terminal includes a multi-wavelength pulse generator 214; the multi-wavelength pulse generator 214 is used to generate an optical pulse train and send it to the information processing block 101, the optical pulse train includes n optical signals of different wavelengths carrying different information; the information processing block 101 is used to receive and detect multiple optical signals carrying different information; the different information is sorted from low to high according to the importance: first information, second information, ..., n-1th information and nth information; wherein n is a positive integer;

[0106] The Alice control terminal divides the optical signals into multiple levels according to the importance of the information, and then numbers the divided optical signals from the lowest level to the highest level in sequence: the first optical signal, the second optical signal, ..., the n-1th optical signal and the nth optical signal, and forms a sequence set A1, which is recorded as A1={1, 2, ..., n-1, n};

[0107] like Figure 3As shown, the information processing section 101 encrypts the optical signals in the sequence set A1 of sequences in the following order: encrypt the first optical signal alone to obtain the key Keys_1, encrypt the second optical signal and the key Keys_1 together to obtain the key Keys_2,..., encrypt the nth optical signal and the key Keys_n - 1 together to obtain the key Keys_n; sort the obtained multiple keys in ascending order of level as: Keys_1 < Keys_2 <... < Keys_n - 1 < Keys_n, and form a sequence set A2, denoted as A2 = {Keys_1, Keys_2,..., Keys_n - 1, Keys_n}, where Keys_n is the highest-level key;

[0108] Specifically, the key algorithms used by the information processing section 101 to encrypt the optical signals in the sequence set A1 include, but are not limited to, SM2 algorithm, SM3 algorithm, SM4 algorithm, RSA algorithm, ECC algorithm, and ECDSA algorithm;

[0109] At the same time, the information processing section 101 generates an administrator key Keys_Ad and assigns it to the administrator account, where the level of the administrator key Keys_Ad is higher than the level of the key Keys_n;

[0110] Among the n pieces of information carried by the n optical signals sent by the Alice control terminal, there is the target information required by the Bob user terminal; it is set that the mth piece of information is the target information, the mth piece of information corresponds to the mth optical signal, and the key Keys_m corresponding to the mth optical signal is the passing key, where the mth piece of information is any one of the n pieces of information, m is a positive integer, and 1 ≤ m ≤ n;

[0111] The information processing section 101 sends some of the keys in the sequence set A2 to the Bob user terminal through the second optical fiber 103, and stores the other part of the keys in the sequence set A2 in the information processing section 101;

[0112] The Bob user terminal verifies each of the received first part of the keys with the passing key Keys_m one by one. If the verification fails, the communication line between the Bob user terminal and the information processing section 101 is locked; after the verification fails, the Bob user terminal requests the administrator key Keys_Ad from the information processing section 101 through the public channel; after the information processing section 101 receives the request from the Bob user terminal, the administrator account unlocks the communication line locked after the verification fails with the administrator key Keys_Ad; after the communication line is unlocked, the Bob user terminal continues to receive all the remaining keys except the first part of the keys. And verify each one until the verification is successful;

[0113] After successful verification, Bob's client terminal decrypts the key used for successful verification and obtains an optical signal of a level corresponding to the key used for successful verification and a key one level lower than the key used for successful verification; Bob's client terminal obtains target information from the optical signal of a level corresponding to the key used for successful verification, and Bob's client terminal then filters the remaining optical signals except the optical signal carrying the target information and stops verification.

[0114] In this embodiment, the wavelength may be set to be proportional to the level of the optical signal; or the wavelength may be set to be inversely proportional to the level of the optical signal;

[0115] In the information processing block 101, the lowest level key Keys_1 includes the first information, the key Keys_2 includes the second information and the key Keys_1... and so on, the highest level key Keys_n includes the nth information and the key Keys_n-1; and it is set that the highest level key Keys_n can obtain the information carried by all the optical signals of the information processing block 101;

[0116] This embodiment sets a multi-level key. When the user makes multiple wrong operations or is attacked by illegal elements, the information processing module 101 will protect itself, that is, the communication line will be automatically locked and can only be unlocked by the administrator key Keys_Ad to further protect the information from being eavesdropped. Even if the low-level key is stolen, the remaining information can be protected. It is difficult for an eavesdropper to obtain all the valid information, thereby further enhancing the confidentiality of the information.

[0117] Specifically, the information processing module 101 includes a key management module 348 and an information storage module 349;

[0118] The keys in the number set A2 and the administrator key Keys_Ad are sent to the key management module 348 for storage; the key encryption algorithms of the keys in the number set A2 and the administrator key Keys_Ad are the same or different;

[0119] The key management module 348 then sends part of the keys in the sequence set A2 to Bob's client through the second optical fiber, and the other part of the keys in the sequence set A2 is directly decrypted by the key management module 348;

[0120] The information processing module 101 defines information with an importance level lower than or equal to level k as low-level information, and information with an importance level higher than level k as high-level information; wherein k is a positive integer, and 1≤k <n;

[0121] The key management module 348 first decrypts the key corresponding to the low-level information in the sequence set A2 to obtain the low-level information, and sends the low-level information to the information storage module 349 for storage. The Bob client directly obtains the low-level information from the information storage module 349.

