A method and system for establishing a global quantum secure virtual private network

Abstract

The present application discloses a networking method and system for a global quantum secure virtual private network, the networking method comprising the following steps: a first boundary base station establishes a connection with a second boundary base station via the Internet, and synchronizes the original key file; the first boundary base station establishes a connection with at least one access base station via a local area network, and the second boundary base station establishes a connection with at least one access base station via a local area network; the access base station receives an access request from at least one client, determines whether the client meets the networking access conditions based on the access request, and agrees to the access request in response to determining that the client meets the networking access conditions; the access base station establishes a connection with the client via the Internet based on an indication of agreeing to the access request; the access base station distributes communication keys to the accessed client. The networking method and networking system involved in the present invention provide a secure virtual private network to solve communication security and communication isolation problems.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a networking method and system for a global quantum secure virtual private network. Background Art

[0002] Virtual Private Network, or VPN for short, is a network that establishes a private network on a public network for encrypted communication. It is widely used in corporate networks. VPN gateways enable remote access by encrypting data packets and converting the destination address of data packets.

[0003] According to the patent "Scheduling Method and System for Virtual Private Network" with application number 201910683782.6: "Edge nodes can communicate directly with each other, and reach the target address through one addressing, so as to improve the communication speed between edge nodes in the virtual private network and the network addressing speed." It can be seen that communication in a virtual private network depends on address information. In this patent, the address uses the physical address MAC address. Since communication depends on address information, the address information needs to be made public to be addressed, which will be directly exposed during the data transmission process, giving illegal users the opportunity to forge and intercept address information to impersonate a counterfeit device with the address, thereby intercepting data that should have been sent to a normal device with the address, creating security risks.

[0004] In addition, two different virtual private networks A and B are isolated from each other. Both virtual private network A and virtual private network B use their own intranet addresses, which makes it impossible for virtual private networks A and B to communicate directly using intranet addresses.

[0005] In summary, the current method of communicating with a virtual private network that relies on publicly available address information makes the virtual private network vulnerable to intrusion and data theft; and the isolation between different virtual private networks makes it difficult for two devices belonging to different private networks to communicate. In view of this, a secure virtual private network is currently needed to solve the problems of communication security and communication isolation. Summary of the invention

[0006] Purpose of the invention: The purpose of the present invention is to provide a method and system for establishing a global quantum secure virtual private network to solve the problems existing in the prior art.

[0007] Technical solution: The present invention provides a networking method for a global quantum secure virtual private network. The participants of the networking method include a first border base station, an access base station, a client, and a second border base station. The networking method comprises the following steps:

[0008] Step 1: The first border base station establishes a connection with the second border base station via the Internet and synchronizes the original key file;

[0009] Step 2: The first border base station establishes a connection with at least one access base station through a local area network, and the second border base station establishes a connection with at least one access base station through a local area network, and the access base station obtains a communication key from the first border base station or the second border base station;

[0010] Step 3: The access base station receives an access request from at least one client, determines whether the client satisfies a networking access condition based on the access request, and approves the access request in response to determining that the client satisfies the networking access condition; or rejects the access request in response to determining that the client does not satisfy the networking access condition;

[0011] Step 4: The access base station establishes a connection with the client via the Internet based on the indication of approving the access request;

[0012] Step 5: The access base station distributes communication keys to the accessed clients.

[0013] As an improvement of the present invention, a first true random number generator is configured inside or outside the first border base station, and a second true random number generator is configured inside or outside the second border base station; in step 1, the specific process of synchronizing the original key file is:

[0014] 1-1: The first border base station generates a first set of keys based on a first true random number generator to form a first key file of length n; the second border base station generates a second set of keys based on a second true random number generator to form a second key file of length n; wherein both the first key file and the second key file are quantum keys;

[0015] 1-2: The first border base station encrypts the first key file and sends it to the second border base station, and the second border base station encrypts the second key file and sends it to the first border base station;

[0016] 1-3: The first border base station performs an XOR operation on the first key file and the second key file to obtain and save the third key file; the second border base station performs an XOR operation on the second key file and the first key file to obtain and save the fourth key file that is the same as the third key file; wherein the third key file and the fourth key file are the original key files provided by the border base station to the access base station.

