District key efficient distribution and data encryption method based on quantum communication

Abstract

The invention provides a zone area key efficient distribution and data encryption method based on quantum communication, which comprises the following steps that: firstly, a quantum key management platform charges a quantum protection key Kc and a certificate to a local communication bin of side equipment and charges a quantum protection key Ks and a certificate to end equipment, and then the end equipment S performs identity authentication to a local communication bin of side equipment C; the local communication bin of the side equipment C performs identity authentication on the end equipment S, and the local communication bin of the side equipment C generates a session key Kh; and finally, encrypting and decrypting downlink data, encrypting and decrypting uplink data and updating the secret key. According to the invention, the problems of low distribution efficiency and insufficient data encryption security of the transformer area key in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to communication technology, and more specifically, to a method for realizing efficient distribution of station keys and data encryption based on quantum communication technology, aiming to improve the security, efficiency and reliability of data transmission. Background Art

[0002] With the rapid development of information technology, communication security has become an urgent problem to be solved. Traditional encryption methods such as RSA and AES are powerless in the face of the potential threat of quantum computers. Quantum communication technology, with its unique non-cloning, unpredictability and high security, provides a new solution for communication security. Especially in regional communications, higher requirements are placed on key distribution and data encryption. Summary of the invention

[0003] The present invention aims to solve the problems of low efficiency of regional key distribution and insufficient data encryption security in the prior art, and to provide a regional key efficient distribution and data encryption method based on quantum communication.

[0004] In order to achieve the above object, the present invention provides a method for realizing efficient key distribution and data encryption in a station area based on quantum communication technology, comprising: Step S1: The quantum key management platform injects the quantum protection key Kc and certificate into the local communication warehouse of the edge device, and the quantum key management platform injects the quantum protection key Ks and certificate into the end device; the quantum key management platform generates the quantum key and certificate, transmits the protection key Kc and certificate to the local communication warehouse of the edge device through offline injection, and transmits the protection key Ks and certificate to the end device; Step S2: The end device S performs identity authentication on the local communication warehouse of the edge device C; Step S3: The local communication warehouse of edge device C performs identity authentication on end device S; Step S4: The local communication warehouse of edge device C generates a session key Kh; Step S5: encryption and decryption of downlink data; Step S6: encryption and decryption of uplink data; Step S7: Session key update.

[0005] Preferably, step S2 further comprises: The end device S sends its network access certificate to the local communication warehouse of the edge device C. The local communication warehouse of the edge device C authenticates its certificate and sends the authentication result to the end device S.

[0006] Preferably, step S3 further comprises: The local communication warehouse of edge device C sends its network access certificate to end device S, which authenticates its certificate and sends the authentication result to the local communication warehouse of edge device C; After steps S2 and S3, an authenticated communication connection is established between the local communication warehouse of the edge device C and the end device S.

[0007] Preferably, step S4 further comprises: Step S4.1: The end device S transmits the dispersion factor to the local communication warehouse of the edge device C through the established channel; Step S4.2: The local communication compartment of edge device C uses the quantum protection key Kc and the dispersion factor to calculate the protection key Ks of the end device; Step S4.3: randomly generate a set of session keys Kh according to the key composition requirements; and encrypt the session keys using the protection key Ks to obtain the encrypted session key Ks (Kh); Step S4.4: Through the established channel, the local communication warehouse of the edge device C transmits the encrypted session key Ks (Kh) to the end device S; Step S4.5: The end device S receives the encrypted session key Ks (Kh), decrypts it, and obtains the session key Kh.

[0008] Preferably, step S5 further comprises: Step S5.1: The main control board of edge device C sends a downlink plaintext data Data to the local communication warehouse of edge device C; Step S5.2: The local communication compartment of edge device C encrypts the downlink plaintext data Data with the session key Kh; Step S5.3: The terminal device decrypts the encrypted data Kh(Data) to obtain the downlink plaintext data Data.