[0122] The key management module 348 then sends the key corresponding to the high-level information in the sequence set A2 to Bob's client through different second optical fibers 103; Bob's client verifies the keys obtained from the key management module 348 one by one; after successful verification, Bob's client decrypts the key used for successful verification, and obtains an optical signal of a level corresponding to the key used for successful verification and a key one level lower than the key used for successful verification; Bob's client obtains target information from the optical signal of a level corresponding to the key used for successful verification; Bob's client then decrypts the key one level lower than the key used for successful verification step by step, and indirectly obtains low-level information.

[0123] Specifically, the information processing block 101 includes an optical storage 346, a first beam splitter 347 and a wavelength division multiplexer 301 connected in sequence;

[0124] The wavelength division multiplexer 301 is connected to Bob's client via a transmission link; the transmission link includes a first link, a second link, ... and an nth link; each of the links is provided with a second beam splitter 303;

[0125] In each of the links, the input end of the second beam splitter 303 is connected to the wavelength division multiplexer 301 through the third optical fiber 302; the two output ends of the second beam splitter 303 are respectively connected to the first branch and the second branch;

[0126] The first branch includes a first variable optical attenuator 304, a pulse delayer 305, a second optical fiber delay line 306, a second phase modulator 307, an erbium-doped fiber amplifier 308 and a gain equalizer 309 connected in sequence;

[0127] The second branch includes a second variable optical attenuator 310, a first photodetector 311 and a channel measuring instrument 312 connected in sequence; the output end of the channel measuring instrument 312 and the output end of the second phase modulator 307 are both connected to the input end of the erbium-doped fiber amplifier 308;

[0128] The second beam splitter 303 is connected to the same node as the first branch and the second branch; the first branch is used to modulate the wavelength of the optical signal to load phase information, and the second branch is used to provide reference information for the first branch and monitor the aggregate channel or single channel power inside the node;

[0129] The first photodetector 311 is used to monitor the signal-to-noise ratio of the optical signal in the entire node; the channel measuring instrument 312 is used to monitor the power of the aggregated channel or single channel in the node;

[0130] The Alice control terminal is connected to the optical storage 346 via the first optical fiber 102 , and the gain equalizer 309 is connected to the Bob user terminal via multiple second optical fibers 103 .

[0131] Specifically, Figure 5 As shown, the key management module 348 includes the optical memory 346, the first beam splitter 347, the wavelength division multiplexer 301, the third optical fiber 302, the second beam splitter 303, the first variable optical attenuator 304, the pulse delay 305, the second optical fiber delay line 306, the second phase modulator 307, the erbium-doped fiber amplifier 308 and the gain equalizer 309 connected in sequence;

[0132] like Figure 6 As shown, the optical storage 346, the first beam splitter 347, the wavelength division multiplexer 301, the third optical fiber 302, the second beam splitter 303, the second variable optical attenuator 310, the first photodetector 311, the channel meter 312, the erbium-doped fiber amplifier 308 and the gain equalizer 309 are connected in sequence to form the information storage module 349.

[0133] When the information processing module 101 receives the optical pulse train, the optical memory 346 stores the optical signal sent by the Alice control terminal, the first beam splitter 347 divides the input optical signal into n paths, and the wavelength division multiplexer 301 simultaneously transmits n optical signals of different wavelengths on one optical fiber and sends them to each of the links respectively;

[0134] In each of the links, the third optical fiber 302 transmits the optical signal to the second beam splitter 303, and the second beam splitter 303 divides the optical signal into two optical signals, one of which is transmitted to the first branch, and the other is transmitted to the second branch; in the first branch, the first variable optical attenuator 304 adjusts the intensity of the optical signal, and the second phase modulator 307 adjusts the phase of the optical signal; the pulse delayer 305 and the second optical fiber delay line 306 are used to delay the optical signal returned from Bob's user end until it arrives at the node together with the optical signal returned from the second branch; in the second branch, the second variable optical attenuator 310 is used to adjust the intensity of the optical signal, the first photodetector 311 detects the optical signal, and the channel meter 312 is used to test the intensity of the optical signal; the erbium-doped fiber amplifier 308 is used to increase the intensity of the input optical signal; and the gain equalizer 309 is used to adjust the waveform balance of the input optical signal.

[0135] Specifically, the wavelength division multiplexer 301 adopts a reconfigurable optical differential multiplexer, an optical power adjustable wavelength division multiplexer or a WSS wavelength selective switch.

[0136] Specifically, the optical memory 346 adopts a non-saturated bipolar semiconductor memory, a semi-random access memory or a readable and writable magneto-optical disk memory.

