Access method of multi-quantum security network

Abstract

The invention relates to the technical field of information security, in particular to an access method of a multi-quantum security network. According to the scheme of the invention, the network address information, the key pool configuration information and the unique network access identifier of the quantum security terminal are configured, so that the terminal can select a proper access base station for data transmission, and the terminal is allowed to access a plurality of quantum security networks at the same time. The limitation that an existing global quantum security terminal can only access a single network is broken through, and the flexibility and service selection of a user in a complex application scene are remarkably improved. Through an encrypted access request and a dynamic key mechanism, data transmission is ensured to be safe and reliable when the quantum security terminal accesses a plurality of networks.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for accessing a multi-quantum security network. Background Art

[0002] With the development of quantum communication technology, quantum security networks have gradually become an important means of ensuring information security. However, due to geographical, network environment or management factors, users often establish multiple independent quantum security networks. These networks are not interconnected, forming their own independent quantum security environments. However, for some users, it may be necessary to access multiple quantum security networks at the same time to obtain services, or even require these networks to provide services in collaboration.

[0003] Existing global quantum security services usually rely on global quantum security terminals to access a global quantum security network and then provide services through this network. In this case, regional quantum security terminals can usually only access one global quantum security network. This single access method limits the flexibility of users when multiple quantum security networks are needed to provide services at the same time, and cannot meet the needs of some complex application scenarios.

[0004] Therefore, how to enable quantum security terminals to access multiple quantum security networks at the same time has become an urgent problem to be solved. In order to solve this problem, this patent proposes a method for accessing multiple quantum security networks. By configuring the network address information and key pool configuration information of the quantum security terminal, it can effectively access and manage multiple quantum security networks, thereby meeting the user's multiple service needs. Summary of the invention

[0005] To solve the above problems, the present application discloses a method for accessing a multi-quantum security network, comprising the following steps:

[0006] During the access process, the quantum security terminal is configured with the network address information and key pool configuration information of the access device corresponding to the quantum security network, and the key pool configuration information is matched with the initial key of the quantum security terminal to form a paired communication key;

[0007] The access authentication step includes: the quantum security terminal sends an access request carrying authentication information to the access device, and encrypts the access request using a communication key matching the access device;

[0008] Forward the authentication information from the quantum security terminal to the authentication center through the access device;

[0009] The access device determines whether to allow access based on the authentication result response message of the authentication center; and when access is allowed, a unique network access identifier in the quantum security network is allocated to the quantum security terminal;

[0010] When accessing multiple quantum security networks, the quantum security terminal accesses the corresponding quantum security network based on the network address information of the access device and the paired communication key in each quantum security network, as well as the assigned unique network access identifier.

[0011] The method further includes: presetting multiple initial communication keys and authentication information for the quantum security terminal, wherein the multiple initial communication keys are respectively matched with the local key pool of the access device corresponding to the quantum security network to support encrypted communication during the access process.

[0012] The authentication information includes device identity information and an identity verification key, and the quantum security terminal is uniquely identified by the device identity information and the identity verification key.

[0013] In the specific scheme, the communication process of the quantum security terminal specifically includes:

[0014] Forwarding access data to the quantum encryption module of the quantum security terminal;

[0015] The quantum encryption module matches the corresponding destination network access identifier R ID' according to the destination address of the access data, and selects the corresponding access device based on the network access identifier, wherein the network access identifier includes a prefix part and a device identification part. In the quantum secure network, the prefix is ​​the quantum secure network location information, and the device identification is the access device identification.

[0016] In the above scheme, the process of selecting the corresponding access device includes:

[0017] Search and match the existing multiple network access identifiers RID to determine the following situations:

[0018] If the destination network access identifier RID' matches the quantum security network location information in the network access identifier R ID assigned by the current quantum security terminal, the corresponding access device in the current quantum security network is selected as the key relay base station;

[0019] Otherwise, the configured routing strategy is matched to select the access device in the corresponding quantum security network as the key relay base station.