[0017] As an improvement of the present invention, a key remaining amount threshold is set in the first border base station or the second border base station, and when the size of the original key file is lower than the key remaining amount threshold, steps 1-1 to 1-3 are repeated.

[0018] As an improvement of the present invention, in step 3, the client that meets the networking access conditions has a communication area, an isolation area, and a security area, wherein the communication area is provided with a communication agent for the client to communicate with the outside world and receive or send data; the isolation area is provided between the communication area and the security area, for connecting the communication area and the security area, and is provided with a decryption unit, an encryption unit, and a response unit, the decryption unit is used to decrypt data received from the communication area, the encryption unit is used to encrypt data sent from the security area, and the response unit is used to verify the data format of the inquiry statement and provide feedback on the inquiry; the security area is provided with an information processing unit and a key unit, the information processing unit is used to perform data processing in the client, and the key unit is used to store the communication key distributed by the access base station; wherein the communication agent of the communication area is respectively connected to the decryption unit and the encryption unit of the isolation area, the decryption unit of the isolation area is respectively connected to the information processing unit and the key unit of the security area, the encryption unit of the isolation area is respectively connected to the information processing unit and the key unit of the security area, and the decryption unit of the isolation area is also connected to the response unit of the isolation area.

[0019] As an improvement of the present invention, in step 3, the specific process of determining whether the client meets the networking access condition based on the access request is:

[0020] 3-1: Based on the access request of the client, the access base station sends a query Q to the client, negotiates a set of communication keys k with the client, encrypts the query Q using the communication key k, and obtains a ciphertext Q⊕k, wherein the data format of the query Q is a data format recognized by the client with a secure zone, and the recipient of the query Q is the response unit in the isolation zone;

[0021] 3-2: The client's communication agent transmits the received ciphertext Q⊕k to the decryption unit in the isolation area for decryption to obtain the query Q, and obtains the recipient of the query from the decrypted query Q;

[0022] 3-3: The decryption unit sends the query Q to the response unit based on the receiving object of the query;

[0023] 3-4: The response unit verifies the data format of the query Q. In response to successful verification, the response unit responds to the query and feeds back a yes query result, determines that the client meets the networking access conditions, and agrees to the access request. In response to failed verification, the response unit refuses to respond to the query and feeds back a null query result, determines that the client does not meet the networking access conditions, rejects the access request, and the client re-initiates an access request to the access base station.

[0024] As an improvement of the present invention, the specific process of step 5 is as follows:

[0025] 5-1: The access base station requests a key from the first border base station or the second border base station. The first border base station or the second border base station responds to the request, selects a portion from the stored third key file or the fourth key file and sends it to the access base station as a seed key of the access base station;

[0026] 5-2: After the access base station detects that a connection has been established with the client, the access base station determines the storage size of the key unit in the client;

[0027] 5-3: The access base station executes an expansion algorithm for the seed key based on the storage size of the key unit in the client in step 5-2 to obtain an expanded key file that meets the storage size;

[0028] 5-4: The access base station encrypts the extended key file and sends it to the client;

[0029] 5-5: The communication agent of the client receives the encrypted extended key file, forwards the received encrypted extended key file to the decryption unit in the isolation zone for decryption, and the decryption unit transmits the decrypted extended key file to the key unit in the security zone for storage.

[0030] As an improvement of the present invention, a networking system of a global quantum secure virtual private network is also provided, the networking system is constructed using the networking method of the global quantum secure virtual private network as described above, the networking system includes a first border base station and a second border base station connected via the Internet, and at least one access base station connected to the first border base station via a local area network, at least one access base station connected to the second border base station via a local area network, and at least one client connected to the access base station;

[0031] The first boundary base station and the second boundary base station are used to define the boundary of the local area network, provide keys for access base stations, and provide cross-region or cross-local area network key relay and relay routing selection for communication links;

[0032] The access base station is used to obtain a communication key from a border base station, determine whether a client accessing the access base station meets a networking access condition, and distribute a communication key to a client that meets the networking access condition and accesses the access base station;

[0033] The client is used to carry user network communications.

