All-domain quantum security network terminal nearby access method

Abstract

The invention relates to a global quantum security network terminal nearby access method. According to the scheme of the invention, the terminal initiates the access request to the base station position management server, and the base station position management server can quickly match the access base station closest to the terminal, so that the access efficiency is remarkably improved, and the waiting time is shortened. In the access request process, the terminal carries its RID into the request, so that the base station can identify and verify the identity of the terminal. And when the terminal is switched from one base station to another base station, the RID of the terminal is used for initiating a roaming request to the target access base station. And the target base station carries the RI D to request related terminal parameter information from the original access base station so as to ensure that the identity and the state of the terminal can be correctly identified and managed in the roaming process. The terminal network access identifier and the base station network access identifier complement each other in the base station access process, so that smooth implementation of identity recognition, roaming management, security authentication and key management is ensured.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for local access of global quantum security network terminals. Background Art

[0002] In a global quantum secure network, for example, the contents disclosed in the patent application document entitled "A Key Relay Method for a Quantum Secure Network" with Chinese patent application number CN202211125550.7, and the patent application document entitled "Quantum secure communication method, apparatus, device and medium based on network access identification" with Chinese patent application number CN202310226846.6, the key to global quantum secure communication between any two terminals is to relay keys through their respective access base stations to achieve pairing keys between the two terminals, thereby conducting quantum secure encrypted communication.

[0003] However, the mobility of terminal devices means that they may establish connections with different access base stations. These access base stations may be located in distant geographical locations, which means that the key relay needs to take a very roundabout path to reach the target terminal. This roundabout transmission not only increases the latency and bandwidth burden of the key relay, but may also cause a large amount of ciphertext to wait for the key, significantly reducing the user experience.

[0004] Therefore, how to achieve the nearest access of terminals, thereby optimizing the key relay path, reducing communication delays and bandwidth consumption, has become an urgent problem to be solved. To this end, the present invention proposes a method for the nearest access of terminals in a global quantum security network to improve the efficiency of the network and the user experience. Summary of the invention

[0005] To solve the above problems, the present application discloses a method for local access of global quantum security network terminals, comprising the following steps:

[0006] The terminal initiates a base station access request to the base station location management server, and carries the original network access identifier RID and the terminal geographic location parameters in the request;

[0007] The base station location management server matches the access base station closest to the terminal as the target access base station according to the terminal geographic location parameters, and returns the base station network identification BID corresponding to the target access base station to the terminal as a result;

[0008] The terminal constructs domain name query information according to the base station network access identifier BID, and queries the quantum secure domain name server for the address information of the target access base station;

[0009] The quantum secure domain name server performs an IP query based on the domain name query information and returns the corresponding target base station IP address to the terminal;

[0010] The terminal initiates an access request to the target access base station according to the acquired target base station IP address, and carries the original network access identifier R ID;

[0011] The target access base station receives the access request of the terminal, initiates a roaming request to the original access base station, and carries the original network access identifier RID of the terminal;

[0012] The original access base station matches the parameter information of the terminal according to the original network access identifier RID, and returns the parameter information to the target access base station, where the parameter information includes identity information, authentication information and a partial symmetric quantum key corresponding to the terminal, where the partial symmetric key is a key for pairing the original access base station with the terminal;

[0013] The target access base station authenticates the terminal according to the acquired parameter information, and returns an access response message to the terminal. After the authentication is passed, it carries the quantum key synchronization data from the original access base station.

[0014] After receiving the access response, the terminal synchronizes the local key according to the quantum key synchronization data; and establishes a symmetric quantum key with the target access base station to carry out quantum secure communication.

[0015] Furthermore, the terminal initiates a supplementary key process to a key center assigned to the target access base station through the target access base station; and uses the target access base station to relay the quantum key.

[0016] The terminal geographic location parameters include the terminal's communication IP, GPS or Beidou positioning information.

[0017] In a specific solution, the base station location management server stores the network access identification and location value corresponding to each access base station, and the location value is the geographical location corresponding to the IP or the GPS, Beidou positioning location.

