Quantum network certificate update method, device, equipment and medium

Abstract

This invention provides a certificate update method, apparatus, device, and medium for quantum networks, applicable to quantum communication networks and quantum security. The certificate update method for quantum networks includes: detecting the communication status of the communication link between a quantum terminal device and a first authentication center for managing the quantum terminal device; if the communication status indicates that the communication link between the quantum terminal device and the first authentication center is unstable, identifying a second authentication center whose communication link with the quantum terminal device is stable and whose distance meets a preset condition; the quantum terminal device sending a certificate update request authenticated by a first quantum key to the second authentication center; upon receiving the certificate update request, the second authentication center determining the certificate to be transmitted based on the certificate update request; and upon receiving the certificate to be transmitted from the second authentication center, updating the certificate on the quantum terminal device based on the certificate to be transmitted.

Description

Technical Field

[0001] The present invention relates to the fields of quantum communication networks and quantum security, and in particular to a method, device, equipment and medium for updating certificates in a quantum network. Background Art

[0002] During the communication process, signature authentication technology can ensure the authenticity and non-tamperability of data, which usually requires the use of public and private keys and digital certificates. Therefore, ensuring the security of the digital certificate or root certificate of the terminal device is the key to ensuring the success of signature authentication between the two communicating parties and the security of the communication process.

[0003] In the related art, the certificate update process is authenticated and protected by the public and private keys provided by the digital certificate already existing on the terminal device, thereby providing security for the digital certificate or root certificate. However, for terminal devices such as communication satellites, they have high requirements for communication security. The number of times digital certificates are used for communication and the number of times root certificates are updated is relatively frequent. In addition, the communication link during the certificate update process is not a real-time link. As a result, the security requirements of terminal devices such as communication satellites for the certificate update process are higher than those of traditional terminal devices. Therefore, there is an urgent need for a method for updating digital certificates and root certificates on terminal devices to meet their security requirements during the certificate update process. Summary of the invention

[0004] In view of the above problems, the present invention provides a certificate update method, device, equipment and medium for a quantum network that improves the security of the certificate update process.

[0005] According to a first aspect of the present invention, a method for updating a certificate of a quantum network is provided, comprising: detecting a communication status of a communication link between a quantum terminal device and a first authentication center for managing the quantum terminal device, wherein the quantum terminal device stores at least one certificate issued by the first authentication center, and the certificate includes a digital certificate and a root certificate; in the case where the communication status indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, determining a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance satisfies a preset condition, wherein a connection link for temporary certificate sharing is provided between the second authentication center and the first authentication center; and transmitting the certificate to the quantum terminal device to the first authentication center. The second authentication center sends a certificate update request authenticated by the first quantum key, wherein the quantum network includes the quantum terminal device, the first authentication center and the second authentication center; when the second authentication center receives the certificate update request, the certificate to be transmitted is determined based on the certificate update request, wherein the certificate to be transmitted is a transmission certificate authenticated by the second quantum key, the first quantum key and the second quantum key belong to different quantum key pairs, and the quantum key pairs used in each certificate update process are all one-time quantum key pairs; when the quantum terminal device receives the certificate to be transmitted sent by the second authentication center, the certificate of the quantum terminal device is updated based on the certificate to be transmitted.

[0006] According to an embodiment of the present invention, the above-mentioned determination of the certificate to be transmitted based on the above-mentioned certificate update request includes: verifying the above-mentioned certificate update request based on a third quantum key to obtain a request verification result, wherein the above-mentioned third quantum key and the above-mentioned first quantum key constitute the same quantum key pair; when the request verification result indicates that the verification is passed, based on the above-mentioned certificate update request, in the management database of the above-mentioned second authentication center, or the management database of the first authentication center, determining the first identity information corresponding to the above-mentioned quantum terminal device; authenticating the above-mentioned quantum terminal device based on the above-mentioned first identity information to obtain an authentication result; when the above-mentioned authentication result indicates that the verification is passed, determining the transmission certificate to be sent to the above-mentioned quantum terminal device based on the above-mentioned certificate update request; authenticating the above-mentioned transmission certificate based on the above-mentioned second quantum key to obtain the above-mentioned certificate to be transmitted.

[0007] According to an embodiment of the present invention, the above-mentioned determination of the transmission certificate to be sent to the above-mentioned quantum terminal device based on the above-mentioned certificate update request includes: parsing the above-mentioned certificate update request to determine the request type of the above-mentioned certificate update request; in the case where the above-mentioned request type is a digital certificate update request, determining the first terminal public key generated by the above-mentioned quantum terminal device from the above-mentioned certificate update request; and in the case where the above-mentioned second authentication center stores the first root certificate issued by the above-mentioned first authentication center, generating the above-mentioned digital certificate based on the above-mentioned first terminal public key, the first center private key of the above-mentioned second authentication center and the above-mentioned first identity information, wherein the above-mentioned digital certificate is the above-mentioned transmission certificate.

[0008] According to an embodiment of the present invention, the transmission certificate determined to be sent to the quantum terminal device based on the certificate update request also includes: in the case where the request type is for a root certificate update request, generating a second center public key and a second center private key of the second authentication center; and generating a second root certificate based on the second center public key, the second center private key and the second identity information of the second authentication center, wherein the second root certificate is the transmission certificate.

[0009] According to an embodiment of the present invention, the above-mentioned updating of the certificate of the above-mentioned quantum terminal device based on the above-mentioned certificate to be transmitted includes: verifying the above-mentioned certificate to be transmitted based on the fourth quantum key to obtain a transmission verification result, wherein the above-mentioned fourth quantum key and the above-mentioned second quantum key constitute the same quantum key pair; when the above-mentioned transmission verification result indicates that the verification is passed, updating the certificate of the above-mentioned quantum terminal device based on the above-mentioned certificate to be transmitted.

[0010] According to an embodiment of the present invention, the above-mentioned determination of the certificate to be transmitted based on the above-mentioned certificate update request also includes: in a case where the above-mentioned first root certificate issued by the above-mentioned first authentication center is not stored in the above-mentioned second authentication center, sending the above-mentioned certificate update request for re-authentication based on the fifth quantum key to the above-mentioned first authentication center; in a case where the above-mentioned first authentication center receives the above-mentioned new certificate update request sent by the above-mentioned second authentication center, determining the initial certificate to be transmitted based on the above-mentioned new certificate update request; in a case where the above-mentioned second authentication center receives the above-mentioned initial certificate to be transmitted sent by the above-mentioned first authentication center through the above-mentioned connection link, verifying the above-mentioned initial certificate to be transmitted based on the sixth quantum key to obtain an initial verification result; in a case where the above-mentioned initial verification result indicates that the verification is passed, determining the above-mentioned initial certificate to be transmitted as the above-mentioned certificate to be transmitted sent to the above-mentioned quantum terminal device.