[0009] Preferably, step S6 further comprises: Step S6.1: The end device encrypts the uplink plaintext data Data with the session key Kh; Step S6.2: The local communication compartment of edge device C uses the session key Kh to decrypt the encrypted data Kh(Data) to obtain the uplink plaintext data Data; Step S6.3: The local communication compartment of edge device C sends the uplink plaintext data Data to the main control board of edge device C.

[0010] Preferably, step S7 further comprises: The end device S makes a request to the edge device C to update the session key. The local communication warehouse of the edge device C regenerates a new set of session keys Kh', encrypts the new session key Kh' with the session key Kh and transmits it to the end device. The end device uses the session key Kh to decrypt the encrypted data Kh (Kh') to obtain the new session key Kh'.

[0011] Preferably, the session key Ks is specifically calculated as follows: The quantum key management platform generates two sets of associated quantum keys of length N, denoted as U and V. , ; Randomly generate a set of keys of length 2N , the first half of the interval is inserted into U, and the second half of the interval is inserted into V, so that the protection keys Ks and Kc of length 2N are obtained; , ; The secret key generated above is distributed to the end device S and the edge device C in an offline charging manner.

[0012] Preferably, the specific calculation method of the session key Ks further includes: In the station area, each device has a unique identification code, and the terminal device structure dispersion factor is as follows: Re-obtain the unique identification code of the device and the device to be communicated in the system, record the end device as As and the side device as Ac; , ; For the end device As, use the quantum key U to encrypt (As, Ac) to form a new encryption sequence ; Based on the quantum key U, determine the quantum key V, and use the key to parse the random sequence Encrypt and get ; will sequence The data is transmitted to the edge device C through the established channel, and the edge device C parses the data.

[0013] Preferably, the specific calculation method of the session key Ks further includes: Take the first 2M values , determine the quantum key U of the end device C through its own quantum key V, and then decrypt it to obtain a unique identification code , , and then compare it with the unique identification code in the system. If they are consistent, it means that the data is safe and has not been tampered with; The same reason Decrypt to obtain , then combine the quantum key U and the random sequence ,get .

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1) Offline quantum key charging can ensure the security of system communications, give full play to the confidentiality characteristics of quantum keys, and does not require the establishment of quantum channels, with high cost-effectiveness.

[0015] 2) During the communication transmission process, the initial quantum key is not transmitted through the channel, ensuring the security of the key.

[0016] 3) By verifying the unique identification code, the authentication security between the two communicating nodes is further increased to simulate information forgery and tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a security protection solution for low-voltage distribution business in an area based on quantum encryption according to the present invention.

[0018] Figure 2 This is a flow chart of edge-to-end quantum key session key distribution and business data transmission protection of the present invention. DETAILED DESCRIPTION

[0019] The present invention is further described in detail below in conjunction with the accompanying drawings: In order to better understand the present invention, the embodiments of the present invention are explained in detail below with reference to the accompanying drawings.

[0020] The present invention provides embodiment 1 which discloses the relevant structure of the quantum encryption device of the present invention.

[0021] Embodiment 1 discloses a quantum encryption communication system structure.

[0022] Based on quantum key technology, by integrating quantum security chips in the local communication warehouse of edge devices such as distribution terminals and fusion terminals, and integrating security chips (embedded) or external security modules (external) in end devices such as smart circuit breakers, photovoltaic grid-connected circuit breakers, and charging piles, an edge-to-end quantum security encryption channel is built.

[0023] The structure of the data encryption system based on quantum communication and efficient key distribution is as follows: Figure 1 As shown: The encrypted communication system includes edge nodes and end nodes, and realizes encrypted communication between the edge nodes and the end nodes by adding a security chip in an embedded or external security module manner.

[0024] The side of the substation distribution network is generally a distribution terminal. A security chip with a built-in quantum random number generator is deployed in the local communication warehouse of the edge device, and the quantum session key is encrypted and issued using a quantum protection key.

[0025] In particular, the security chip of the quantum random number generator can be a quantum random number generator or a quantum random number chip or other devices or means that can generate true random numbers.