[0018] The method for constructing a domain name is: arranging the base station code BS I, the cell code SC I, the regional code LCI, the operator code NC, the country code CC and the quantum security suffix aaqs in sequence to form domain name query information.

[0019] The quantum key synchronization data includes quantum key quantity information and quantum key information. The terminal eliminates the used symmetric quantum keys according to the quantum key synchronization data and retains the unused quantum keys.

[0020] In the above scheme, the process of the target access base station authenticating the terminal according to the acquired parameter information includes:

[0021] The terminal sends the identity information and authentication information to be verified to the target access base station in encrypted form, and carries the index information corresponding to the quantum key used for encryption;

[0022] The target access base station matches the corresponding decryption key in the partial symmetric quantum key returned by the original access base station to the target access base station according to the index information, thereby decrypting and obtaining the identity information and authentication information to be verified, and comparing them with the identity information and authentication information in the obtained parameter information to determine whether the authentication is successful.

[0023] The solution of this application is to initiate an access request from the terminal to the base station location management server, and the base station location management server can quickly match the access base station closest to the terminal, thereby significantly improving access efficiency and reducing waiting time. By matching the geographical location parameters of the terminal, it can ensure that the terminal is always connected to the optimal base station, optimize the use of network resources, and improve user experience.

[0024] During the access request process, the terminal will carry its RID in the request so that the base station can identify and verify the identity of the terminal. When the terminal switches from one base station to another, the terminal's RID will be used to initiate a roaming request to the target access base station. The target base station will carry the RID to request the original access base station for relevant terminal parameter information to ensure that the identity and status of the terminal can be correctly identified and managed during the roaming process. The terminal access identification and the base station access identification complement each other in the base station access process, ensuring the smooth progress of identity identification, roaming management, security authentication and key management, thereby achieving secure and efficient network access. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flow chart of the terminal nearby access method in an embodiment of the present application;

[0026] Figure 2 This is a flow chart of the authentication method in an embodiment of the present application;

[0027] Figure 3 This is a timing diagram of the terminal proximity access method in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0029] Example 1: Figure 1 and 3As shown, a method for local access of a terminal in a global quantum security network is applied to when a terminal moves to a new location far away from the geographical location of the original access base station, reselects a new nearby access base station, and migrates the access to the old base station (hereinafter referred to as the original access base station) to the new access base station (hereinafter referred to as the target access base station), and quickly relays the key for the terminal through the new access base station (transmits the quantum key used for encryption to the receiving end through the access base station);

[0030] The specific steps include:

[0031] S101: The terminal initiates a base station access request to the base station location management server, and carries the original network access identifier RID and the terminal geographic location parameter in the request;

[0032] When a terminal initiates a request to access a base station, in addition to providing the original network access identifier RID, it must also include the terminal's geographic location parameters; these geographic location parameters may include the terminal's communication IP address, or more accurate positioning information, such as positioning data provided by the Global Positioning System (GPS) or the Beidou satellite navigation system; the base station location management server will maintain a record table that contains the network access ID of each access base station (the complete sequence of the ID from the country code to the base station identifier BID), and the location values ​​corresponding to these base stations; the location value can be the geographic location corresponding to the IP address, or the precise geographic location information obtained through the GPS or Beidou system according to the situation;

[0033] S102: The base station location management server matches the access base station closest to the terminal as the target access base station according to the terminal geographic location parameters, and returns the base station network identification BID corresponding to the target access base station to the terminal as a result;

[0034] After receiving the access base station request initiated by the terminal, the base station location management server (BLR) uses the geographical location parameters provided by the terminal to match the access base station closest to it. This process involves comparing the geographical location of the terminal with the geographical locations of various access base stations to determine the nearest access base station; then, the server will take the base station access identifier BID of the selected target access base station as the response result and return it to the terminal to complete the sending of the access base station response message;