[0034] As an improvement of the present invention, the first border base station and the second border base station are respectively configured with corresponding first true random number generators and second true random number generators inside or outside to generate original key files and provide seed keys for corresponding access base stations.

[0035] As an improvement of the present invention, the first boundary base station and / or the second boundary base station are connected to multiple access base stations, each access base station is connected to at least one client, and each access base station and at least one client connected to it constitute a user group.

[0036] As an improvement of the present invention, in addition to the first border base station and the second border base station, the networking system includes other border base stations with the same functions as the first border base station and the second border base station.

[0037] Beneficial effects of the present invention:

[0038] (1) The seed keys of the keys stored in each client in the networking system constructed by the networking method of the global quantum secure virtual private network proposed by the present invention are distributed by the first border base station or the second border base station to the corresponding access base station. Therefore, this networking system is a networking system based on quantum key association, and each client in the networking system communicates based on the key in the extended key file received from the access base station.

[0039] (2) Different from the traditional virtual private network communication method based on the intranet address, each client in the networking system obtained by the present application relies on the associated quantum key for communication. As long as the client obtains the key file based on the original key of the first boundary base station or the second boundary base station, it is within the communication range of the networking system. The boundary base station, as a network communication device at the boundary of the local area network, can be directly connected to the boundary base station at the boundary of another local area network, so that the quantum keys stored in the clients in two different local area networks are associated, and communication is achieved based on the associated quantum key. Clients that do not have associated quantum keys do not belong to the networking system and cannot communicate.

[0040] (3) The client involved in this networking method has a security zone isolated from the isolation zone. The security zone does not communicate directly with the outside world, and the outside world cannot directly connect to the security zone, making the client's security zone invisible to the public network and information unbreakable. It can be regarded as a completely invisible network environment. In this case, the key distribution and key relay for the client in the entire network are safe.

[0041] (4) Each device in this networking method, such as the convenient base station, access base station, and user terminal, is deployed on the Internet (i.e., the public network). It integrates the communication technologies of the public network and the virtual private network, and can directly reuse the existing public network system without the need to redeploy dedicated lines, thereby reducing deployment costs and improving deployment efficiency. It realizes the integrated communication of public and private dual channels and the secure isolation of data, allowing the business side to access the public network and the virtual private network more flexibly according to user needs, thereby meeting diverse communication needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0043] Figure 1 A schematic diagram of the process of the networking method of the present invention;

[0044] Figure 2 A schematic diagram of the structure of a client involved in the networking method of the present invention;

[0045] Figure 3 A connection diagram of the networking system of the present invention;

[0046] Figure 4 It is a connection diagram of another network system of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0048] As described in the background technology, the current access to a virtual private network is based on the address information of the virtual private network. In order to achieve access, the address information will be made public, which creates the risk of the virtual private network being easily invaded and the data being easily stolen; and the address information in the virtual private network is only used in this virtual private network, and other virtual private networks are isolated from this virtual private network. Therefore, it is difficult for two devices belonging to different virtual private networks to communicate. In view of this, a secure virtual private network is currently needed to solve the problems of communication security and communication isolation.

[0049] In response to the above problems, this application proposes a method for networking a global quantum secure virtual private network. The virtual private network constructed using this method can ensure the global security of the communication process. The global domain here refers to the entire information domain covering the terminal, the link, and then the server.

[0050] like Figure 1 As shown, a method for establishing a global quantum secure virtual private network proposed in this application includes the following steps:

[0051] Step 1: The first border base station establishes a connection with the second border base station via the Internet and synchronizes the original key file.

[0052] Among them, the border base station is a network communication device used to define the border of the local area network, provide keys for access base stations, provide cross-region or cross-local area network key relay and relay routing selection for communication links, and realize network docking for cross-region or cross-domain communication. That is, a border base station indicates that a local area network is deployed, and the access base stations connected to the border base station are all within the service scope of the local area network.