[0137] Specifically, Figure 4 As shown, the multi-wavelength pulse generating device 214 includes a single-light-source multi-wavelength pulse laser 201 and a wavelength selector 202 connected in sequence;

[0138] The Alice control end also includes an optical path circulator 203, a coupler 206, a pre-optical amplifier 207, an unbalanced interferometer 215, and a first optical switch 213 connected in sequence;

[0139] The output end of the wavelength selector 202 is connected to the input end of the optical circulator 203; the Alice control end also includes a first detection device 204 and a second detection device 205; the two input ends of the coupler 206 are respectively connected to the second detection device 205 and the optical circulator 203; the first detection device 204 is connected to the single-light source multi-wavelength pulse laser 201;

[0140] The unbalanced interferometer 215 includes a long arm 211 and a short arm 212; wherein the long arm 211 of the unbalanced interferometer 215 includes a first optical fiber delay line 208, a first phase modulator 209 and a polarization beam splitter 210 connected in sequence; the short arm 212 of the unbalanced interferometer 215 is connected to the output end of the pre-optical amplifier 207 and the other input end of the polarization beam splitter 210; the polarization beam splitter 210 is used to separate the input optical signal according to different polarization directions;

[0141] The optical pulse train output by the single-source multi-wavelength pulse laser 201 first passes through the wavelength selector 202, the optical path circulator 203 and the coupler 206 in sequence, and then is injected into the unbalanced interferometer 215 through the pre-optical amplifier 207;

[0142] The single-light-source multi-wavelength pulse laser 201 emits a plurality of optical signals, the wavelength selector 202 selects different wavelengths for the plurality of optical signals, and the optical path circulator 203 transmits the plurality of optical signals unidirectionally to the coupler 206; the first detection device 204 detects the time when the plurality of optical signals are emitted from the Alice control terminal, and the second detection device 205 detects the time when the plurality of optical signals are returned from the Bob user terminal to the Alice control terminal; the coupler 206 transmits the optical signal, the pre-optical amplifier 207 amplifies the input optical signal to increase the signal strength, and the first optical fiber delay line 208 performs delay compensation on the input optical signal; the first phase modulator 209 realizes the level division of the optical signal by adjusting the phase of the optical signal; the optical signal output by the first phase modulator 209 and the optical signal output by the short arm 212 are combined in the polarization beam splitter 210, and the combined optical signal is sent to the information processing block 101 via the first optical switch 213; the first optical switch 213 is also used to lock the communication line between the Alice control terminal and the information processing block 101.

[0143] like Figure 7 As shown, the Bob client includes a beam combiner 401, a second optical switch 402 and a filter 404 connected in sequence; the Bob client also includes a second photodetector 406 connected to the beam combiner 401; the beam combiner 401 and the second optical switch 402 are connected via a fourth optical fiber 403, and the second optical switch 402 and the filter 404 are also connected via a fifth optical fiber 405; the fourth optical fiber 403 and the fifth optical fiber 405 are both single-mode optical fibers SMF;

[0144] The first optical switch 213 is connected to the information processing module 101 through the first optical fiber 102, and the information processing module 101 is connected to the beam combiner 401 through a plurality of second optical fibers 103;

[0145] The combiner 401 receives the optical signal sent by the information processing module 101, and the second photodetector 406 is used to detect the phase information of the optical signal to obtain the key, and then compare and verify the obtained key with the pass key; when the verification fails, the second optical switch 402 locks the communication line between the Bob client and the information processing module 101; when the verification is successful, the target information and the lower-level key are decrypted, and the filter 404 then filters the remaining optical signals except the optical signal carrying the target information.

[0146] Specifically, the optical switches are all semiconductor laser optical switches or built-in amplifying optical switches;

[0147] Each of the detection devices adopts a multi-wavelength single-photon detection device.

[0148] Specifically, the unbalanced interferometer 215 adopts an unequal-arm Michelson interferometer with an automatic polarization compensation function;

[0149] The long arm 211 and the short arm 212 of the unbalanced interferometer 215 are both made of polarization-maintaining optical fiber.

[0150] Specifically, the beam combiner 401 is a high-power pump signal beam combiner or a signal light beam combiner.

[0151] Specifically, the filter 404 is a bandpass filter, a Chebyshev filter or a Butterworth filter.

[0152] Specifically, after the optical pulse string reaches the wavelength selector 202, the wavelength selector 202 selects the wavelength using a secondary equidistant frequency interval method; the first photodetector 311 is also used to detect whether there are other external optical signals in the line from Alice's control end to Bob's user end except for the optical signal screened by the wavelength selector 202. If other external optical signals are detected, it is determined that eavesdropping occurs.

[0153] Specifically, the number of the second optical fibers 103 is the same as the number of levels into which the optical signal is divided; the first optical fibers 102 are shared optical fibers, and the second optical fibers 103 are dedicated optical fibers.