[0035] S103: The terminal constructs domain name query information according to the base station network access identifier BID, and queries the quantum secure domain name server for the address information of the target access base station;

[0036] After receiving the access base station response message returned by the base station location management server (BLR), the terminal uses the base station network identification BID contained in the response to construct domain name query information; the query information is used to initiate a query to the global quantum secure domain name server to obtain the address information of the target access base station;

[0037] The constructed domain name format follows a specific structure, where the top-level location information is placed at the end of the domain name; the BID consists of the following parts: country code (CC), operator code (NC), large region code (LCI), cell code (SCI) and base station code (BSI); therefore, the constructed domain name format is as follows: xxxBI.yyySCI.zzzLCI.vvvNC.cccCC.aaqs

[0038] Among them, xxx, yyy, zzz, vvv, and ccc are the specific values ​​of the country code CC, operator code NC, regional code LCI, cell code SCI, and base station code BSI respectively. aaqs is the global quantum security suffix, which is similar to the com / net Internet domain name suffix. The constructed domain name format follows a specific structure and provides a standardized way to describe base station information, which facilitates interoperability between different systems and devices.

[0039] The terminal network identification RID includes the country code (CC), operator code (NC), large area code (LCI), cell code (SCI), base station code (BSI, the access base station currently or previously connected to the terminal) and terminal code (DID);

[0040] Among them, the country code (CC) indicates the country where the terminal is located, supports international communications and roaming, and ensures that the system can correctly identify the terminal's geographical location.

[0041] Carrier Code (NC): provides information about the mobile network operator to which the terminal is connected, helps to distinguish different network service providers in the same country, and supports management and coordination between operators;

[0042] Large cell code (LCI), small cell code (SCI) and base station code (BSI): These hierarchical identification information can help accurately locate the terminal's access base station and its area, and help optimize the allocation and use of base station resources; the terminal code (DID) is a unique identifier for the terminal, allowing the network to quickly identify and manage the status and information of each terminal; because the RID contains various network-related information, the terminal can quickly find the nearest access base station when moving to a new location to ensure that its communication is not interrupted. When the network environment changes (such as changes in base station load and signal strength), the system can quickly respond and adjust the connection through the RID to improve the user experience. In addition, the information in the RID can be used to authenticate the terminal to ensure that only legitimate terminals can access the network and can exchange keys securely with the base station.

[0043] By constructing domain name query information, the terminal can quickly initiate a request to the quantum security domain name server to obtain the address information of the target access base station; the domain name format contains multiple levels of information (such as country code, operator code, etc.), making the query clearer and more efficient, which is conducive to the server's rapid positioning and resolution. The terminal may frequently switch base stations. By querying the address information of the target access base station in real time, the terminal can quickly adapt to the changing network environment and maintain a stable connection. When the base station location changes or the network conditions change, the terminal can instantly obtain the latest base station information to ensure communication quality.

[0044] S104: The quantum secure domain name server performs an IP query based on the domain name query information and returns the corresponding target base station IP address to the terminal;

[0045] S105: The terminal initiates an access request to the target access base station according to the acquired target base station IP address, and carries the original network access identifier RID;

[0046] S106: The target access base station receives the access request of the terminal, initiates a roaming request to the original access base station, and carries the original access identifier RID of the terminal;

[0047] S107: The original access base station matches the parameter information of the terminal according to the original network access identifier RID, and returns the parameter information to the target access base station, where the parameter information includes identity information, authentication information and a partial symmetric quantum key corresponding to the terminal, where the partial symmetric key is a key paired between the original access base station and the terminal;

[0048] After receiving the access request from the terminal, the original access base station (BSo) matches and retrieves the context information of the terminal according to the original access identifier RID of the terminal to obtain the corresponding parameter information, and then returns the parameter information to the target access base station (BSn). The parameter information includes the identity information, authentication information and part of the symmetric quantum key of the terminal. The symmetric key is the key generated by the pairing between the original access base station and the terminal; in this way, the target access base station can obtain the necessary information to complete the access and subsequent communication of the terminal;

[0049] S108: The target access base station authenticates the terminal according to the acquired parameter information, and returns an access response message to the terminal. After the authentication is passed, the message carries the quantum key synchronization data from the original access base station.