[0020] The process of matching and selecting the access device in the corresponding quantum security network as the key relay base station according to the configured routing strategy specifically includes:

[0021] According to the destination network access identifier RID', find a policy that best matches the destination network access identifier RID'; in the policy, select the prefix that matches the destination network access identifier RID' the longest;

[0022] Selecting an access device identifier according to the routing strategy;

[0023] Determine whether the access device identifier is the same as the access device identifier of one of the network access identifiers currently assigned to the quantum security terminal;

[0024] If they are the same, the access device is selected as the key relay base station for this application service;

[0025] If they are not the same, the matching continues according to the network access identifier prefix and the secondary length matching principle until an access device identifier that matches the assigned network access ID is matched, and the key relay base station of the access device is selected to serve this application;

[0026] If an access device is still not selected after matching all routing strategies, it is determined that the destination service accessed by this application is not under the quantum security network that can be relayed by any access device currently accessed by the quantum security terminal, and the request is rejected.

[0027] In the above scheme, the communication key is a quantum true random number key.

[0028] The solution of this application configures the network address information, key pool configuration information, and unique network access identification of the quantum security terminal, so that the terminal can select the appropriate access base station for data transmission, allowing the terminal to access multiple quantum security networks at the same time. It breaks the limitation that the existing global quantum security terminal can only access a single network, and significantly improves the flexibility and service selection of users in complex application scenarios. Through encrypted access requests and dynamic key mechanisms, the data transmission of quantum security terminals when accessing multiple networks is ensured to be secure and reliable. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of a method for accessing a multi-quantum secure network in an embodiment of the present application;

[0030] Figure 2 This is a flow chart of the method for access authentication in an embodiment of the present application;

[0031] Figure 3 This is a flow chart of the communication method of the quantum security terminal in the embodiment of the present application;

[0032] Figure 4 This is a flow chart of a method for selecting an access device in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0034] Example 1: Figure 1 As shown, a method for accessing a multi-quantum security network comprises the following steps:

[0035] S101: During the access process, the network address information and key pool configuration information of the access device corresponding to the quantum security network are configured for the quantum security terminal, and the key pool configuration information is matched with the initial key of the quantum security terminal to form a paired communication key;

[0036] Wherein, the communication key is a quantum true random number key;

[0037] In this step, necessary network parameters and keys are provided to the quantum security terminal to ensure secure communication. In the quantum security network, quantum true random number keys generated by a quantum random number generator (QRNG) are used to encrypt communication data. Quantum true random number keys have quantum true randomness and are difficult to predict or copy.

[0038] The network address information and key pool configuration information of the access device are configured into the quantum security terminal, while ensuring that the key in the key pool matches the initial key of the quantum security terminal for subsequent secure communication.

[0039] S102: The quantum security terminal executes the access authentication process and obtains the network access identifier;

[0040] like Figure 2 As shown, the access authentication step includes:

[0041] S111: The quantum security terminal sends an access request with authentication information to the access device, and encrypts the access request using a communication key matching the access device;

[0042] Specifically, the quantum security terminal constructs an access request message, which contains the device's identity information, request type (such as access network) and other necessary authentication information (such as timestamp, device ID, etc.); uses the communication key that matches the access device to encrypt the access request message, and uses a symmetric encryption algorithm, such as AES (Advanced Encryption Standard), to ensure the confidentiality of the request content; sends the encrypted request message to the access device;

[0043] S112: Forwarding the authentication information from the quantum security terminal to the authentication center through the access device;

[0044] The access device receives the encrypted access request message from the quantum security terminal, decrypts the access request message using the same communication key as the quantum security terminal, and extracts the authentication information; the authentication information is added to a new request message and is ready to be sent to the authentication center;

[0045] S113: The access device determines whether to allow access based on the authentication result response message of the authentication center; and when access is allowed, allocates a unique network access identifier in the quantum security network to the quantum security terminal;

[0046] After receiving the access request message, the authentication center verifies the authentication information, including checking the identity, the validity of the timestamp, and whether it is on the blacklist; based on the authentication result, a response message is generated to indicate whether access is allowed, and if allowed, a unique network access identifier is assigned to the quantum security terminal;

[0047] S103: When accessing multiple quantum secure networks, the quantum secure terminal accesses the corresponding quantum secure network according to the network address information of the access device and the paired communication key in each quantum secure network, as well as the assigned unique network access identifier.