[0026] The end side of the distribution network in the substation area is mainly the power consumption (generation) node equipment in the power grid, and a security chip is embedded in the end device or a security module with an external integrated security chip is installed.

[0027] The security chip on the terminal side is mainly embedded in the terminal device and integrated with the device, which is called the embedded mode of secure communication; it can also be used for external terminal devices; the security module provides security services to the terminal device through hardware modification, such as embedding the tail module, external security isolation device, etc., which is called the external mode of secure communication.

[0028] The end-side device protects the transmission of edge-to-end business data through quantum key encryption.

[0029] Another aspect of the present invention discloses the composition of encrypted communication system equipment.

[0030] In the process of implementing quantum encryption communication in the distribution network of the substation, the following equipment is involved: (1) The key management platform is used to generate and issue the initial protection key and certificate of the communication "edge-to-end". It is the basic platform for the communication key management of the distribution network in the substation area. In quantum encryption secure communication, the protection key and certificate are generally charged offline.

[0031] (2) Edge devices mainly include edge device main control board and local communication warehouse. The device main control board is a device for information generation, processing and execution, and the local communication warehouse is an encrypted secure communication device. The main control board and local communication warehouse constitute the secure communication and information processing control node of the edge device.

[0032] (3) End equipment, including end equipment functional system and encrypted secure communication module. The end equipment functional system mainly refers to the corresponding facilities and equipment of the distribution network terminal, such as various types of power consumption devices, power grid safety protection devices, etc. The secure communication module is the main carrier for realizing quantum encrypted secure communication.

[0033] The protection keys between edge and end are uniformly generated and issued by the key management platform. The session keys between edge and end are generated by the quantum random numbers built into the edge security chip and issued to the end device. The edge device is responsible for the maintenance and management of the session keys of the end device.

[0034] The second embodiment of the present invention discloses the process of implementing encrypted communication of the present invention, as shown in the attached Figure 2 shown.

[0035] The edge device is denoted as C and the end device is denoted as S. The method for implementing quantum encryption secure communication between devices C and S is described as follows: It can be understood that the edge device includes a main control board and a local communication compartment.

[0036] Step S1: The quantum key management platform injects the quantum protection key Kc and certificate into the local communication warehouse of the edge device, and the quantum key management platform injects the quantum protection key Ks and certificate into the end device; The key management platform generates quantum keys and certificates, transmits the protection key Kc and certificate to the local communication warehouse of the edge device through offline filling, and transmits the protection key Ks and certificate to the end device.

[0037] Step S2: The end device S performs identity authentication to the local communication warehouse in the edge device C.

[0038] The end device S sends its network access certificate to the local communication warehouse of the edge device C. The local communication warehouse authenticates its certificate and sends the authentication result to the end device S.

[0039] Step S3: The local communication warehouse of edge device C performs identity authentication to end device S. Similarly, the local communication warehouse of edge device C sends its network access certificate to the end device S, the end device authenticates its certificate and sends the authentication result to the local communication warehouse of edge device C.

[0040] After steps S2 and S3, an authenticated communication connection is established between the local communication warehouse of the edge device C and the end device S.

[0041] Step S4: The local communication compartment of edge device C generates a session key Kh.

[0042] Step S4.1: The end device S transmits the dispersion factor to the local communication bin of the edge device C through the established channel.

[0043] Step S4.2: The local communication compartment of edge device C uses the quantum protection key Kc and the dispersion factor to calculate the protection key Ks of the end device.

[0044] Step S4.3: According to the key composition requirements, a set of session keys Kh is randomly generated. The session keys are encrypted using the protection key Ks to obtain the encrypted session key Ks (Kh).

[0045] Step S4.4: Through the established channel, the local communication warehouse of the edge device C transmits the encrypted session key Ks (Kh) to the end device S.

[0046] Step S4.5: The end device S receives the encrypted session key Ks (Kh), decrypts it, and obtains the session key Kh.