[0050] S109: After receiving the access response, the terminal synchronizes the local key according to the quantum key synchronization data; and establishes a symmetric quantum key with the target access base station to perform quantum secure communication.

[0051] Quantum key synchronization data includes key quantity (the number of available quantum keys) and key information (the index corresponding to the specific used key);

[0052] During the synchronization process, the terminal can accurately identify and remove these used keys through the index provided in the key information to ensure that they are not reused;

[0053] After eliminating the used keys, the terminal extracts the unused quantum keys from the quantum key synchronization data; the extracted unused quantum keys are added to the local key storage, thereby updating the available symmetric quantum keys.

[0054] Through synchronization operations, the terminal can use the latest unused quantum key to establish a new symmetric quantum key with the target access base station to achieve quantum secure communication.

[0055] Conduct quantum secure communication: After completing key synchronization, the terminal can ensure communication security and use the updated key to conduct secure data transmission with the base station to ensure the confidentiality and integrity of information. In this way, the terminal can effectively manage local keys and ensure that the keys used are the latest and valid, thereby improving the security of quantum communication.

[0056] Furthermore, the terminal initiates a supplementary key process to a key center assigned to the target access base station through the target access base station; and uses the target access base station to relay the quantum key.

[0057] The terminal geographic location parameters include the terminal's communication IP, GPS or Beidou positioning information.

[0058] In a specific solution, the base station location management server stores the network access identification and location value corresponding to each access base station, and the location value is the geographical location corresponding to the IP or the GPS, Beidou positioning location.

[0059] The method for constructing a domain name is: arranging the base station code BSI, the cell code SCI, the regional code LCI, the operator code NC, the country code CC and the quantum security suffix aaqs in sequence to form domain name query information.

[0060] The quantum key synchronization data includes the quantum key quantity information and the quantum key content. After receiving the access response, the terminal removes the used symmetric quantum key according to the quantum key synchronization data and retains the unused quantum key, so as to establish a new symmetric quantum key with the target access base station, thereby realizing quantum secure communication.

[0061] The solution of this embodiment quickly locates the nearest access base station, so that the terminal can quickly complete access after moving to a new location, reducing the long connection time and making the user experience smoother. The use of quantum keys for encrypted communication ensures the confidentiality and integrity of data transmission. Even in high-risk environments, the characteristics of quantum keys can effectively prevent eavesdropping and man-in-the-middle attacks. By synchronizing quantum key data, the terminal can update the local key in real time. This means that the terminal can avoid using leaked or outdated keys, improving overall security.

[0062] In this embodiment, the terminal access identification (RID) provides a unique identifier for each terminal, so that the terminal information can be effectively tracked and managed during the entire access process; it ensures that the system can accurately identify each terminal and will not cause confusion even in a dynamic network environment; through the RID, the original access base station can quickly match and retrieve context information related to the terminal, including identity information, authentication information, and keys, etc. The correlation between the RID and the context information enables the terminal information to be quickly obtained during the access process, reducing the delay in information transmission. In the process where the terminal needs to migrate from one base station to another, the RID makes this process flexible and efficient. The terminal can quickly restore the previous session state in the new access base station to ensure the continuity of communication.

[0063] The RID of the terminal and the BID of the base station form an efficient information flow throughout the access process. The RID is used to identify the context information of the terminal, while the BID ensures that the terminal can quickly find a suitable base station. In different network environments, the terminal can quickly adapt to new base stations. The combination of RID and BID ensures fast switching between different access points, ensuring the stability and reliability of communication.