[0154] like Figure 2 and Figure 8 As shown, this embodiment also provides a multi-level key QKD transmission method based on wavelength division multiplexing, which is applied to the above-mentioned multi-level key QKD transmission system based on wavelength division multiplexing, including the following steps:

[0155] Step S1: information classification, optical signal classification, optical signal encryption, key screening and coding, the steps are as follows:

[0156] Step S1a: Information classification; Alice control terminal sends an optical pulse train to the information processing module 101, wherein the optical pulse train includes a plurality of optical signals of different wavelengths carrying different information; the information processing module 101 receives and detects the plurality of optical signals carrying different information; wherein the different information is sorted from low to high according to the importance: first information, second information, ..., n-1th information and nth information;

[0157] Step S1b: optical signal classification; the Alice control terminal classifies the optical signals into multiple levels according to the importance of the information, and then numbers the classified optical signals from low level to high level in sequence: the first optical signal, the second optical signal, ..., the n-1th optical signal and the nth optical signal, and forms a sequence set A1, which is recorded as A1 = {1, 2, ..., n-1, n};

[0158] Step S1c: Encrypt the optical signal; the information processing section 101 encrypts the optical signals in the sequence set A1 in the following order: encrypt the first optical signal to obtain the key Keys_1, encrypt the second optical signal and the key Keys_1 together to obtain the key Keys_2,..., encrypt the (n - 1)th optical signal and the key Keys_n-2 together to obtain the key Keys_n-1, encrypt the nth optical signal and the key Keys_n-1 together to obtain the key Keys_n; sort the obtained multiple keys in ascending order of level as: Keys_1 < Keys_2 <... < Keys_n-2 < Keys_n-1 < Keys_n, and form a sequence set A2, denoted as A2 = {Keys_1, Keys_2,..., Keys_n-2, Keys_n-1, Keys_n}, where Keys_n is the highest-level key;

[0159] Step S1d: Key screening and code generation; randomly screen the keys in the sequence set A2; then randomly select some data from the screened keys to determine whether there is eavesdropping. After determining that there is no eavesdropping,剔除 the selected data, and then perform data reconciliation and privacy amplification on the remaining data to obtain a secure key;

[0160] Step S1e: Generate the administrator key Keys_Ad; the information processing section 101 generates an administrator key Keys_Ad and assigns it to the administrator account; the administrator key Keys_Ad, by default, uses the SM2 algorithm and is used to unlock the communication line between the Bob client and the information processing section 101; the level of the administrator key Keys_Ad is higher than the level of the key Keys_n;

[0161] Step S2: Keys between different levels: According to the key levels set in Step S1, the key levels are: Keys_Ad > Keys_n > Keys_n-1 >... > Keys_l; the Bob client can only obtain one of the keys and decrypts it to obtain the target information and the lower-level key; among them, the Bob client directly obtains the low-level information from the information processing section 101 or obtains all the information content of the information processing section 101 through the key Keys_n;

[0162] Step S3: If there is eavesdropping on the Alice control end, lock the communication line between the Alice control end and the information processing section 101; if the key verification of the Bob client fails, lock the communication line between the Bob client and the information processing section 101;

[0163] Step S4: Remaining information processing: After Bob obtains the target information at the user end, the key management module 348 sends a key management instruction. After receiving the key management instruction, the filter 404 starts to filter the remaining optical signals except the optical signals carrying the target information, and destroys or updates the keys and decryption information of the key management module 348 and the information storage module 349.

[0164] In this embodiment, before performing step S1, system state initialization, system noise test and system noise test are performed first:

[0165] System status initialization: Check the hardware and software facilities of Alice's control terminal, information processing module 101 and Bob's user terminal to see if the equipment can operate normally and set the initial conditions;

[0166] System noise test: Under the premise that the Alice control end does not transmit an optical pulse train, that is, when the number of optical pulse trains is zero, test the system noise level; specifically, determine whether the measured noise hinders the normal operation of the system. If so, it is necessary to reduce the channel crosstalk so that the QBER value is lower than a predetermined threshold, and modify the attenuation of each variable optical attenuator and / or the gain of each optical amplifier so that the classical channel power in the optical fiber is low enough to enable the system to operate normally;

[0167] Fiber length test and pulse delay setting: According to the time domain method, Alice generates a group of strong pulse signals, sends them out through the first optical fiber delay line 208, measures the length of the first optical fiber delay line 208, and then sets the information processing block 101 delay according to the length relationship of the optical fiber between the information processing block 101 and Alice's control end; after setting the delay, Alice's control end transmits another group of strong pulses, which are attenuated by the information processing block 101 and then return to Alice's control end, and measures the arrival time. The round-trip time continuously adjusts the information processing block 101 delay setting, so that the pulses arriving at each transmission link of the information processing block 101 and then returning arrive at Alice's control end almost at the same time;

[0168] Specifically, the length measurement process of the first optical fiber delay line 208 is as follows: a first detection device 204 is set at the starting point of the first optical fiber delay line 208, and a second detection device 205 is set at the end point of the first optical fiber delay line 208 to receive a strong pulse signal; after each of the detection devices receives the strong pulse signal, the time difference between the start point and the end point receiving the signal is measured to obtain the length of the first optical fiber delay line 208.