[0011] According to an embodiment of the present invention, the method further includes: determining a quantum key pair of each of the first quantum key and the second quantum key in the shared quantum key based on pre-set key position information.

[0012] The second aspect of the present invention provides a certificate updating device for a quantum network, comprising: a detection module, for detecting the communication status of a communication link between a quantum terminal device and a first authentication center for managing the quantum terminal device, wherein the quantum terminal device stores at least one certificate issued by the first authentication center, and the certificate includes a digital certificate and a root certificate; a first determination module, for determining, when the communication status indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance meets a preset condition, wherein the second authentication center has a connection link with the first authentication center for temporary certificate sharing; a request initiation module, for the quantum terminal device to initiate a request for updating the certificate. The terminal device sends a certificate update request authenticated by the first quantum key to the above-mentioned second authentication center, wherein the quantum network includes the above-mentioned quantum terminal device, the above-mentioned first authentication center and the above-mentioned second authentication center; a second determination module is used to determine the certificate to be transmitted based on the above-mentioned certificate update request when the above-mentioned second authentication center receives the above-mentioned certificate update request, wherein the above-mentioned certificate to be transmitted is authenticated by the second quantum key, the above-mentioned first quantum key and the above-mentioned second quantum key belong to different quantum key pairs, and the quantum key pairs used in each certificate update process are all one-time quantum key pairs; a certificate update module is used to update the certificate of the above-mentioned quantum terminal device based on the above-mentioned certificate to be sent when the above-mentioned quantum terminal device receives the above-mentioned certificate to be transmitted transmitted by the above-mentioned second authentication center.

[0013] A third aspect of the present invention provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present invention further provides a computer-readable storage medium on which a computer program or instruction is stored, and the steps of the above method are implemented when the above computer program or instruction is executed by a processor.

[0015] According to an embodiment of the present invention, when it is detected that the communication status of the communication link between the first authentication center and the quantum terminal device is an unstable link, a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance meets preset conditions is determined, so that the quantum terminal device and the second authentication center can safely generate a shared quantum key, and the principles of quantum mechanics are used to ensure the security of the digital certificate and the root certificate during the update process. Specifically, the certificate update request is authenticated by the first quantum key to determine the sender and receiver of the certificate update request, and the digital certificate to be updated is authenticated by the second quantum key to determine the sender and receiver of the certificate to be updated, and combined with the One-Time Pad (OTP) technology, information-theoretically secure key exchange is provided for the update process of the digital certificate and the root certificate, and security is maintained even under the threat of quantum computing. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The above contents and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0017] Figure 1 An application scenario diagram of a certificate updating method, apparatus, device, medium, and program product for a quantum network according to an embodiment of the present invention is shown.

[0018] Figure 2 A flow chart of a method for updating a certificate in a quantum network according to an embodiment of the present invention is shown.

[0019] Figure 3 An application scenario of a certificate updating method for a quantum network according to another embodiment of the present invention is shown.

[0020] Figure 4 A diagram showing the interaction between a quantum terminal device and an authentication center according to an embodiment of the present invention is shown.

[0021] Figure 5 A structural block diagram of a certificate updating device for a quantum network according to an embodiment of the present invention is shown.

[0022] Figure 6 A block diagram of an electronic device suitable for implementing a certificate update method for a quantum network according to an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0023] Below, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present invention. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of embodiments of the present invention. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of concepts of the present invention.

[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present invention. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0026] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0027] In related technologies, digital certificates are required for both the incorporation of new nodes and maintenance, and the update of digital certificates in the current process is authenticated by the public and private keys provided by the previous round of certificates. However, the security of public and private keys and digital certificates will decrease over time. In particular, when the terminal device is a satellite, considering that the satellite is in space and faces resource constraints and security risks, it is particularly important to improve the security of the digital certificate and root certificate update process.

[0028] Specifically, (1) The update cycle of the root certificate (Certificate Authority, CA) issued by the certification center in the classic ground communication network is extremely long. It is generally believed that the update of the root certificate is no different from the initialization of the root certificate of a new node. However, the root certificate and digital certificate on the satellite are more easily damaged, which will lead to more frequent update requirements. (2) Compared with the terminal equipment on the ground being invaded, the risk of satellites being hijacked and counterfeited is greater. The data transmitted by satellite nodes is often more confidential. Therefore, the risk of satellite private key leakage is greater. (3) In related technologies, terminal devices are usually repaired by manual injection. For example, after the private key of the terminal device is leaked, the digital certificate and private key are manually injected for repair. However, this method is difficult to implement on a satellite after it is launched, and the cost of implementation is huge.

[0029] Therefore, there is an urgent need for a method that can be used to improve the security of the digital certificate or root certificate update process of the terminal node.

[0030] The embodiments of the present invention propose a method for improving the security of a digital certificate update process using a QKD (Quantum Key Distribution) key in a QKD network. In this case, the security of the digital certificate does not decrease as the number of updates increases.

[0031] Specifically, a certificate updating method for a quantum network is provided, comprising: detecting the communication status of a communication link between a quantum terminal device and a first authentication center for managing the quantum terminal device, wherein the quantum terminal device stores at least one certificate issued by the first authentication center, and the certificate includes a digital certificate and a root certificate; in a case where the communication status indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, determining a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance meets a preset condition, wherein a connection link for temporary certificate sharing is provided between the second authentication center and the first authentication center; sending a certificate update request authenticated by a first quantum key to the second authentication center by the quantum terminal device, wherein the quantum network includes the quantum terminal device, the first authentication center and the second authentication center; in a case where the second authentication center receives the certificate update request, determining a certificate to be transmitted based on the certificate update request, wherein the certificate to be transmitted indicates a transmission certificate authenticated by a second quantum key, the first quantum key and the second quantum key belong to different quantum key pairs, and the quantum key pairs used in each certificate updating process are one-time quantum key pairs; in a case where the quantum terminal device receives the certificate to be transmitted sent by the second authentication center, updating the certificate of the quantum terminal device based on the certificate to be transmitted.