[0064] Example 2: Figure 2As shown, the process of the target access base station authenticating the terminal according to the acquired parameter information includes:

[0065] S201: The terminal sends the identity information and authentication information to be verified to the target access base station in encrypted form, and carries the index information corresponding to the quantum key used for encryption;

[0066] The terminal generates identity information (such as user ID, device serial number, etc.) and authentication information (such as password, token, etc.) to be verified; encrypts them using the quantum key stored in the terminal, and generates index information corresponding to the quantum key used for encryption;

[0067] The terminal sends the encrypted identity and authentication information to the target access base station, along with the corresponding index information;

[0068] S202: The target access base station matches the corresponding decryption key in the partial symmetric quantum key returned to the target access base station by the original access base station according to the index information, decrypts the key to obtain the identity information and authentication information to be verified, and compares the key with the identity information and authentication information in the obtained parameter information to determine whether the authentication is successful;

[0069] After receiving the encrypted information, the target access base station uses the index information to match the corresponding decryption key in the partial symmetric quantum key returned by the original access base station, and uses the decryption key to decrypt the encrypted identity and authentication information; the decrypted identity and authentication information are compared with the parameter information stored by the target access base station (such as the previously saved identity information and authentication information); if the two match, the authentication is successful; otherwise, the authentication fails.

[0070] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for local access of global quantum security network terminals, characterized in that: The following steps are involved: The terminal initiates a base station access request to the base station location management server, and carries the original network access identifier RID and the terminal geographic location parameters in the request; The base station location management server matches the access base station closest to the terminal as the target access base station according to the terminal geographic location parameters, and returns the base station network identification BID corresponding to the target access base station to the terminal as a result; The terminal constructs domain name query information according to the base station network access identifier BID, and queries the quantum secure domain name server for the address information of the target access base station; The quantum secure domain name server performs an IP query based on the domain name query information and returns the corresponding target base station IP address to the terminal; The terminal initiates an access request to the target access base station according to the acquired target base station IP address, and carries the original network access identifier RID; The target access base station receives the access request of the terminal, initiates a roaming request to the original access base station, and carries the original network access identifier RID of the terminal; The original access base station matches the parameter information of the terminal according to the original network access identifier RID, and returns the parameter information to the target access base station, where the parameter information includes identity information, authentication information and a partial symmetric quantum key corresponding to the terminal, where the partial symmetric key is a key for pairing the original access base station with the terminal; The target access base station authenticates the terminal according to the acquired parameter information, and returns an access response message to the terminal. After the authentication is passed, it carries the quantum key synchronization data from the original access base station. After receiving the access response, the terminal synchronizes the local key according to the quantum key synchronization data; and establishes a symmetric quantum key with the target access base station to carry out quantum secure communication.

2. The method according to claim 1, characterized in that The terminal initiates a supplementary key process to a key center assigned to the target access base station through the target access base station; and uses the target access base station to relay the quantum key.

3. The method according to claim 1, characterized in that The terminal geographic location parameters include the communication IP, GPS or Beidou positioning information of the terminal.

4. The method according to claim 1, characterized in that The base station location management server stores the network access identifier and location value corresponding to each access base station, and the location value is the geographical location corresponding to the IP or the GPS or Beidou positioning location.

5. The method according to claim 1, characterized in that The method for constructing a domain name is: arranging the base station code BSI, the cell code SCI, the regional code LCI, the operator code NC, the country code CC and the quantum security suffix aaqs in sequence to form domain name query information.

6. The method according to claim 1, characterized in that The quantum key synchronization data includes quantum key quantity information and quantum key information. The terminal eliminates the used symmetric quantum keys according to the quantum key synchronization data and retains the unused quantum keys.

7. The method according to claim 1, characterized in that The process of the target access base station authenticating the terminal according to the acquired parameter information includes: The terminal sends the identity information and authentication information to be verified to the target access base station in encrypted form, and carries the index information corresponding to the quantum key used for encryption; The target access base station matches the corresponding decryption key in the partial symmetric quantum key returned by the original access base station to the target access base station according to the index information, thereby decrypting and obtaining the identity information and authentication information to be verified, and comparing them with the identity information and authentication information in the obtained parameter information to determine whether the authentication is successful.

Images