[0048] With accurate network address information, quantum security terminals can locate and access specific quantum security networks. Encryption and key management mechanisms significantly improve the security of the entire network and reduce the risk of potential network attacks. Only verified terminals can successfully access, thereby protecting network resources. Each quantum security terminal is assigned a unique network access identifier to facilitate subsequent management and monitoring, ensuring that the identity of any device in the network can be traced, and enhancing the controllability and responsibility traceability of the network.

[0049] The method further includes: presetting multiple initial communication keys and authentication information for the quantum security terminal, wherein the multiple initial communication keys are respectively matched with the local key pool of the access device corresponding to the quantum security network to support encrypted communication during the access process.

[0050] In a possible implementation, the initial communication key can be manually preset offline when it is necessary to access the quantum secure network.

[0051] The authentication information includes device identity information and authentication key, and the device identity information and authentication key are used to uniquely identify the quantum security terminal. Assume that the quantum security terminal model is QTerm-1001. Its authentication information may include: device identity information: device ID: QTerm-1001-XYZ123, serial number: SN-987654321, manufacturer information: QuantumTech I nc. Registration time: 2023-01-15;

[0052] Authentication Key: K123456789ABCDEFG (This is a security key generated for this terminal)

[0053] When accessing a quantum secure network, the quantum secure terminal will send the above authentication information (device identity information and authentication key) to the network's access device. The access device will check whether the device identity information matches the record in its database and whether the authentication key is correct to ensure that the request comes from a legitimate terminal.

[0054] In one possible implementation, the identity authentication key of the quantum security device is preset at the factory, generated by a quantum true random number generator (QRNG), and protected using symmetric encryption. At the same time, the authentication center also securely stores the hash value of the identity key (for example, using SHA-256) in the database instead of directly storing the complete key.

[0055] When performing identity authentication, the identity key is encrypted and sent to the authentication center. The user can choose to use symmetric key encryption (such as AES) to process the identity key. After receiving the encrypted identity key, the authentication center decrypts the key. In order to facilitate decryption, the authentication center needs to know the corresponding symmetric key (which can be a pre-shared secure channel). After decryption, the authentication center calculates the hash value of the identity key and compares it with the hash value stored in the database.

[0056] In another possible implementation, to further improve the security of the verification process, during the authentication process, the user first enters his username and password, the system generates an identity key (using QRNG), and encrypts it with the random number through XOR during the login process;

[0057] The access device sends the encrypted identity key (ciphertext) to the authentication center;

[0058] After receiving the encrypted identity key, the authentication center uses the stored random number to perform XOR decryption to obtain the original identity key, and calculates its hash value to compare with the stored hash value;

[0059] If the initial verification is successful, the system generates a one-time verification code (OTP) and sends it to the user via the pre-registered mobile number or email;

[0060] The user enters the received OTP on the login page;

[0061] After receiving the OTP, the authentication center compares it with the generated OTP. If they match and the user's password and identity key are also correct, the identity key verification is successful.

[0062] Example 2: Figure 3 As shown in the figure, the communication process of the quantum security terminal specifically includes:

[0063] S201: forwarding the access data to the quantum encryption module of the quantum security terminal;

[0064] The quantum security terminal generates access data to be transmitted and sends it to the quantum encryption module of the quantum security terminal. In this step, the data can be sensitive information such as user credentials, transaction data or other confidential information;

[0065] S202: The quantum encryption module matches the corresponding destination network access identifier RID' according to the destination address of the access data, and selects the corresponding access device based on the network access identifier, wherein the network access identifier includes a prefix part and a device identification part. In the quantum secure network, the prefix is ​​the quantum secure network location information, and the device identification is the access device identification;

[0066] After receiving the access data, the quantum encryption module first parses the destination address in the data and matches the destination address with the preset network access identifier (RID'). Based on the matching network access identifier, the quantum encryption module selects the corresponding access device to ensure that the data can be transmitted through the correct channel. According to the network access identifier, the quantum encryption module identifies and selects the appropriate access device. This device will act as a relay station for the transmission of quantum keys. The target device receives the quantum key from the access device and uses the key to decrypt the received encrypted data.