[0032] Figure 1An application scenario diagram of a certificate updating method, apparatus, device, medium, and program product for a quantum network according to an embodiment of the present invention is shown.

[0033] like Figure 1 As shown, according to this embodiment, the quantum network may include quantum terminal device U1, quantum terminal device U2, quantum terminal device U3, quantum terminal device U4, quantum terminal device U5, authentication center CA1, authentication center CA2 and authentication center CA3. Each authentication center has its own coverage. It can be assumed that quantum terminal device U1, quantum terminal device U2 and quantum terminal device U4 are managed by authentication center CA1; quantum terminal device U3 is managed by authentication center CA2; quantum terminal device U5 is managed by authentication center CA3. Authentication center CA1, authentication center CA2 and authentication center CA3 store the first identity information of the quantum terminal devices they manage respectively.

[0034] There are two types of direct communication links between quantum terminal device U1, quantum terminal device U2, quantum terminal device U3, quantum terminal device U4, quantum terminal device U5 and authentication center CA1, authentication center CA2 and authentication center CA3; as well as authentication center CA1, authentication center CA2 and authentication center CA3, including: stable link and unstable link. Among them, stable link, also known as real-time link, means that communication can be carried out at any time, such as large servers and personal computers in the city; unstable link means that the communication link is only available or unavailable at part of the time, such as satellite, etc. The instability of the link will make the original digital certificate update and root certificate update unable to be completed.

[0035] In the case where the quantum terminal device U4 is a satellite, although the quantum terminal device U4 is managed by the authentication center CA1, at some times, the quantum terminal device U4 will exceed the scope of CA1, for example, it is performing an ocean mission or the satellite cannot pass over CA1 in the near future. At this time, the communication link between the quantum terminal device U4 and the authentication center CA1 is an unstable link, and the connection time between the quantum terminal device U4 and the authentication center CA1 is limited or cannot be connected, resulting in the inability to complete the update of the digital certificate or root certificate. The quantum terminal device U4 is within the stable communication range of the authentication center CA3, for example, it is performing an ocean mission or a satellite passes over CA3.

[0036] It should be understood that Figure 1 The number of terminal devices and authentication centers in the system is only , and any number of terminal devices and authentication centers can be provided according to the implementation needs. In addition, the communication link between the terminal device and the authentication center is also , and any form of communication link can be provided according to the implementation situation.

[0037] The following will be based on Figure 1The scene described by Figure 2 The certificate updating method of the quantum network of the disclosed embodiment is described in detail.

[0038] Figure 2 A flow chart of a method for updating a certificate in a quantum network according to an embodiment of the present invention is shown.

[0039] like Figure 2 As shown, the certificate updating method of the quantum network of this embodiment includes operations S210 to S250.

[0040] In operation S210, a communication status of a communication link between a quantum terminal device and a first authentication center for managing the quantum terminal device is detected.

[0041] The quantum terminal device stores at least one certificate issued by the first certification center, and the certificate includes a digital certificate and a root certificate.

[0042] In operation S220, when the communication status indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, a second authentication center is determined whose communication link with the quantum terminal device is a stable link and whose distance meets a preset condition.

[0043] Among them, there is a connection link between the second authentication center and the first authentication center for temporary sharing of certificates.

[0044] In operation S230, the quantum terminal device sends a certificate update request authenticated by the first quantum key to the second authentication center.

[0045] Among them, the quantum network includes quantum terminal equipment, a first authentication center and a second authentication center.

[0046] In operation S240, when the second authentication center receives the certificate update request, the certificate to be transmitted is determined based on the certificate update request.

[0047] Among them, the certificate to be transmitted is authenticated by the second quantum key, the first quantum key and the second quantum key belong to different quantum key pairs, and the quantum key pair used in each certificate update process is a one-time quantum key pair.

[0048] In operation S250, when the quantum terminal device receives the certificate to be transmitted sent by the second authentication center, the certificate of the quantum terminal device is updated based on the certificate to be transmitted.

[0049] According to an embodiment of the present invention, the quantum terminal device represents a device in the quantum network that has a certificate update request. The first authentication center is an authentication center that manages the quantum terminal device and can issue a digital certificate or a root certificate for the quantum terminal device. The relationship between the first authentication center and the quantum terminal device can be Figure 1 In FIG. 1 , the relationship between the quantum terminal device U1 and the authentication center CA1 is shown in FIG. 1 . Before the quantum terminal device updates the digital certificate or the root certificate, at least one of the digital certificate or the root certificate issued by the first authentication center is stored.

[0050] According to an embodiment of the present invention, the communication status of the communication link between the quantum terminal device and the first authentication center can be detected by using the quantum terminal device to send a heartbeat signal to the first authentication center to verify the communication status of the communication link. The heartbeat signal can be a quantum bit in a known state, such as a photon in a polarization state or phase state, or a data packet in network communication.

[0051] According to an embodiment of the present invention, when the communication status indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, the communication links of one or more alternative authentication centers can be detected respectively according to the distance between the quantum terminal device and one or more alternative authentication centers, and the authentication center whose communication link with the quantum terminal device is a stable link and whose distance meets the preset conditions is selected as the second authentication center. Figure 1 As shown, the authentication center CA3 can be understood as the second authentication center. The alternative authentication center can establish a connection link for temporary certificate sharing with the first authentication center, or have a connection link for temporary certificate sharing.

[0052] According to an embodiment of the present invention, the first quantum key is one of a pair of shared keys between the quantum terminal device and the second authentication center. The shared key is generated by the quantum terminal device and the second authentication center on the basis of establishing a communication link based on the quantum key distribution protocol. The certificate update request may include the quantum terminal device identifier, the request subject name (Distinguished Name, DN), etc. The authentication process of the certificate update request in the QKD network can be completed using the first quantum key under the QKD protocol to obtain a certificate update request, wherein the QKD protocol may include the E91 protocol, etc. The purpose of the authentication process is to verify the identities of the communicating parties and ensure that the data is sent to the correct recipient.