[0053] The first border base station and the second border base station can be respectively configured with a true random number generator. For example, the first border base station is configured with a first true random number generator, and the second border base station is configured with a second true random number generator. The first true random number generator can be set inside the device of the first border base station as a module, or it can be separated from the first border base station and exist as a separate device; similarly, the second true random number generator can be set inside the device of the second border base station as a module, or it can be separated from the second border base station and exist as a separate device. At this time, the process of synchronizing the original key between the first border base station and the second border base station is:

[0054] 1-1: The first border base station generates a first set of keys based on a first true random number generator to form a first key file of length n; similarly, the second border base station generates a second set of keys based on a second true random number generator to form a second key file of length n; both the first key file and the second key file are quantum keys;

[0055] 1-2: The first border base station encrypts the first key file and sends it to the second border base station, and the second border base station encrypts the second key file and sends it to the first border base station;

[0056] 1-3: The first border base station performs an XOR operation on the first key file and the second key file to obtain and save the third key file. Similarly, the second border base station performs an XOR operation on the second key file and the first key file to obtain and save the fourth key file that is the same as the third key file. The third key file and the fourth key file are the original key files provided by the border base station to the access base station.

[0057] Subsequently, as the communication process is executed, when the original key file is consumed to a certain extent, steps 1-1 to 1-3 are repeated to replenish the original key file for the first border base station and the second border base station. For example, the first border base station or the second border base station can set a key remaining amount threshold, and when the size of the original key file is lower than the threshold, the operation of replenishing the original key file is performed.

[0058] Alternatively, the first border base station and the second border base station are connected to the same key center. At this time, the process of synchronizing the initial key between the first border base station and the second border base station is as follows: the first border base station and the second border base station both obtain the same set of key files from the key center as the original key files provided by the border base station to the access base station. Subsequently, as the communication process is executed, when the original key files are consumed to a certain extent, the first border base station and the second border base station interact with the key center to obtain a new set of identical key files to supplement the original key files. For example, the first border base station or the second border base station can set a key remaining amount threshold. When the size of the original key file is lower than the threshold, the first border base station and the second border base station initiate interaction with the key center.

[0059] Step 2: The first border base station establishes a connection with at least one access base station through a local area network, and the second border base station establishes a connection with at least one access base station through a local area network.

[0060] The access base station connected to the first border base station includes the first access base station, and the access base station connected to the second border base station includes the second access base station. The access base station is used to obtain a communication key from the border base station and distribute the communication key to a client accessing the access base station.

[0061] Step 3: The access base station receives an access request from at least one client, and based on the access request, determines whether the client meets the networking access conditions. In response to determining that the client meets the networking access conditions, the access request is approved; in response to determining that the client does not meet the networking access conditions, the access request is rejected.

[0062] The client is held by the user. One client corresponds to one user and is the terminal device that carries the user's network communications.

[0063] Clients that meet the network access conditions must have a security zone. Figure 2 In the structure shown, the client has three areas: the communication area, the isolation area, and the security area. Among them, the communication area is provided with a communication agent, which is used for the client to communicate with the outside world and receive or send data; the isolation area is set between the communication area and the security area, used to connect the communication area and the security area, and is provided with a decryption unit, an encryption unit, and a response unit. The decryption unit is used to decrypt the data received from the communication area, and the encryption unit is used to encrypt the data sent from the security area to realize data interaction between the communication area and the security area. The response unit is used to verify the data format of the query statement and give feedback on the query. The security area is provided with an information processing unit and a key unit. The information processing unit is used to perform the data processing process in the client, and the key unit is used to store the communication key distributed by the access base station.

[0064] In the client, the communication agent in the communication area is respectively connected to the decryption unit and encryption unit in the isolation area, the decryption unit in the isolation area is respectively connected to the information processing unit and key unit in the security area, the encryption unit in the isolation area is respectively connected to the information processing unit and key unit in the security area, and the decryption unit in the isolation area is also connected to the response unit in the isolation area.