[0169] Specifically, in step S1c, Alice's control end sends an optical pulse string to Bob's user end in frames, with a certain number of frames sent each time; after receiving the optical pulse string, Bob's user end modulates and attenuates it to the single-photon level through the information processing module 101 and then returns it. The pulses returned from the information processing module 101 through different optical fibers simultaneously arrive at Alice's control end and are loaded with the same phase information; the voltage required for modulating the pulse corresponds to the true random code generated before the pulse is sent, and as the selection of their respective bases, Alice's control end and Bob's user end select different voltage modulation pulse phases according to their respective coding needs; Alice's control end records the detection response events of each of the detection devices, and publicly compares the base with Bob's user end, and the information processing module 101 then encrypts the information of the graded optical signal blocks to form a key.

[0170] Specifically, the security key obtained in step S1d is stored bit by bit, and each group of security keys includes a unique key ID, wherein the character length of the key ID is two bytes; the key ID is a unique identifier of each level of keys in the key storage module, and the key sending time is used as the key ID before the key.

[0171] Specifically, in step S3, Alice's control end is provided with a first optical switch 213. When the first photodetector 311 detects that there are other external optical signals in the line except those screened by the wavelength selector 202, that is, when eavesdropping occurs, the first optical switch 213 automatically operates to lock the communication line, and the optical storage 346 suspends operation, stops writing or reading, and the data that has been running is temporarily stored in the optical storage 346, and the communication is abandoned, waiting for the administrator account to unlock the communication line with the administrator key Keys_Ad; Bob's user end is provided with a second optical switch 402, and the second optical switch 402 operates after the key verification fails, locks the communication line, and waits for the administrator account to unlock it with the administrator key Keys_Ad.

[0172] Specifically, in step S4, the key management instruction includes a key destruction instruction and a key update instruction; when the key management module 348 sends a key destruction instruction, the filter 404 retains the optical signal carrying the target information, filters the optical signals of the remaining channels, and destroys the key and decryption information of the key management module 348 and the information storage module 349;

[0173] When the key management module 348 sends a key update instruction, the filter 404 updates the key and decryption information of the key management module 348 and the information storage module 349;

[0174] Specifically, the key management module 348 will send a key update instruction only after the Alice control terminal updates the information carried by the optical signal.

[0175] According to the disclosure and teaching of the above description, those skilled in the art to which the present invention belongs may also make changes and modifications to the above embodiments. Therefore, the present invention is not limited to the specific embodiments disclosed and described above, and some modifications and changes to the present invention should also fall within the scope of protection of the claims of the present invention. In addition, although some specific terms are used in this specification, these terms are only for the convenience of description and do not constitute any limitation to the present invention.

Claims

1. A multi-level key QKD transmission system based on wavelength division multiplexing, comprising an Alice control terminal, a pulse transmission line and a Bob user terminal; characterized in that: It further includes an information processing section; The pulse transmission line includes a first optical fiber and multiple second optical fibers; the Alice control end is connected to the information processing section through the first optical fiber, and the information processing section is connected to the Bob user end through multiple second optical fibers; The Alice control end includes a multi-wavelength pulse generation device; the multi-wavelength pulse generation device is used to generate an optical pulse train and send it to the information processing section, and the optical pulse train includes n optical signals with different wavelengths carrying different information; the information processing section is used to receive and detect multiple optical signals carrying different information; the different information is sorted from low to high according to the importance level as: the first information, the second information,..., the (n - 1)th information, and the nth information; where n is a positive integer; The Alice control end classifies the optical signals into multiple levels according to the importance level of the information, and then numbers the classified optical signals from low level to high level in sequence as: the first optical signal, the second optical signal,..., the (n - 1)th optical signal, and the nth optical signal, and forms a sequence set A1, denoted as A1 = {1, 2,..., n - 1, n}; The information processing section encrypts the optical signals in the sequence set A1 in the following order: encrypt the first optical signal alone to obtain the key Keys_1, pack the second optical signal and the key Keys_1 together for encryption to obtain the key Keys_2,..., pack the nth optical signal and the key Keys_n - 1 together for encryption to obtain the key Keys_n; sort the obtained multiple keys in ascending order of level as: Keys_1 < Keys_2 <... < Keys_n - 1 < Keys_n, and form a sequence set A2, denoted as A2 = {Keys_1, Keys_2,..., Keys_n - 1, Keys_n}, and Keys_n is the highest-level key; At the same time, the information processing section generates an administrator key Keys_Ad and assigns it to the administrator account, where the level of the administrator key Keys_Ad is higher than the level of the key Keys_n; Among the n information carried by the n optical signals sent by the Alice control end, there is the target information required by the Bob user end; it is set that the mth information is the target information, the mth information corresponds to the mth optical signal, and the key Keys_m corresponding to the mth optical signal is the access key, where the mth information is any one of the n information, m is a positive integer, and 1 ≤ m ≤ n; The information processing section sends some of the keys in the sequence set A2 to the Bob user end through the second optical fiber, and the other part of the keys in the sequence set A2 is stored in the information processing section; The Bob client verifies the received first part of the key with the pass key Keys_m one by one, and if the verification fails, the communication line between the Bob client and the information processing block is locked; after the verification fails, the Bob client requests the administrator key Keys_Ad from the information processing block through a public channel; after the information processing block receives the request from the Bob client, the administrator account unlocks the communication line locked after the verification fails with the administrator key Keys_Ad; after the communication line is unlocked, the Bob client continues to receive all the remaining keys except the first part of the key, and verifies them one by one until the verification succeeds; After successful verification, Bob's client terminal decrypts the key used for successful verification and obtains an optical signal of a level corresponding to the key used for successful verification and a key one level lower than the key used for successful verification; Bob's client terminal obtains target information from the optical signal of a level corresponding to the key used for successful verification, and Bob's client terminal then filters the remaining optical signals except the optical signal carrying the target information and stops verification.