[0053] According to an embodiment of the present invention, the certificate to be transmitted is authenticated by a second quantum key, and the certificate to be transmitted may include a digital certificate or a root certificate, wherein the authentication may be to encrypt the transmission content using the generated quantum key after the devices generating the quantum key mutually authenticate each other. The second quantum key and the first quantum key belong to different quantum key pairs. The quantum key pairs for authenticating the transmission certificate or the certificate update request are all one-time quantum key pairs, which are not used after the use is completed. When the second authentication center receives the certificate update request, it responds to the certificate update request to determine the certificate to be transmitted that is finally sent to the quantum terminal device.

[0054] According to an embodiment of the present invention, when the quantum terminal device receives the certificate to be transmitted by the second authentication center, the digital certificate or root certificate already stored in the quantum terminal device is updated based on the certificate to be transmitted. Since the certificate to be transmitted cannot be forged and the content of the certificate update request does not need to be kept confidential, the certificate to be transmitted and the certificate update request do not need to be encrypted.

[0055] According to an embodiment of the present invention, when it is detected that the communication status of the communication link between the first authentication center and the quantum terminal device is an unstable link, a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance meets preset conditions is determined, so that the quantum terminal device and the second authentication center can safely generate a shared quantum key, and the principles of quantum mechanics are used to ensure the security of the digital certificate and the root certificate during the update process. Specifically, the certificate update request is authenticated by the first quantum key to determine the sender and receiver of the certificate update request, and the digital certificate to be updated is authenticated by the second quantum key to determine the sender and receiver of the certificate to be updated, and combined with the One-Time Pad (OTP) technology, information-theoretically secure key exchange is provided for the update process of the digital certificate and the root certificate, and security is maintained even under the threat of quantum computing.

[0056] According to an embodiment of the present invention, determining a certificate to be transmitted based on a certificate update request includes: verifying the certificate update request based on a third quantum key to obtain a request verification result, wherein the third quantum key and the first quantum key constitute the same quantum key pair; determining first identity information corresponding to a quantum terminal device in a management database of a second authentication center or in a management database of a first authentication center based on the certificate update request when the request verification result indicates that the verification is passed; authenticating the quantum terminal device based on the first identity information to obtain an authentication result; determining a transmission certificate to be sent to the quantum terminal device based on the certificate update request when the authentication result indicates that the verification is passed; authenticating the transmission certificate based on the second quantum key to obtain a certificate to be transmitted.

[0057] According to an embodiment of the present invention, the third quantum key and the first quantum key belong to the same quantum key pair. The certificate update request is verified based on the third quantum key to obtain a request verification result. The first identity information is key data for verifying the identity of the certificate holder. The first identity information may include a unique identifier of the certificate held by the certificate holder, the validity period of the certificate, the certification center that issued the certificate, the organization name of the certificate holder, etc. The management database of the second certification center stores the first identity information of the quantum terminal device managed by the second certification center.

[0058] According to an embodiment of the present invention, the management database of the first authentication center stores the first identity information of the quantum terminal device managed by the first authentication center. The second authentication center can access the management database of the first authentication center through the connection link between the second authentication center and the first authentication center. Based on the terminal device identifier in the certificate update request or other information used to uniquely identify the quantum terminal device, the first identity information corresponding to the quantum terminal device is searched in the management database.

[0059] According to an embodiment of the present invention, the information representing the identity provided by the quantum terminal device in the certificate request ciphertext is verified based on the first identity information to obtain an identity verification result to ensure the authenticity and accuracy of the quantum terminal device. In the case where the identity verification result represents that the verification is passed, in response to the certificate update request, if the second authentication center has the certificate issuance capability, a digital certificate or root certificate that needs to be sent to the quantum terminal device is generated; if the second authentication center has the certificate issuance capability, the connection link between the second authentication center and the first authentication center for temporary certificate sharing is used to obtain the digital certificate or root certificate that needs to be sent to the quantum terminal device.

[0060] According to an embodiment of the present invention, under a preset QKD protocol, the transmission certificate is authenticated by using the second quantum key, that is, the digital certificate or root certificate that needs to be sent to the quantum terminal device is authenticated to obtain the certificate to be transmitted.

[0061] According to an embodiment of the present invention, when the identity authentication result indicates that the verification fails, the second authentication center may feed back the identity authentication result to the quantum terminal device, and the quantum terminal device may re-initiate a certificate update application.

[0062] According to an embodiment of the present invention, the second authentication center responds to the certificate update request of the quantum terminal device to authenticate the quantum terminal device. After the verification is passed, the transmission certificate that needs to be sent to the quantum terminal device is determined based on the certificate update request. Instead of simply using the second authentication center as an information transmission hub and handing over the task of authenticating the quantum terminal device to the first authentication center, unnecessary information interaction and waste of quantum key pairs are reduced.

[0063] According to an embodiment of the present invention, a transmission certificate to be sent to a quantum terminal device is determined based on a certificate update request, including: parsing the certificate update request to determine the request type of the certificate update request; in the case where the request type is a digital certificate update request, determining the first terminal public key regenerated by the quantum terminal device from the certificate update request; in the case where a first root certificate issued by a first authentication center is stored in a second authentication center, generating a digital certificate based on the first terminal public key, the first center private key of the second authentication center, and the first identity information, wherein the digital certificate is a transmission certificate.

[0064] According to an embodiment of the present invention, the request type of the certificate update request may be a digital certificate or a root certificate. The request header of the certificate update request may be parsed first to obtain the request type of the certificate. If the request type is not found in the content obtained by parsing the request header of the certificate update request, the request body of the certificate update request may be further parsed to obtain the request type of the certificate.

[0065] According to an embodiment of the present invention, when the request type represents a digital certificate for updating a quantum terminal device, the request body of the certificate update request can continue to be parsed to obtain the first terminal public key. The first terminal public key is newly generated by the quantum terminal device, and is not the public key in the digital certificate obtained in the previous round. The first terminal public key can be a public key under a quantum terminal device including post-quantum cryptography (Post Quantum Cryptography, PQC), that is, the first terminal public key can be generated by a PQC algorithm, wherein the quantum terminal device including post-quantum cryptography can be a quantum terminal device that integrates the PQC authentication protocol into a QKD device.

[0066] According to an embodiment of the present invention, when the second authentication center stores the first root certificate issued by the first authentication center and the first root certificate is still valid, the first center private key of the second authentication center is used to sign the first terminal public key and the first identity information to obtain a digital certificate, wherein the first root certificate is still valid, which can be understood as not needing to be updated, that is, not damaged or expired, etc. The first center private key can be generated by the PQC algorithm. Use the digital certificate as a transmission certificate.