[0065] In this client, due to the existence of the isolation zone, the security zone is not directly connected to the outside world. All data sent from the security zone must be encrypted in the isolation zone, and then the encrypted ciphertext is transmitted to the outside world through the communication agent in the communication zone; all data received from the communication zone must be decrypted in the isolation zone, and then the decrypted plaintext data is sent to the information processing unit in the security zone for processing. Therefore, for other devices outside the client, the client's security zone is invisible to the public network and the information is unbreakable, just like being in a completely invisible network environment.

[0066] In view of the above client structure, the method for the access base station to determine whether the client has a security zone is:

[0067] 3-1: Based on the access request of the client, the access base station sends a query Q to the client, and negotiates a set of communication keys k with the client, and uses the communication key k to encrypt the query Q to obtain the ciphertext Q⊕k. The data format of the query Q can be a data format recognized by the client in the security zone, and the recipient of the query Q is the response unit in the isolation zone;

[0068] 3-2: The client's communication agent transmits the received ciphertext Q⊕k to the decryption unit in the isolation area for decryption to obtain the query Q, and obtains the recipient of the query from the decrypted query Q;

[0069] 3-3: The decryption unit sends the query Q to the response unit based on the recipient of the query;

[0070] 3-4: The response unit verifies the data format of the inquiry. In response to successful verification, the response unit responds to the inquiry and feedback that the inquiry result is yes; in response to failed verification, the response unit refuses to respond to the inquiry and feedback that the inquiry result is empty, and the client re-initiates an access request to the access base station.

[0071] Thus, through the query operation, only Figure 2 Only the client with the security zone structure shown can respond to the query with a yes result. Otherwise, if the client does not have a security zone, it will certainly not have an isolation zone. The query sent by the access base station cannot reach the response unit, and an empty query result will be obtained.

[0072] Step 4: The access base station establishes a connection with the client via the Internet based on the indication of approving the access request. For example, the first access base station establishes a connection with the 1Ath client.

[0073] Step 5: The access base station distributes communication keys to the accessed clients.

[0074] Here, the process of distributing communication keys is described by taking the first access base station distributing communication keys to the 1A client as an example. The process includes the following steps:

[0075] 5-1: The first access base station requests a key from the first border base station. The first border base station responds to the request and selects a portion from the stored third key file and sends it to the first access base station as a seed key of the first access base station. Since the first access base station and the first border base station are connected via a local area network, it can be considered that the key file transmission between the first access base station and the first border base station is secure.

[0076] 5-2: After the first access base station detects that a connection has been established with the 1A client, it determines the storage size of the key unit in the 1A client;

[0077] 5-3: The first access base station executes an expansion algorithm for the seed key based on the storage size of the key unit in the 1A client to obtain an expanded key file that meets the storage size;

[0078] 5-4: The first access base station encrypts the extended key file and sends it to the 1A client;

[0079] 5-5: The communication agent of the 1A client receives the encrypted extended key file, and forwards the received encrypted extended key file to the decryption unit in the isolation area for decryption. The decryption unit transmits the decrypted extended key file to the key unit in the security area for storage.

[0080] Other access base stations request keys from their corresponding border base stations and distribute communication keys to the clients connected to them using the same steps from 5-1 to 5-5 to complete the distribution of communication keys to each client in the entire network.

[0081] Based on the above networking method, a global quantum secure virtual private network networking system can be constructed. Figure 3 shown.

[0082] The system includes a first border base station and a second border base station connected via the Internet, at least one access base station connected to the first border base station via a local area network, the access base station includes a first access base station, the system includes at least one client connected to the first access base station (for example, the 1A client, the 1B client, the 1C client, etc.), and the first access base station and the at least one client connected to the first access base station constitute a first user group. The system also includes at least one access base station connected to the second border base station via a local area network, the access base station includes a second access base station, the system includes at least one client connected to the second access base station (for example, the 2A client, the 2B client, the 2C client, etc.), and the second access base station and the at least one client connected to the second access base station constitute a second user group. Similarly, the system may also include a third access base station connected to the second border base station via a local area network, at least one client connected to the third access base station (for example, the 3A client, the 3B client, the 3C client, etc.), and the third access base station and the at least one client connected to the third access base station constitute a third user group.