[0047] Step S5: Encryption and decryption of downlink data.

[0048] Step S5.1: The main control board of edge device C sends a downlink plaintext data Data to the local communication warehouse; Step S5.2: The local communication compartment of edge device C encrypts the downlink plaintext data Data with the session key Kh; Step S5.3: The terminal device S decrypts the encrypted data Kh(Data) to obtain the downlink plaintext data Data.

[0049] Step S6: Encryption and decryption of uplink data.

[0050] Step S6.1: The end device S encrypts the uplink plaintext data Data with the session key Kh; Step S6.2: The local communication compartment of edge device C uses the session key Kh to decrypt the encrypted data Kh(Data) to obtain the uplink plaintext data Data; Step S6.3: The local communication compartment of edge device C sends the uplink plaintext data Data to the main control board of edge device C.

[0051] Step S7: Key update.

[0052] To ensure communication security, the session key needs to be updated regularly. The end device S makes a request to the edge device C to update the session key. The edge device C generates a new set of session keys Kh' in the local communication warehouse, and encrypts the new session key Kh' with the current session key Kh and transmits it to the end device S. The end device S uses the current session key Kh to decrypt the encrypted data Kh (Kh') to obtain the new session key Kh'.

[0053] Specifically, a method for calculating a session key Ks is also provided in Embodiment 3 of the present invention.

[0054] The quantum key management platform generates two sets of associated quantum keys of length N, denoted as U and V. , To ensure key security, improve the efficiency of quantum key usage, and enhance economic efficiency, the following methods are used: Randomly generate a set of keys of length 2N , the first half of the interval is inserted into U, and the second half of the interval is inserted into V, thus obtaining protection keys KS and Kc of length 2N.

[0055] ,

[0056] The secret key generated above is distributed to the end device S and the edge device C by offline charging.

[0057] In the substation area, each device has a unique identification code (such as MAC code, substation unified identification code, etc.), and the terminal device structure dispersion factor is as follows: First, the system re-obtains the unique identification codes of the device and the device to be communicated, and records the end device as As and the edge device as Ac.

[0058] ,

[0059] For the end device As, use the quantum key U to encrypt (As, Ac) to form a new encryption sequence Based on the quantum key U, the quantum key V is determined and used to parse the random sequence Encrypt and get .

[0060] will sequence The data is transmitted to the edge device C through the established channel, and the edge device C parses the above data.

[0061] First, take the first 2M values , determine the quantum key U of the end device C through its own quantum key V, and then decrypt it to obtain a unique identification code , , and then compare it with the unique identification code in the system. If they are consistent, it means that the data is safe and has not been tampered with. Decrypt to obtain , then combine the quantum key U and the random sequence ,get .

[0062] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "connected" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0063] In the description of the present invention, unless otherwise specified, the directions or positional relationships indicated by terms such as "up", "down", "left", "right", "inside" and "outside" are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on the present invention.

[0064] Finally, it should be explained that the above technical solution is only one implementation method of the present invention. For those skilled in the art, it is easy to make various types of improvements or modifications based on the application methods and principles disclosed in the present invention, and it is not limited to the method described in the above specific implementation method of the present invention. Therefore, the method described above is only preferred and does not have a restrictive meaning.

Claims

1. A method for realizing efficient key distribution and data encryption in a station area based on quantum communication technology, characterized in that: Step S1: The quantum key management platform injects the quantum protection key Kc and certificate into the local communication warehouse of the edge device, and the quantum key management platform injects the quantum protection key Ks and certificate into the end device; The quantum key management platform generates quantum keys and certificates, transmits the protection key Kc and certificate to the local communication warehouse of the edge device through offline filling, and transmits the protection key Ks and certificate to the end device; Step S2: The end device S performs identity authentication on the local communication warehouse of the edge device C; Step S3: The local communication warehouse of the edge device C performs identity authentication on the end device S; Step S4: The local communication compartment of the edge device C generates a session key Kh; Step S5: encryption and decryption of downlink data; Step S6: encryption and decryption of uplink data; Step S7: Session key update.