[0067] According to an embodiment of the present invention, when the second authentication center stores the first root certificate issued by the first authentication center and the first root certificate is still valid, it directly responds to the certificate update request and generates the requested digital certificate, thereby avoiding communication with the first authentication center again. The first terminal public key and the corresponding private key are pre-generated on the quantum terminal device, and the first terminal public key is sent to the second authentication center, thereby avoiding the private key corresponding to the first terminal public key from being leaked during transmission, further improving the security of the certificate update process.

[0068] According to an embodiment of the present invention, a transmission certificate to be sent to a quantum terminal device is determined based on a certificate update request, and also includes: generating a second center public key and a second center private key of a second authentication center when the request type is a root certificate update request; generating a second root certificate based on the second center public key, the second center private key, and the second identity information of the second authentication center, wherein the second root certificate is a transmission certificate.

[0069] According to an embodiment of the present invention, the second identity information is key data for verifying the identity of the certificate issuer, and the second identity information may include a unique identifier of the second authentication center and the validity period of the certificate. In the case where the request type represents a root certificate for updating a quantum terminal device, the second center public key and the second center private key of the second authentication center may be regenerated based on the PQC algorithm, and the second center public key and the second identity information of the second authentication center may be signed based on the second center private key to generate a second root certificate.

[0070] According to an embodiment of the present invention, based on generating the second center public key and the second center private key, the root certificate is redetermined, and all certificates issued by the second authentication center need to be updated. Therefore, if the communication link between the second authentication center and one or more terminal devices to which it issues certificates is unstable, the first center public key and the first center private key can continue to be used to generate a second root certificate.

[0071] According to an embodiment of the present invention, the certificate of a quantum terminal device is updated based on the certificate to be transmitted, including: verifying the certificate to be transmitted based on a fourth quantum key to obtain a transmission verification result, wherein the fourth quantum key and the second quantum key constitute the same quantum key pair; when the transmission verification result indicates that the verification is passed, updating the certificate on the quantum terminal device based on the certificate to be transmitted.

[0072] According to an embodiment of the present invention, when a quantum terminal device receives a certificate to be transmitted, the certificate to be transmitted is verified based on a shared symmetric key of the second quantum key, i.e., the fourth quantum key, to verify the integrity of the certificate to be transmitted and ensure the identities of both parties in communication. The transmission verification result may include information for characterizing whether the verification is passed. In addition, since the second quantum key is only stored on the second authentication center and the fourth quantum key is only stored on the quantum terminal device, the authentication process can also be used to determine whether the sender of the certificate to be transmitted is the second authentication center.

[0073] According to an embodiment of the present invention, the second authentication center can use a message authentication code (MAC) to process the transmission certificate to generate an additional verification value. The quantum terminal device also uses the message authentication code (MAC) to process the transmission certificate received to generate a verification value. If the two verification values ​​match, the verification is passed.

[0074] According to an embodiment of the present invention, when the transmission verification result characterizes the verification, the digital certificate on the quantum terminal device is updated using the digital certificate in the transmission verification result, or the root certificate on the quantum terminal device is updated using the root certificate in the transmission verification result. When the transmission verification result characterizes the verification and fails, the quantum terminal node re-initiates a certificate update request to the second authentication center.

[0075] According to an embodiment of the present invention, the certificate to be transmitted is verified based on the fourth quantum key, and the certificate on the quantum terminal device is updated when the transmission verification result indicates that the verification is passed, which can ensure the security of communication and the reliability of identity authentication. This helps to maintain the security of the quantum communication system and improve communication efficiency.

[0076] According to an embodiment of the present invention, determining the certificate to be transmitted based on the certificate update request also includes: when the second authentication center does not store the certificate issued by the first authentication center, sending a new certificate update request based on the fifth quantum key re-authentication to the first authentication center; when the first authentication center receives the new certificate update request sent by the second authentication center, determining the initial certificate to be transmitted based on the new certificate update request; when the second authentication center receives the initial certificate to be transmitted sent by the first authentication center through the connection link, verifying the initial certificate to be transmitted based on the sixth quantum key to obtain an initial verification result; when the initial verification result indicates that the verification is passed, determining the initial certificate to be transmitted as the certificate to be transmitted sent to the quantum terminal device.

[0077] According to an embodiment of the present invention, when the first root certificate issued by the first authentication center is not stored in the second authentication center, or the first root certificate is invalid, the second authentication center re-authenticates the received certificate update request, that is, re-authenticates the certificate update request based on the fifth quantum key to confirm the identities of the first authentication center and the second authentication center.

[0078] According to an embodiment of the present invention, when the first authentication center receives a new certificate update request sent by the second authentication center, the new certificate update request can be authenticated based on the shared symmetric key of the fifth quantum key, and the authenticated certificate update request can be sent to the first authentication center. A corresponding transmission certificate is generated based on the certificate update request. An initial certificate to be transmitted is obtained based on the transmission certificate of the new quantum key, wherein the initial certificate to be transmitted represents a transmission certificate authenticated by the quantum key of the first authentication center.

[0079] According to an embodiment of the present invention, when the second authentication center receives the initial certificate to be transmitted sent by the first authentication center through the connection link, the transmission certificate in the initial certificate to be transmitted is verified based on the sixth quantum key to obtain an initial verification result; when the initial verification result indicates that the verification is passed, the initial certificate to be transmitted is determined as the certificate to be transmitted that needs to be sent to the quantum terminal device, wherein the sixth quantum key and the fifth quantum key belong to the same quantum key pair.

[0080] According to an embodiment of the present invention, the certificate to be transmitted that needs to be sent to the quantum terminal device is determined through the connection link between the first authentication center and the second authentication center, thereby reducing the risk of communication between the quantum terminal device and other devices caused by the inability of the second authentication center to issue a certificate for the quantum terminal device.

[0081] According to an embodiment of the present invention, the certificate update method of the quantum network also includes: determining the quantum key pair of each of the first quantum key and the second quantum key in the shared quantum key based on pre-set key location information.

[0082] According to an embodiment of the present invention, the key location information characterizes the starting and ending positions of the key segment in the entire key. In a quantum network, the sender and the receiver can negotiate the location information of the shared key segment through a classical communication network, such as a telephone, email, etc. For example, the starting and ending positions of a key segment in the entire key can be negotiated. Based on the negotiated key location information, both parties use the same starting and ending positions to extract the shared key segment to determine the quantum key pairs of the first quantum key and the second quantum key. This method is suitable for non-continuous QKD sessions, or when the previous QKD key cannot be directly retained.