2. A multi-level key QKD transmission system based on wavelength division multiplexing according to claim 1, characterized in that: The information processing module includes a key management module and an information storage module; The keys in the number set A2 and the administrator key Keys_Ad are sent to the key management module for storage; the key management module then sends part of the keys in the number set A2 to Bob's client through the second optical fiber, and the other part of the keys in the number set A2 is directly decrypted by the key management module; The information processing section defines information with an importance level lower than or equal to level k as low-level information, and information with an importance level higher than level k as high-level information; where k is a positive integer, and 1≤k <n; The key management module first decrypts the key corresponding to the low-level information in the sequence set A2 to obtain the low-level information, and sends the low-level information to the information storage module for storage. The Bob client directly obtains the low-level information from the information storage module. The key management module then sends the key corresponding to the high-level information in the sequence set A2 to Bob's client through different second optical fibers; Bob's client verifies the keys obtained from the key management module one by one; after successful verification, Bob's client decrypts the key used for successful verification, and obtains an optical signal of the level corresponding to the key used for successful verification and a key one level lower than the key used for successful verification; Bob's client obtains target information from the optical signal of the level corresponding to the key used for successful verification; Bob's client then decrypts the key one level lower than the key used for successful verification step by step, and indirectly obtains low-level information.

3. A wavelength division multiplexing based multi-level key QKD transmission system according to claim 2, characterized in that: The information processing block includes an optical storage, a first beam splitter and a wavelength division multiplexer connected in sequence; The wavelength division multiplexer is connected to Bob's client via a transmission link; the transmission links include a first link, a second link, ... and an nth link, and each of the links is provided with a second beam splitter; In each of the links, the input end of the second beam splitter is connected to the wavelength division multiplexer through a third optical fiber; the two output ends of the second beam splitter are respectively connected to the first branch and the second branch; The first branch includes a first variable optical attenuator, a pulse delayer, a second optical fiber delay line, a second phase modulator, an erbium-doped fiber amplifier and a gain equalizer connected in sequence; The second branch includes a second variable optical attenuator, a first photodetector and a channel measuring instrument connected in sequence; the output end of the channel measuring instrument and the output end of the second phase modulator are both connected to the input end of the erbium-doped fiber amplifier; The second beam splitter is connected to the same node as the first branch and the second branch; the first branch is used to modulate the wavelength of the optical signal to load phase information, and the second branch is used to provide reference information for the first branch and monitor the aggregate channel or single channel power inside the node; The first photoelectric detector is used to monitor the signal-to-noise ratio of the optical signal in the entire node; the channel measuring instrument is used to monitor the power of the aggregated channel or single channel in the node; The Alice control terminal is connected to the optical storage via a first optical fiber, and the gain equalizer is connected to the Bob user terminal via a plurality of second optical fibers.

