Key generation and distribution system based on quantum random numbers

Abstract

The present invention discloses a key generation and distribution system based on quantum random numbers, and the present invention relates to the field of quantum key distribution technology. The system includes a quantum random number generation module, a light source control module, a quantum key distribution module, a detector module, a data processing module, a communication control module, a network anomaly monitoring module, and an identity authentication module. The key generation and distribution system based on quantum random numbers uses the randomness principle in quantum mechanics through a quantum random number generator to generate a truly unpredictable random number sequence, and uses the random number sequence as the basis of the key, which fundamentally improves the unpredictability and security of the key. Compared with the traditional key generation method based on pseudo-random numbers, the quantum random number has higher randomness and lower predictability risk, can effectively resist various cryptanalysis attacks, ensure the unbreakability of the key, and provide an indestructible security guarantee for information communication.

Description

Technical Field

[0001] The present invention relates to the technical field of quantum key distribution, and in particular to a key generation and distribution system based on quantum random numbers. Background Art

[0002] With the popularization of the Internet and digital technology, information security issues are becoming increasingly prominent. Traditional encryption technology mainly relies on the complexity of encryption algorithms and the confidentiality of keys to ensure information security. With the development of quantum computing technology, traditional encryption algorithms and key distribution methods will face the risk of being cracked. Therefore, it is necessary to adopt a more secure and reliable key generation and distribution method. Quantum random numbers have the characteristics of unpredictability, non-repeatability and unbiasedness. Compared with pseudo-random numbers generated by traditional computers, quantum random numbers can still maintain their unpredictability when facing new attack algorithms with powerful computing power, thereby greatly improving the security of keys.

[0003] Since quantum key distribution is sensitive to eavesdropping, it is vulnerable to denial of service attacks. Therefore, how to monitor network traffic and identify abnormal behavior so as to take measures to prevent DoS attacks is the problem we need to solve. To this end, a key generation and distribution system based on quantum random numbers is proposed. Summary of the invention

[0004] To achieve the above objectives, the present invention is implemented through the following technical solutions: a key generation and distribution system based on quantum random numbers, the system includes a quantum random number generation module, a light source control module, a quantum key distribution module, a detector module, a data processing module, a communication control module, a network anomaly monitoring module and an identity authentication module, wherein the modules are connected by electrical signals;

[0005] The quantum random number generation module generates unpredictable true random numbers based on the intrinsic randomness of the quantum random number generator and quantum mechanics, which serve as the basis for key generation, provide a highly secure random number source, and ensure the unpredictability and security of the key;

[0006] The light source control module generates a photon signal for quantum key distribution according to the requirements of the quantum key distribution system, controls the transmission path of the photon signal in the quantum key distribution system, provides a stable light source, ensures the generation and transmission quality of the quantum state, ensures that the photon signal can be accurately transmitted to the receiver, and realizes the preparation and measurement of the quantum state of the photon;

[0007] The quantum key distribution module implements the quantum key distribution protocol, transmits the key through the quantum state, ensures the security of the key during the transmission process, can detect eavesdropping, and provide information-theoretic security keys;

[0008] The detector module is used to detect the transmitted photon signal at the receiving end, convert it into an electrical signal, realize the measurement of the quantum state, and output the original detection result for subsequent key negotiation and post-processing;

[0009] The data processing module is used to post-process the original detection results output by the detector module, including basis vector comparison, key accumulation, error correction and privacy amplification steps, extract the security key sequence from the original detection results, and compress and purify the key to ensure its security;

[0010] The communication control module realizes the classic channel connection between the sender and the receiver, transmits control information and negotiates the key, ensures that the sender and the receiver can communicate in real time, and collaboratively complete the key negotiation and post-processing process;

[0011] The network anomaly monitoring module monitors network traffic and system status in real time, identifies abnormal behaviors and potential denial of service attacks, and responds to security threats of denial of service attacks to ensure the stable operation of the system and the security of the key distribution process;

[0012] The identity authentication module uses an authentication algorithm to authenticate network interaction data in the quantum key distribution process, verify the identities of both communicating parties, ensure that data is not tampered with or stolen by a third party during transmission, and improve the security of the system.