2. The method according to claim 1, characterized in that The step S2 further comprises: The end device S sends its network access certificate to the local communication warehouse of the edge device C. The local communication warehouse of the edge device C authenticates its certificate and sends the authentication result to the end device S.

3. The method according to claim 2, characterized in that The step S3 further comprises: The local communication warehouse of the edge device C sends its network access certificate to the end device S, and the end device S authenticates its certificate and sends the authentication result to the local communication warehouse of the edge device C; After step S2 and step S3, an authenticated communication connection is established between the local communication compartment of the edge device C and the end device S.

4. The method according to claim 3, characterized in that The step S4 further comprises: Step S4.1: the end device S transmits the dispersion factor to the local communication warehouse of the edge device C through the established channel; Step S4.2: The local communication compartment of the edge device C uses the quantum protection key Kc and the dispersion factor to calculate the protection key Ks of the end device; Step S4.3: randomly generate a set of session keys Kh according to the key composition requirements; and encrypt the session keys using the protection key Ks to obtain the encrypted session key Ks (Kh); Step S4.4: The local communication compartment of the edge device C transmits the encrypted session key Ks (Kh) to the end device S through the established channel; Step S4.5: The terminal device S receives the encrypted session key Ks (Kh), decrypts it, and obtains the session key Kh.

5. The method according to claim 4, characterized in that The step S5 further comprises: Step S5.1: the main control board of the edge device C sends a downlink plaintext data Data to the local communication compartment of the edge device C; Step S5.2: The local communication compartment of the edge device C encrypts the downlink plaintext data Data with the session key Kh; Step S5.3: The terminal device decrypts the encrypted data Kh(Data) to obtain downlink plaintext data Data.

6. The method according to claim 5, characterized in that The step S6 further comprises: Step S6.1: The terminal device encrypts the uplink plaintext data Data with the session key Kh; Step S6.2: The local communication compartment of the edge device C uses the session key Kh to decrypt the encrypted data Kh(Data) to obtain the uplink plaintext data Data; Step S6.3: The local communication compartment of the edge device C sends the uplink plaintext data Data to the main control board of the edge device C.

7. The method according to claim 6, characterized in that The step S7 further comprises: The end device S makes a request to update the session key to the edge device C. The local communication warehouse of the edge device C regenerates a new set of session keys Kh', encrypts the new session key Kh' by the session key Kh and transmits it to the end device. The end device uses the session key Kh to decrypt the encrypted data Kh (Kh') to obtain the new session key Kh'.

8. The method according to claim 7, characterized in that The specific calculation method of the session key Ks is as follows: The quantum key management platform generates two sets of associated quantum keys of length N, denoted as U and V. , ; Randomly generate a set of keys of length 2N , the first half of the interval is inserted into U, and the second half of the interval is inserted into V, so that the protection keys Ks and Kc of length 2N are obtained; ， ； The secret key generated above is distributed to the end device S and the edge device C in an offline charging manner.

9. The method according to claim 8, characterized in that The specific calculation method of the session key Ks further includes: In the station area, each device has a unique identification code, and the terminal device structure dispersion factor is as follows: Re-obtain the unique identification code of the device and the device to be communicated in the system, record the end device as As and the side device as Ac; ， ； For the end device As, use the quantum key U to encrypt (As, Ac) to form a new encryption sequence ; Based on the quantum key U, determine the quantum key V, and use the key to parse the random sequence Encrypt and get ; will sequence The data is transmitted to the edge device C through the established channel, and the edge device C parses the data.

10. The method according to claim 9, characterized in that The specific calculation method of the session key Ks further includes: Take the first 2M values , determine the quantum key U of the end device C through its own quantum key V, and then decrypt it to obtain a unique identification code , , and then compare it with the unique identification code in the system. If they are consistent, it means that the data is safe and has not been tampered with; The same reason Decrypt to obtain , then combine the quantum key U and the random sequence ,get .

Images