[0083] According to an embodiment of the present invention, a shared quantum key can be a complete communication in the process of quantum key distribution. In the process of quantum key distribution, a part of the key is retained as a shared key segment in the continuous shared quantum key. This part of the key is used as an initialization key in the subsequent QKD session to synchronize the key generation process of both parties to determine the quantum key pair of the quantum key and the second quantum key. This method can reduce the time required for key synchronization and improve the efficiency of the QKD system.

[0084] According to an embodiment of the present invention, in the process of authenticating data using QKD keys, a longer quantum key can be selected and combined with OTP to ensure the security of the transmitted certificate update request and the transmitted certificate. The length of the longer quantum key can range from hundreds to thousands of bits.

[0085] According to an embodiment of the present invention, the public and private key generation involved in the present invention is performed by the PQC certification device, including but not limited to two methods: the second certification center generates the PQC public and private keys, and passes the private key to the quantum terminal device while completing the certificate issuance, and hands it over to the digital certificate storage management device of the quantum terminal device. The quantum terminal device generates the PQC public and private keys, and sends the public key to the second certification center for subsequent digital certificate issuance.

[0086] According to an embodiment of the present invention, in the case where a public and private key is generated in the first authentication center or the second authentication center, the private key can be encrypted by a shorter quantum key to be sent to the terminal device, and the length of the shorter quantum key can range from tens to hundreds of bits. Data of different orders of magnitude are encrypted separately to reduce the amount of computing resources occupied by the encrypted content that is too long, at least partially solving the problem of reduced data transmission efficiency caused by excessive use of computing resources.

[0087] According to an embodiment of the present invention, situations in which the root certificate is updated include but are not limited to: expiration of the root certificate, damage to the root certificate, update of the security algorithm, change in the trust scope of the authentication center, and unified update and maintenance of the QKD network.

[0088] According to an embodiment of the present invention, situations in which the digital certificate of a terminal node is updated include but are not limited to: expiration of a digital certificate, damage to a digital certificate, revocation of a digital certificate, update of an encryption algorithm, active application initiated by the terminal node, and unified update and maintenance of the QKD network.

[0089] Figure 3 An application scenario of a certificate updating method for a quantum network according to another embodiment of the present invention is shown.

[0090] According to an embodiment of the present invention, in a classical network, the channel authentication of the current update process is performed using the public and private keys of the previous round. For the case where there is a stable real-time link between the quantum terminal device and the authentication center, the network structure between the authentication center and the quantum terminal device can be simplified to Figure 3 The network structure shown.

[0091] like Figure 3 As shown, the quantum network includes only one authentication center CA, and quantum terminal devices U1, U2, U3 and U4 are managed by the authentication center CA.

[0092] According to the embodiment of the present invention, the public and private key security is defined in the related art as S, ranging from 0 to 1, representing the security level of using the public and private keys for authentication, 1 being the maximum, and with the continuous use of the public and private keys, the public and private key security level decreases per unit time on average. , digital certificate update cycle T, after a total of N digital certificate updates, the security of the public and private keys currently used by the system Proportional to .

[0093] According to an embodiment of the present invention, a QKD key is used to authenticate the certificate update channel. Thanks to the information-theoretic secure symmetric key generated by QKD, the digital certificate obtained by the quantum terminal device is always secure. This method can be effectively used in optical fiber QKD networks and free space QKD networks, especially in satellite-based quantum constellation networks.

[0094] According to an embodiment of the present invention, when a quantum terminal node is incorporated into a quantum network as a new node, a digital certificate and a root certificate can be injected into the quantum terminal device by manual injection. In order to improve the communication security between various terminal devices in the quantum network, the public and private keys involved in the present invention can be generated by the PQC algorithm.

[0095] Figure 4 A diagram showing the interaction between a quantum terminal device and an authentication center according to an embodiment of the present invention is shown.

[0096] like Figure 4 As shown, the two parties in the figure are the quantum terminal device U and the authentication center CA. The whole process includes the initialization phase and the digital certificate update phase. The QKD key can be obtained through the quantum channel QKD between the two. When the quantum terminal device U needs to be incorporated into the QKD network as a new node, after the identity of the quantum terminal device U is confirmed by the authentication center CA, the root certificate Certca and the first digital certificate Certu of the quantum terminal device U are injected through the secure injection channel. The injection method is preferably a manual injection method, wherein the manual injection method is that the confidentiality personnel transmit the data securely under the conditions of a confidential environment and secure physical equipment. The root certificate Certca contains the public key information of the authentication center CA, and the digital certificate Certu contains the public key information of the quantum terminal device U.

[0097] In the digital certificate update phase, the quantum terminal device U first initiates an application for digital certificate update to the certification center CA. After confirming the identity of the quantum terminal device U, the certification center CA will generate a public key Pu and a private key Su (through the PQC certification device), and then issue a digital certificate Certu based on the public key Pu, and finally issue the digital certificate Certu and private key Su to the quantum terminal device U. The communication in this phase is protected by the QKD key, in which the application of the quantum terminal device U and the issuance of the digital certificate Certu are authenticated by the QKD key, and the transmission of the private key Su is encrypted by the QKD key.

[0098] During the root certificate update phase, the quantum terminal device U first initiates an application for root certificate update to the certification center CA. After confirming the identity of the quantum terminal device U, the certification center CA re-prepares the root certificate Certca and transmits the root certificate Certca to the quantum terminal device U through the QKD key authentication channel. Specifically, the root certificate Certca is authenticated by the QKD key and the authenticated root certificate Certca is transmitted to the quantum terminal device U.

[0099] In this example, the authentication center CA generates public and private keys, but it is not limited to this. The quantum terminal device U also has the ability to generate public and private keys. When the authentication center CA generates public and private keys, the public key Pu is passed to CA through the QKD key encryption channel for subsequent processes. Specifically, the public key Pu is encrypted based on the QKD key, and the encrypted public key Pu is sent to the quantum terminal device U.

[0100] In this example, the issuance of digital certificate Certu using QKD key authentication is taken as an example, but it is not limited to this. The certification center CA can also perform QKD key authentication on the digital certificate Certu, which will further increase security and the digital certificate Certu will no longer be exposed to the outside of the system.