[0067] During this process, the quantum security terminal can instantly identify and verify the identity of the target device, ensuring that the information is only received by authorized devices.

[0068] In the above scheme, the process of selecting the corresponding access device includes:

[0069] Search and match the existing multiple network access identifiers RID to determine the following situations:

[0070] If the destination network access identifier RID' matches the quantum security network location information in the network access identifier R ID assigned by the current quantum security terminal, the corresponding access device in the current quantum security network is selected as the key relay base station;

[0071] Case 1: If the prefix part of the destination network access identifier RID' matches the prefix part of the network access identifier RID of the current quantum security terminal. If the match is successful, the quantum security terminal will select the corresponding access device in the current network as the key relay base station to ensure that the data is transmitted within the same quantum security network, thereby providing higher security and efficiency.

[0072] Otherwise, the configured routing strategy is matched to select the access device in the corresponding quantum security network as the key relay base station.

[0073] If the prefix part of the destination network access identifier R ID' does not match the network access identifier RID of the current quantum security terminal, in this case, the quantum security terminal will search for a suitable access device as a key relay base station according to the configured routing strategy (such as shortest path, minimum delay, load balancing, etc.).

[0074] The terminal evaluates the available access devices according to the preset strategy and selects the best device for key relay.

[0075] Once the corresponding access device is selected, the quantum security terminal will relay the quantum key through the device to ensure the encryption and secure transmission of the data.

[0076] Further, such as Figure 4 As shown, the process of matching and selecting the access device in the corresponding quantum security network as the key relay base station according to the configured routing strategy specifically includes:

[0077] S401: according to the destination network access identifier RID', find a policy that best matches the destination network access identifier RID'; in the policy, select the prefix that matches the destination network access identifier RID' the longest;

[0078] Receive the destination network access identifier RID', traverse the configured routing strategies, and find the strategy that best matches the destination network access identifier RID'. Among these strategies, select the strategy that has the longest prefix match with the destination network access identifier RID' to maximize the matching degree;

[0079] S402: Selecting an access device identifier according to the routing strategy;

[0080] Determine whether the access device identifier is the same as the access device identifier of one of the network access identifiers currently assigned to the quantum security terminal;

[0081] If they are the same, the access device is selected as the key relay base station for this application service;

[0082] If they are not the same, the matching continues according to the network access identifier prefix and the secondary length matching principle until an access device identifier that matches the assigned network access ID is matched, and the key relay base station of the access device is selected to serve this application;

[0083] According to the prefix of the network access ID, other access device IDs are searched according to the second longest match first principle. In all available strategies, the matching is continued until an access device ID matching the currently assigned network access ID is found.

[0084] If an access device is still not selected after matching all routing strategies, it is determined that the destination service accessed by this application is not under the quantum security network that can be relayed by any access device currently accessed by the quantum security terminal, and the request is rejected.

[0085] Exemplarily, it is assumed that the content of the network access identification (RID) includes: country code (Country Code): 86 (China); cell code (Ce ll Code): 001 (indicating a specific cell or area); access device identification (Device Identif ier): A1 B2C3 (uniquely identifies the access device).

[0086] The complete network identification RID is: RID:86-001-A1 B2C3

[0087] The user initiates a data access request on the quantum security terminal, and the access data is forwarded through the terminal to the quantum encryption module (which can be an encryption module based on quantum true random numbers as encryption keys).

[0088] The quantum encryption module receives the access data and identifies the destination network access identifier R ID' according to the destination address of the data (assuming it is "86-001-D4E5F6").

[0089] Destination network access identifier RID'=86-001-D4E5F6

[0090] The quantum security terminal compares the currently allocated network access identifier R ID (assuming it is "86-001-A1 B2C3") with the prefix part of the destination network access identifier R ID'.

[0091] Prefix match: The prefix "86-001" of both matches.

[0092] Since the prefix matching is successful, the quantum security terminal selects access devices A1 B2C3 in the current quantum security network as key relay base stations.

[0093] The system further determines whether the access device identifier A1 B2C3 is the same as the access device identifier in the network access identifier currently assigned to the quantum security terminal.

[0094] Matching success: The access device IDs are the same, and the device is selected as the key relay base station for this application service.