4. A wavelength division multiplexing based multi-level key QKD transmission system according to claim 3, characterized in that: The key management module includes the optical memory, the first beam splitter, the wavelength division multiplexer, the third optical fiber, the second beam splitter, the first variable optical attenuator, the pulse delayer, the second optical fiber delay line, the second phase modulator, the erbium-doped fiber amplifier and the gain equalizer connected in sequence; The optical memory, the first beam splitter, the wavelength division multiplexer, the third optical fiber, the second beam splitter, the second variable optical attenuator, the first photodetector, the channel measuring instrument, the erbium-doped fiber amplifier and the gain equalizer are sequentially connected to form the information storage module; When the information processing block receives the optical pulse train, the optical memory stores the optical signal sent by the Alice control terminal, the first beam splitter divides the input optical signal into n paths, and the wavelength division multiplexer simultaneously transmits n optical signals of different wavelengths on one optical fiber and sends them to each of the links respectively; In each of the links, the third optical fiber transmits the optical signal to the second beam splitter, and the second beam splitter splits the optical signal into two optical signals, one of which is transmitted to the first branch, and the other is transmitted to the second branch; in the first branch, the first variable optical attenuator adjusts the intensity of the optical signal, and the second phase modulator adjusts the phase of the optical signal; the pulse delayer and the second optical fiber delay line are used to delay the optical signal returned from Bob's user end until it arrives at the node together with the optical signal returned from the second branch; In the second branch, the second variable optical attenuator is used to adjust the intensity of the optical signal, the first photodetector detects the optical signal, and the channel meter is used to test the intensity of the optical signal; The erbium-doped fiber amplifier is used to increase the intensity of the input optical signal; the gain equalizer is used to adjust the waveform balance of the input optical signal.

5. A multi-level key QKD transmission system based on wavelength division multiplexing according to claim 3, characterized in that: The wavelength division multiplexer adopts a reconfigurable optical differential multiplexer, an optical power adjustable wavelength division multiplexer or a WSS wavelength selection switch; The optical memory adopts a non-saturated bipolar semiconductor memory, a semi-random access memory or a readable and writable magneto-optical disk memory; The multi-wavelength pulse generating device comprises a single light source multi-wavelength pulse laser and a wavelength selector connected in sequence; The Alice control end also includes an optical path circulator, a coupler, a pre-optical amplifier, an unbalanced interferometer, and a first optical switch connected in sequence; The output end of the wavelength selector is connected to the input end of the optical circulator; the Alice control end also includes a first detection device and a second detection device; the two input ends of the coupler are respectively connected to the second detection device and the optical circulator; the first detection device is connected to a single-light-source multi-wavelength pulse laser; The unbalanced interferometer comprises a long arm and a short arm; wherein the long arm of the unbalanced interferometer comprises a first optical fiber delay line, a first phase modulator and a polarization beam splitter connected in sequence; the short arm of the unbalanced interferometer is connected to the output end of the pre-optical amplifier and the other input end of the polarization beam splitter; the polarization beam splitter is used to separate the input optical signal according to different polarization directions; The optical pulse train output by the single-source multi-wavelength pulse laser first passes through the wavelength selector, optical circulator and coupler in sequence, and then is injected into the unbalanced interferometer through the pre-optical amplifier; The single-light-source multi-wavelength pulse laser emits multiple optical signals, the wavelength selector selects different wavelengths for the multiple optical signals, and the optical path circulator transmits the multiple optical signals unidirectionally to the coupler; the first detection device detects the time when the multiple optical signals are sent from the Alice control end, and the second detection device detects the time when the multiple optical signals return from the Bob user end to the Alice control end; the coupler transmits the optical signal, the pre-optical amplifier amplifies the input optical signal to increase the signal strength, and the first optical fiber delay line then compensates the input optical signal for delay; the first phase modulator realizes the level division of the optical signal by adjusting the phase of the optical signal; the optical signal output by the first phase modulator and the optical signal output by the short arm are combined in the polarization beam splitter, and the combined optical signal is sent to the information processing block via the first optical switch; the first optical switch is also used to lock the communication line between the Alice control end and the information processing block.

6. A wavelength division multiplexing based multi-level key QKD transmission system according to claim 5, characterized in that: The Bob user end includes a beam combiner, a second optical switch and a filter connected in sequence; the Bob user end also includes a second photodetector connected to the beam combiner; The first optical switch is connected to the information processing board via a first optical fiber, and the information processing board is connected to the beam combiner via a plurality of second optical fibers; The beam combiner receives the optical signal sent by the information processing module, and the second photodetector is used to detect the phase information of the optical signal to obtain the key, and then compares and verifies the obtained key with the pass key; when the verification fails, the second optical switch locks the communication line between the Bob client and the information processing module; when the verification succeeds, the target information and the lower-level key are decrypted, and the filter then filters the remaining optical signals except the optical signal carrying the target information; Each of the optical switches uses a semiconductor laser optical switch or a built-in amplification optical switch; Each of the detection devices uses a multi-wavelength single-photon detection device; The unbalanced interferometer uses an unequal-arm Michelson interferometer with a polarization automatic compensation function; Both the long arm and the short arm of the unbalanced interferometer use polarization-maintaining optical fibers; The beam combiner uses a high-power pump signal beam combiner or a signal beam combiner; The filter uses a band-pass filter, a Chebyshev filter, or a Butterworth filter.