[0101] Based on the above-mentioned quantum network certificate update method, the present invention also provides a quantum network certificate update device. Figure 5 The device is described in detail.

[0102] Figure 5 A structural block diagram of a certificate updating device for a quantum network according to an embodiment of the present invention is shown.

[0103] like Figure 5 As shown, the certificate updating device 500 of the quantum network of this embodiment includes a detection module 510, a first determination module 520, a request initiation module 530, a second determination module 540 and a certificate updating module 550.

[0104] The detection module 510 is used to detect the communication status of the communication link between the quantum terminal device and the first authentication center used to manage the quantum terminal device, wherein the quantum terminal device stores at least one certificate issued by the first authentication center, and the certificate includes a digital certificate and a root certificate.

[0105] The first determination module 520 is used to determine a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance meets a preset condition when the communication status indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, wherein the second authentication center and the first authentication center have a connection link for temporary sharing of certificates.

[0106] The request initiation module 530 is used for sending a certificate update request authenticated by the first quantum key from the quantum terminal device to the second authentication center, wherein the quantum network includes the quantum terminal device, the first authentication center and the second authentication center.

[0107] The second determination module 540 is used to determine the certificate to be transmitted based on the certificate update request when the second authentication center receives the certificate update request, wherein the certificate to be transmitted represents a transmission certificate authenticated by the second quantum key, the first quantum key and the second quantum key belong to different quantum key pairs, and the quantum key pair used in each certificate update process is a one-time quantum key pair.

[0108] The certificate updating module 550 is used to update the certificate of the quantum terminal device based on the certificate to be transmitted when the quantum terminal device receives the certificate to be transmitted transmitted by the second authentication center.

[0109] According to an embodiment of the present invention, the second determination module 540 includes: an authentication submodule, a first determination submodule, a first verification submodule, a sending submodule, and an authentication submodule.

[0110] The authentication submodule is used to verify the certificate update request based on the third quantum key to obtain a request verification result, wherein the third quantum key and the first quantum key constitute the same quantum key pair.

[0111] The first determination submodule is used to determine the first identity information corresponding to the quantum terminal device in the management database of the second authentication center or the management database of the first authentication center based on the certificate update request when the request verification result indicates that the verification is passed.

[0112] The first verification submodule is used to authenticate the quantum terminal device based on the first identity information to obtain an identity authentication result.

[0113] The sending submodule is used to determine the transmission certificate to be sent to the quantum terminal device based on the certificate update request when the identity authentication result indicates that the authentication is passed.

[0114] The authentication submodule is used to authenticate the transmission certificate based on the second quantum key to obtain the certificate to be transmitted.

[0115] According to an embodiment of the present invention, the sending submodule includes: a type determination unit, a first key generation unit, and a digital certificate generation unit.

[0116] The type determination unit is used to determine the first terminal public key regenerated by the quantum terminal device from the certificate update request when the request type is a digital certificate update request.

[0117] The first key generation unit is used to determine the first terminal public key for generating the digital certificate based on the certificate update request when the request type represents a digital certificate for updating the quantum terminal device, wherein the certificate update request includes the first terminal public key regenerated by the quantum terminal device.

[0118] A digital certificate generation unit is used to generate a digital certificate based on the first terminal public key, the first center private key of the second authentication center and the first identity information when the second authentication center stores the first root certificate issued by the first authentication center, wherein the first identity information digital certificate is a transmission certificate.

[0119] According to an embodiment of the present invention, the sending submodule further includes: a second key generating unit and a root certificate generating unit.

[0120] The second key generation unit is used to generate a second center public key and a second center private key of a second authentication center when the request type is a root certificate update request.

[0121] The root certificate generating unit is used to generate a second root certificate based on the second center public key, the second center private key and the second identity information of the second authentication center, wherein the second root certificate is a transmission certificate.

[0122] According to an embodiment of the present invention, the certificate updating module 550 includes: a second verification submodule and an updating submodule.

[0123] The second verification submodule is used to verify the certificate to be transmitted based on the fourth quantum key to obtain a transmission verification result, wherein the fourth quantum key and the second quantum key constitute the same quantum key pair.

[0124] The update submodule is used to update the certificate on the quantum terminal device based on the certificate to be transmitted when the transmission verification result indicates that the verification is passed.

[0125] According to an embodiment of the present invention, the second determination module 540 further includes: an authentication request submodule, a second determination submodule, a third determination submodule, and a fourth determination submodule.

[0126] The authentication request submodule is used to send a new certificate update request based on the fifth quantum key re-authentication to the first authentication center when the first root certificate issued by the first authentication center is not stored in the second authentication center, wherein the first root certificate issued by the first authentication center is not stored in the second authentication center.

[0127] The second determination submodule is used to determine the initial certificate to be transmitted based on the new certificate update request sent by the second authentication center when the first authentication center receives the new certificate update request.

[0128] A third determination submodule is used to verify the transmission certificate in the initial certificate to be transmitted based on the sixth quantum key to obtain an initial verification result when the second authentication center receives the initial certificate to be transmitted sent by the first authentication center through the connection link;

[0129] The fourth determination submodule is used to determine the initial certificate to be transmitted as the certificate to be transmitted sent to the quantum terminal device when the initial verification result indicates that the verification is passed.

[0130] According to an embodiment of the present invention, the certificate updating device 500 of the quantum network further includes: a third determination module.

[0131] The third determination module is used to determine the quantum key pair of the first quantum key and the second quantum key in the shared quantum key based on the preset key position information.

[0132] According to an embodiment of the present invention, any multiple modules among the detection module 510, the first determination module 520, the request launch module 530, the second determination module 540 and the certificate update module 550 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present invention, at least one of the detection module 510, the first determination module 520, the request launch module 530, the second determination module 540 and the certificate update module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in any appropriate combination of any of them. Alternatively, at least one of the detection module 510, the first determination module 520, the request initiation module 530, the second determination module 540 and the certificate update module 550 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0133] Figure 6 A block diagram of an electronic device suitable for implementing a certificate update method for a quantum network according to an embodiment of the present invention is shown.

[0134] like Figure 6As shown, the electronic device 600 according to an embodiment of the present invention includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0135] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present invention by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present invention by executing the program stored in the one or more memories.

[0136] According to an embodiment of the present invention, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0137] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiment; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present invention is implemented.