[0013] Preferably, in the quantum random number generation module, the process of generating true random numbers includes:

[0014] In the quantum random number generator, a superconducting quantum system of quantum bits is prepared and used as a random number source. In the superconducting quantum system, the two states of single photons, survival (existence) and death (non-existence), are used as the basis of quantum bits. The polarization state or path state of photons is used to represent quantum bits. The survival and death states of single photons can be mapped to the quantum bit. and In terms of status;

[0015] By applying the Hadamard gate (H gate) operation, the quantum bit is placed in a superposition state using the superposition principle of quantum mechanics, making it simultaneously and State, ensuring that the generated random numbers are unpredictable;

[0016] When measuring a quantum bit in a superposition state, according to the collapse hypothesis of quantum mechanics, the measurement operation will cause the quantum state to collapse, randomly determining the state of the quantum bit to be or , since the results of quantum measurements are random, each measurement generates a new random bit;

[0017] The result of each measurement ( or ) are recorded in binary form to form a random number sequence. Due to the nature of the quantum system, the measurement results cannot be predicted. Therefore, the generated random number sequence is truly random. The generated random number sequence is subjected to randomness tests, including frequency tests and sequence tests, to ensure that the generated random numbers exhibit randomness in all aspects.

[0018] Preferably, in the light source control module, the process of generating the photon signal includes:

[0019] The light source control module uses a laser as a light source to generate a photon signal according to the requirements of the quantum key distribution system. The wavelength of the light signal emitted by the laser is 850nm, and the photon signal will serve as a carrier of the quantum state.

[0020] Start the light source control module, preheat and stabilize the light source, and configure the transmission path and measurement parameters to put the system in standby mode to ensure that the laser and other light source equipment can operate stably and avoid performance fluctuations caused by temperature changes or unstable initial state of the equipment;

[0021] The optical signal emitted by the light source is modulated by a modulator (electro-optical modulator) to generate the required quantum state. The modulation process includes intensity modulation and phase modulation to ensure that the quantum state of the optical signal meets the expected characteristics. Intensity modulation is used to control the energy of the optical pulse to ensure that the number of photons in each pulse meets the requirements (single photon or few-photon state), and phase modulation is used to change the phase of the optical pulse.

[0022] Use an adjustable attenuator to attenuate the modulated optical signal to the single-photon level, ensuring that each optical pulse contains only one photon, which meets the requirements of quantum key distribution. And by controlling the optical switch and fiber coupler devices, control the transmission path of the photon signal in the quantum key distribution system to ensure that the photon signal can be accurately transmitted to the receiver and avoid signal loss and interference.

[0023] After the configuration of the photon signal transmission path is completed, the system is calibrated and tested to ensure the quality and stability of the optical signal, including fine-tuning the intensity, phase and polarization of the optical signal to meet the specific requirements of quantum key distribution. After all configurations and calibrations are completed, the system enters standby mode, waiting to start the quantum key distribution process. In standby mode, the system maintains the stability of the light source and transmission path, ready to start key distribution at any time.

[0024] Preferably, in the quantum key distribution module, the process of quantum state transmission key includes:

[0025] Select the quantum key distribution protocol of the BB84 protocol, set the parameters of the quantum channel and the classical channel, including wavelength, pulse width, and repetition frequency, and configure the device parameters of the sender and the receiver to ensure that both parties can communicate normally. Among them, select a wavelength of 850nm to ensure the transmission efficiency of optical signals in optical fibers, set the pulse width to control the emission time of a single photon, and determine the repetition frequency of the pulse, that is, the frequency at which the light source emits photons;

[0026] The sender uses a light source to generate photons of different polarizations, randomly selects a set of basis vectors, and randomly prepares photons of a polarization state under the selected basis vectors and sends them to the receiver. The prepared quantum state is transmitted to the receiver through the quantum channel. During the transmission process, it is ensured that the quantum state is not affected by environmental noise and interference.

[0027] After receiving the quantum state, the receiver randomly selects a set of basis vectors to measure the quantum state, records the measurement results and the measurement basis vectors used, and exchanges the basis vector information selected by the sender and the receiver during the transmission and measurement through the classical channel. The two parties compare the basis vectors. If the basis vectors are the same, the measurement result is retained as part of the key; if the basis vectors are different, the measurement result is discarded.

[0028] The sender and receiver generate a shared key based on the consistent measurement results, and select inconsistent bits by eliminating basis vectors. The bit sequence finally obtained by both parties is the shared key.

[0029] Preferably, in the detector module, the output process of the original detection result includes:

[0030] The detector module performs initialization operations at startup, including setting working parameters (sensitivity, response time), calibrating the detector, and configuring two sets of measurement bases in orthogonal polarization directions, namely 0° / 90° and 45° / -45°, based on the BB84 quantum key distribution protocol. The two sets of measurement bases are used to distinguish different polarization states of received photon signals.