[0083] It can be understood that the system may also include an nth user group connected to the first boundary base station, and an Lth user group connected to the second boundary base station.

[0084] like Figure 4 As shown, the first border base station in the system can also be connected to other border base stations, for example, the third border base station or the fourth border base station, wherein the fourth border base station is connected to the mth user group. In this way, a larger global quantum secure virtual private network networking system can be constructed through the networking method proposed in this application to serve more users.

[0085] Among them, the structure of the client in the networking system is as follows Figure 2 This structure has been described in step 3 and will not be repeated here.

[0086] The seed keys of the keys stored in each client in the networking system constructed by the above networking method are distributed to the corresponding access base station by the first boundary base station or the second boundary base station. Therefore, this networking system is a networking system based on quantum key association, and each client in the networking system communicates based on the key in the extended key file received from the access base station. The connection between the first boundary base station and the second boundary base station enables the client devices in different local area networks to have associated quantum keys, and the communications based on these associated quantum keys are all within the communication range of the networking system. In addition, the client involved in this networking method has a security zone isolated by an isolation zone. The security zone does not communicate directly with the outside world, and the outside world cannot directly connect to the security zone, so that the client's security zone is invisible to the public network and the information cannot be broken. It can be regarded as a completely invisible network environment. In this case, the key distribution and key relay in the entire networking are safe.

Claims

1. A method for establishing a global quantum secure virtual private network, characterized in that: The participants of the networking method include a first border base station, an access base station, a client, and a second border base station. The networking method includes the following steps: Step 1: The first border base station establishes a connection with the second border base station via the Internet and synchronizes the original key file; Step 2: The first border base station establishes a connection with at least one access base station through a local area network, and the second border base station establishes a connection with at least one access base station through a local area network, and the access base station obtains a communication key from the first border base station or the second border base station; Step 3: The access base station receives an access request from at least one client, determines whether the client satisfies a networking access condition based on the access request, and approves the access request in response to determining that the client satisfies the networking access condition; In response to determining that the client does not meet the networking access condition, rejecting the access request; Step 4: The access base station establishes a connection with the client via the Internet based on the indication of approving the access request; Step 5: The access base station distributes communication keys to the accessed client; The first border base station is internally or externally configured with a first true random number generator, and the second border base station is internally or externally configured with a second true random number generator; in step 1, the specific process of synchronizing the original key file is: 1-1: The first border base station generates a first set of keys based on a first true random number generator to form a first key file of length n; the second border base station generates a second set of keys based on a second true random number generator to form a second key file of length n; wherein both the first key file and the second key file are quantum keys; 1-2: The first border base station encrypts the first key file and sends it to the second border base station, and the second border base station encrypts the second key file and sends it to the first border base station; 1-3: The first border base station performs an XOR operation on the first key file and the second key file to obtain and save a third key file; the second border base station performs an XOR operation on the second key file and the first key file to obtain and save a fourth key file that is the same as the third key file; wherein the third key file and the fourth key file are original key files provided by the border base station to the access base station; In the step 3, the client satisfying the networking access conditions has a communication area, an isolation area, and a security area, wherein the communication area is provided with a communication agent for the client to communicate with the outside world and receive or send data; the isolation area is provided between the communication area and the security area, for connecting the communication area and the security area, and is provided with a decryption unit, an encryption unit, and a response unit, the decryption unit is used to decrypt data received from the communication area, the encryption unit is used to encrypt data sent from the security area, and the response unit is used to verify the data format of the inquiry statement and provide feedback on the inquiry; the security area is provided with an information processing unit and a key unit, the information processing unit is used to perform data processing in the client, and the key unit is used to store the communication key distributed by the access base station; wherein the communication agent of the communication area is respectively connected to the decryption unit and the encryption unit of the isolation area, the decryption unit of the isolation area is respectively connected to the information processing unit and the key unit of the security area, the encryption unit of the isolation area is respectively connected to the information processing unit and the key unit of the security area, and the decryption unit of the isolation area is also connected to the response unit of the isolation area; In step 3, the specific process of determining whether the client meets the networking access condition based on the access request is: 3-1: Based on the access request of the client, the access base station sends a query Q to the client, negotiates a set of communication keys k with the client, encrypts the query Q using the communication key k, and obtains a ciphertext Q⊕k, wherein the data format of the query Q is a data format recognized by the client with a secure zone, and the recipient of the query Q is the response unit in the isolation zone; 3-2: The client's communication agent transmits the received ciphertext Q⊕k to the decryption unit in the isolation area for decryption to obtain the query Q, and obtains the recipient of the query from the decrypted query Q; 3-3: The decryption unit sends the query Q to the response unit based on the receiving object of the query; 3-4: The response unit verifies the data format of the query Q. In response to successful verification, the response unit responds to the query and feeds back a yes query result, determines that the client meets the networking access conditions, and agrees to the access request. In response to failed verification, the response unit refuses to respond to the query and feeds back a null query result, determines that the client does not meet the networking access conditions, rejects the access request, and the client re-initiates an access request to the access base station.