[0138] According to an embodiment of the present invention, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present invention, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present invention, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0139] The embodiment of the present invention also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the certificate update method for the quantum network provided by the embodiment of the present invention.

[0140] The computer program executes the above functions defined in the system / device of the embodiment of the present invention when it is executed by the processor 601. According to the embodiment of the present invention, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0141] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0142] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present invention are performed. According to the embodiment of the present invention, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0143] According to an embodiment of the present invention, the program code for executing the computer program provided by the embodiment of the present invention can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0144] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0145] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present invention may be combined and / or combined in various ways, even if such combinations and / or combinations are not explicitly described in the present invention. In particular, without departing from the spirit and teachings of the present invention, the features described in the various embodiments of the present invention may be combined and / or combined in various ways. All of these combinations and / or combinations fall within the scope of the present invention.

[0146] The embodiments of the present invention are described above. However, these embodiments are only for the purpose of illustration, and are not intended to limit the scope of the present invention. Although each embodiment is described above, it does not mean that the measures in each embodiment cannot be used in combination advantageously. Without departing from the scope of the present invention, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present invention.

Claims

1. A method for updating a certificate of a quantum network, characterized in that: The method comprises: Detecting a communication status of a communication link between a quantum terminal device and a first authentication center for managing the quantum terminal device, wherein the quantum terminal device stores at least one certificate issued by the first authentication center, the certificate including a digital certificate and a root certificate; When the communication condition indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, determining a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance satisfies a preset condition, wherein a connection link for temporary certificate sharing is provided between the second authentication center and the first authentication center; The quantum terminal device sends a certificate update request authenticated by a first quantum key to the second authentication center, wherein the quantum network includes the quantum terminal device, the first authentication center, and the second authentication center; When the second authentication center receives the certificate update request, determine the certificate to be transmitted based on the certificate update request, wherein the certificate to be transmitted is authenticated by a second quantum key, the first quantum key and the second quantum key belong to different quantum key pairs, and the quantum key pairs used in each certificate update process are all one-time quantum key pairs; When the quantum terminal device receives the certificate to be transmitted sent by the second authentication center, the certificate of the quantum terminal device is updated based on the certificate to be transmitted.

2. The method according to claim 1, characterized in that The determining the certificate to be transmitted based on the certificate update request includes: Verifying the certificate update request based on a third quantum key to obtain a request verification result, wherein the third quantum key and the first quantum key constitute the same quantum key pair; In a case where the request verification result indicates that the verification is passed, based on the certificate update request, determining the first identity information corresponding to the quantum terminal device in the management database of the second authentication center or the management database of the first authentication center; Performing identity authentication on the quantum terminal device based on the first identity information to obtain an identity authentication result; In a case where the identity authentication result indicates that the verification is passed, determining a transmission certificate to be sent to the quantum terminal device based on the certificate update request; The transmission certificate is authenticated based on the second quantum key to obtain the certificate to be transmitted.

3. The method according to claim 2, characterized in that The determining, based on the certificate update request, a transmission certificate to be sent to the quantum terminal device comprises: Parsing the certificate update request to determine the request type of the certificate update request; In the case where the request type is a digital certificate update request, determining a first terminal public key regenerated by the quantum terminal device from the certificate update request; and When the second authentication center stores the first root certificate issued by the first authentication center, the digital certificate is generated based on the first terminal public key, the first center private key of the second authentication center and the first identity information, wherein the digital certificate is the transmission certificate.

4. The method according to claim 3, characterized in that The step of determining the transmission certificate to be sent to the quantum terminal device based on the certificate update request further includes: In the case where the request type is a root certificate update request, generating a second center public key and a second center private key of the second authentication center; and A second root certificate is generated based on the second center public key, the second center private key and the second identity information and first identity information of the second authentication center, wherein the second root certificate is the transmission certificate.

5. The method according to claim 1, characterized in that The updating of the certificate of the quantum terminal device based on the certificate to be transmitted includes: Verifying the certificate to be transmitted based on a fourth quantum key to obtain a transmission verification result, wherein the fourth quantum key and the second quantum key constitute the same quantum key pair; When the transmission verification result indicates that the verification is passed, the certificate of the quantum terminal device is updated based on the certificate to be transmitted.

6. The method according to claim 1, characterized in that The determining the certificate to be transmitted based on the certificate update request further includes: When the first root certificate issued by the first authentication center is not stored in the second authentication center, sending a new certificate update request based on the fifth quantum key re-authentication to the first authentication center; In the case where the first authentication center receives the new certificate update request sent by the second authentication center, determining an initial certificate to be transmitted based on the new certificate update request; When the second authentication center receives the initial certificate to be transmitted sent by the first authentication center through the connection link, verifying the initial certificate to be transmitted based on the sixth quantum key to obtain an initial verification result; When the initial verification result indicates that the verification is passed, the initial certificate to be transmitted is determined as the certificate to be transmitted sent to the quantum terminal device.

7. The method according to claim 1, characterized in that The method further comprises: Based on the preset key position information, a quantum key pair of each of the first quantum key and the second quantum key is determined in the shared quantum key.

8. A certificate updating device for a quantum network, characterized in that: The device comprises: A detection module, used to detect the communication status of a communication link between a quantum terminal device and a first authentication center used to manage the quantum terminal device, wherein the quantum terminal device stores at least one certificate issued by the first authentication center, and the certificate includes a digital certificate and a root certificate; A first determination module is used to determine, when the communication condition indicates that the communication link between the quantum terminal device and the first authentication center is an unstable link, a second authentication center whose communication link with the quantum terminal device is a stable link and whose distance satisfies a preset condition, wherein a connection link for temporary certificate sharing exists between the second authentication center and the first authentication center; A request initiation module, configured to send a certificate update request authenticated by a first quantum key from the quantum terminal device to the second authentication center, wherein the quantum network includes the quantum terminal device, the first authentication center, and the second authentication center; A second determination module is configured to determine the certificate to be transmitted based on the certificate update request when the second authentication center receives the certificate update request, wherein the certificate to be transmitted is authenticated by a second quantum key, the first quantum key and the second quantum key belong to different quantum key pairs, and the quantum key pairs used in each certificate update process are all one-time quantum key pairs; A certificate updating module is used to update the certificate of the quantum terminal device based on the certificate to be transmitted when the quantum terminal device receives the certificate to be transmitted sent by the second authentication center.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images