[0095] The quantum security terminal completes the relay of encryption keys through the selected access device, thereby securely transmitting the access data to the destination.

[0096] In a possible implementation, the network access identifier may include a quantum true random number to enhance uniqueness and security. Specifically, it includes: Country code: For example, the country code (such as 86 for China) Cell code: A unique number that identifies a network cell Access device identifier: A unique identifier that represents a specific access device Quantum random number: A random number (e.g., 128 bits) generated by a quantum true random number generator.

[0097] For example, 86-001-A1 B2C3-QR1234567890ABCDEF

[0098] Each time an access request is made, a new quantum true random number is generated to encrypt the random number part of the network access identification to form an updated network access identification, which is synchronized between the quantum security terminal and the access device.

[0099] The random numbers generated by the quantum true random number generator are highly unpredictable and unique, which can effectively prevent conflicts and ensure that each network access ID is unique. A new random number is generated for each access request to update the corresponding network access ID, so that even if multiple devices try to access at the same time, different IDs can be generated, reducing the risk of ID reuse.

[0100] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for accessing a multi-quantum security network, characterized in that: The following steps are involved: During the access process, the quantum security terminal is configured with the network address information and key pool configuration information of the access device corresponding to the quantum security network, and the key pool configuration information is matched with the initial key of the quantum security terminal to form a paired communication key; The access authentication step includes: the quantum security terminal sends an access request carrying authentication information to the access device, and encrypts the access request using a communication key matching the access device; Forward the authentication information from the quantum security terminal to the authentication center through the access device; The access device determines whether to allow access based on the authentication result response message of the authentication center; and when access is allowed, a unique network access identifier in the quantum security network is allocated to the quantum security terminal; When accessing multiple quantum security networks, the quantum security terminal accesses the corresponding quantum security network based on the network address information of the access device and the paired communication key in each quantum security network, as well as the assigned unique network access identifier.

2. The method according to claim 1, characterized in that: The method also includes: presetting a plurality of initial communication keys and authentication information for the quantum security terminal, wherein the plurality of initial communication keys are respectively matched with a local key pool of an access device corresponding to the quantum security network to support encrypted communication during the access process.

3. The method according to claim 1 or 2, characterized in that: The authentication information includes device identity information and an identity verification key, and the quantum security terminal is uniquely identified by the device identity information and the identity verification key.

4. The method according to claim 1, characterized in that: The communication process of the quantum security terminal specifically includes: Forwarding access data to the quantum encryption module of the quantum security terminal; The quantum encryption module matches the corresponding destination network access identifier RID' according to the destination address of the access data, and selects the corresponding access device based on the network access identifier, wherein the network access identifier includes a prefix part and a device identification part. In the quantum secure network, the prefix is ​​the quantum secure network location information, and the device identification is the access device identification.

5. The method according to claim 4, characterized in that: The process of selecting the corresponding access device includes: Search and match the existing multiple network access identifiers RID to determine the following situations: If the destination network access identifier RID' matches the quantum security network location information in the network access identifier RID assigned by the current quantum security terminal, the corresponding access device in the current quantum security network is selected as the key relay base station; Otherwise, the configured routing strategy is matched to select the access device in the corresponding quantum security network as the key relay base station.

6. The method according to claim 5, characterized in that: The process of matching and selecting the access device in the corresponding quantum security network as the key relay base station according to the configured routing strategy specifically includes: According to the destination network access identifier RID', find a policy that best matches the destination network access identifier RID'; in the policy, select the prefix that matches the destination network access identifier RID' the longest; Selecting an access device identifier according to the routing strategy; Determine whether the access device identifier is the same as the access device identifier of one of the network access identifiers currently assigned to the quantum security terminal; If they are the same, the access device is selected as the key relay base station for this application service; If they are not the same, the matching continues according to the network access identifier prefix and the secondary length matching principle until an access device identifier that matches the assigned network access ID is matched, and the key relay base station of the access device is selected to serve this application; If an access device is still not selected after matching all routing strategies, it is determined that the destination service accessed by this application is not under the quantum security network that can be relayed by any access device currently accessed by the quantum security terminal, and the request is rejected.

7. The method according to claim 1, characterized in that: The communication key is a quantum true random number key.

Images