2. The method for establishing a global quantum secure virtual private network according to claim 1, characterized in that: A key remaining amount threshold is set in the first border base station or the second border base station. When the size of the original key file is lower than the key remaining amount threshold, steps 1-1 to 1-3 are repeated.

3. The method for establishing a global quantum secure virtual private network according to claim 1, characterized in that: The specific process of step 5 is as follows: 5-1: The access base station requests a key from the first border base station or the second border base station. The first border base station or the second border base station responds to the request, selects a portion from the stored third key file or the fourth key file and sends it to the access base station as a seed key of the access base station; 5-2: After the access base station detects that a connection has been established with the client, the access base station determines the storage size of the key unit in the client; 5-3: The access base station executes an expansion algorithm for the seed key based on the storage size of the key unit in the client in step 5-2 to obtain an expanded key file that meets the storage size; 5-4: The access base station encrypts the extended key file and sends it to the client; 5-5: The communication agent of the client receives the encrypted extended key file, forwards the received encrypted extended key file to the decryption unit in the isolation zone for decryption, and the decryption unit transmits the decrypted extended key file to the key unit in the security zone for storage.

4. A networking system for a global quantum secure virtual private network, the networking system being constructed using the networking method for a global quantum secure virtual private network as claimed in any one of claims 1 to 3, characterized in that: The networking system includes a first border base station and a second border base station connected via the Internet, at least one access base station connected to the first border base station via a local area network, at least one access base station connected to the second border base station via a local area network, and at least one client connected to the access base station; The first boundary base station and the second boundary base station are used to define the boundary of the local area network, provide keys for access base stations, and provide cross-region or cross-local area network key relay and relay routing selection for communication links; The access base station is used to obtain a communication key from a border base station, determine whether a client accessing the access base station meets a networking access condition, and distribute a communication key to a client that meets the networking access condition and accesses the access base station; The client is used to carry user network communications.

5. The networking system of the global quantum secure virtual private network according to claim 4 is characterized in that: The first border base station and the second border base station are respectively configured with corresponding first true random number generators and second true random number generators inside or outside to generate original key files and provide seed keys for corresponding access base stations.

6. The networking system of the global quantum secure virtual private network according to claim 4 is characterized in that: The first border base station and / or the second border base station are connected to a plurality of access base stations, each access base station is connected to at least one client, and each access base station and at least one client connected thereto constitute a user group.

7. The networking system of the global quantum secure virtual private network according to any one of claims 4 to 6, characterized in that: In addition to the first border base station and the second border base station, the networking system includes other border base stations having the same functions as the first border base station and the second border base station.

Images