7. A wavelength division multiplexing based multi-level key QKD transmission system according to claim 5, characterized in that: After the optical pulse train reaches the wavelength selector, the wavelength selector selects wavelengths in a way of second-order arithmetic frequency intervals.

8. A wavelength division multiplexing based multi-level key QKD transmission system according to claim 1, characterized in that: The number of the second optical fibers is the same as the number of levels into which the optical signals are divided; the first optical fiber is a shared optical fiber, and the second optical fibers are dedicated optical fibers; The key algorithms used by the information processing section to encrypt the optical signals in the sequence set A1 include, but are not limited to, SM2 algorithm, SM3 algorithm, SM4 algorithm, RSA algorithm, ECC algorithm, and ECDSA algorithm.

9. A multi-level key QKD transmission method based on wavelength division multiplexing, characterized in that: Applied to a multi-level key QKD transmission system based on wavelength division multiplexing as described in any one of claims 1 to 8, it includes the following steps: Step S1: Information grading, optical signal grading, encrypting the optical signals, key screening and code generation, the steps are as follows: Step S1a: Information grading; The Alice control terminal sends an optical pulse train to the information processing section, and the optical pulse train includes optical signals carrying different information at multiple different wavelengths; the information processing section receives and detects multiple optical signals carrying different information; among them, different information is sorted from low to high according to the importance level as: first information, second information,..., (n - 1)th information, and nth information; Step S1b: Optical signal grading; The Alice control terminal divides the optical signals into multiple levels according to the importance level of the information, and then numbers the divided-level optical signals from low to high in sequence as: first optical signal, second optical signal,..., (n - 1)th optical signal, and nth optical signal, and forms a sequence set A1, denoted as A1 = {1, 2,..., n - 1, n}; Step S1c: Encrypting the optical signals; The information processing section encrypts the optical signals in the sequence set A1 in the following order: encrypt the first optical signal to obtain the key Keys_1, encrypt the second optical signal and the key Keys_1 together to obtain the key Keys_2,..., encrypt the (n - 1)th optical signal and the key Keys_n-2 together to obtain the key Keys_n-1, encrypt the nth optical signal and the key Keys_n-1 together to obtain the key Keys_n; sort the obtained multiple keys from low to high in sequence as: Keys_1 < Keys_2 <... < Keys_n-2 < Keys_n-1 < Keys_n, and form a sequence set A2, denoted as A2 = {Keys_1, Keys_2,..., Keys_n-2, Keys_n-1, Keys_n}, and Keys_n is the highest-level key; Step S1d: Key screening and coding; randomly screening the keys in the sequence set A2; then randomly selecting some data from the screened keys to determine whether there is eavesdropping. After determining that there is no eavesdropping, the selected data is eliminated, and then the remaining data is coordinated and encrypted to obtain a security key; Step S1e: Administrator key Keys_Ad is generated; the information processing module generates an administrator key Keys_Ad and assigns it to the administrator account; the administrator key Keys_Ad is used to unlock the communication line between Bob's client and the information processing module; the level of the administrator key Keys_Ad is greater than the level of the key Keys_n; Step S2: Keys of different levels: According to the key level set in step S1, the key level is: Keys_Ad>Keys_n>Keys_n-1>...>Keys_l; the Bob client can only obtain one of the keys, and obtain the target information and the key of the lower level after decryption; wherein, the Bob client directly obtains the low-level information from the information processing block, or obtains the entire information content of the information processing block through the key Keys_n; Step S3: If Alice's control terminal is eavesdropped, the communication line between Alice's control terminal and the information processing block is locked; if Bob's user terminal key verification fails, the communication line between Bob's user terminal and the information processing block is locked; Step S4: Remaining information processing: After Bob obtains the target information at the user end, the key management module sends a key management instruction. After receiving the key management instruction, the filter starts to filter the remaining optical signals except the optical signals carrying the target information, and destroys or updates the keys and decryption information of the key management module and the information storage module.

10. A wavelength division multiplexing based multi-level key QKD transmission method according to claim 9, characterized in that: The security key obtained in step S1d is stored bit by bit, and each group of security keys includes a unique key ID before it, wherein the character length of the key ID is two bytes; the key ID is the unique identifier of each level of keys in the key storage module, and the key sending time is used as the key ID before the key; In step S3, Alice's control end is provided with a first optical switch. When the first photodetector detects that there are other external optical signals in the line except those screened by the wavelength selector, that is, when eavesdropping occurs, the first optical switch automatically operates to lock the communication line, the optical storage device suspends operation, stops writing or reading, and the already running data is temporarily stored in the optical storage device, and the communication is abandoned, waiting for the administrator account to unlock the communication line with the administrator key Keys_Ad; Bob's user end is provided with a second optical switch, and the second optical switch operates after the key verification fails, locks the communication line, and waits for the administrator account to unlock it with the administrator key Keys_Ad.

Images