[0031] The transmitted photon signal reaches the receiver through the quantum channel and is received by the detector module. The received photon signal is detected using a single-photon detector. The received photon signal is converted into an electrical signal using the principle of photoelectric effect, and the polarization, wave vector, and phase characteristics of the photon are detected.

[0032] The detector module records the converted electrical signal to form the original detection result, which includes the number of detected photons, timestamp, and measurement basis information. The original detection result will be used to generate quantum keys. According to the BB84 protocol, the sender and receiver compare the photon results detected under the same measurement basis to generate a shared key.

[0033] Preferably, in the data processing module, the process of extracting the security key sequence includes:

[0034] The data processing module receives the original detection results from the detector module, performs basis vector comparison, and after basis vector comparison, obtains the key error rate and key generation rate, detection rate data, calculates the error evaluation index, presets the evaluation threshold T, evaluates the key error rate, and determines whether there is a third-party eavesdropper;

[0035] The data processing module accumulates the key bits retained in multiple measurement cycles until a predetermined key length is reached to form a preliminary key sequence;

[0036] The error correction algorithm of the Cascade algorithm is used to correct the error bits in the preliminary key sequence, ensure the key consistency of the sender and the receiver, and obtain the corrected key sequence;

[0037] After the error is corrected, the correction key sequence is processed through a hash function to amplify the privacy of both parties, eliminate information that may be leaked to eavesdroppers, and then obtain the final generated security key sequence;

[0038] After obtaining the security key sequence, verification is performed and the serial number of the security key sequence is synchronized and managed to ensure the consistency and security of the key. The verified security key sequence is sent to the key management systems of both parties for subsequent encrypted communications.

[0039] Preferably, the calculation formula of the error evaluation index is:

[0040] ;

[0041] in, is the error evaluation index, is the key error rate, is the key generation rate, that is, the number of key bits generated per unit time, is the adjustment coefficient, which is used to adjust the sensitivity of the formula. The maximum allowed key error rate is preset. If the value exceeds this value, the system will be considered unsafe. The preset benchmark key generation rate is used to evaluate whether the current key generation rate is within an acceptable range. The value range is between 0 and 1.

[0042] Preferably, in the network anomaly monitoring module, the process of identifying abnormal behavior and potential denial of service attacks includes:

[0043] Use the network traffic monitoring tool (NetFlow Analyzer) installed on the server to monitor the traffic in and out of the network, including inbound and outbound data packets. The monitoring indicators are traffic size, protocol type, source / destination address, so as to fully understand the network traffic status, and collect system logs and performance indicators, including CPU usage, memory usage, and disk I / O;

[0044] Based on the historical traffic data and system status data collected during normal operation, a baseline of normal behavior patterns of network traffic and system performance is established, wherein the baseline includes the network traffic size, protocol distribution, regular patterns of source / destination addresses, and regular usage of system resources. The baseline is a reference model of normal network and system behavior for comparison with real-time data.

[0045] Monitor the current network traffic and system status in real time, compare the current network traffic and system status with the baseline data, calculate the anomaly identification index, analyze the trend of the anomaly identification index, and identify behaviors that deviate from the normal mode. The higher the anomaly identification index, the greater the difference between the network traffic or system status and the normal mode, and the presence of abnormal behavior;

[0046] Set an anomaly threshold K. When the anomaly identification index exceeds the anomaly threshold, trigger the signature matching method to identify abnormal behavior, analyze the detected anomaly, and compare it with the known denial of service attack and distributed denial of service attack patterns in the signature library to determine whether it is a potential attack sign (such as denial of service attack, distributed denial of service attack);

[0047] Based on the signature matching results, potential denial of service attacks or distributed denial of service attacks are identified, the attack characteristics of attack type, attack source, and attack time are analyzed, and security response measures are initiated. Real-time alarms are sent to network administrators. The alarm information includes key information such as attack type, attack source, and attack time so that administrators can respond quickly.

[0048] Preferably, the calculation formula of the abnormality identification index is:

[0049] ;

[0050] in, is the anomaly recognition index, is the instant value of the current CPU usage. is the average CPU usage during the baseline period, indicating the reference value for normal operation. is the standard deviation of CPU usage during the baseline period, measuring the degree of normal fluctuation. is the instant value of current network traffic usage. is the maximum value of network traffic during the baseline period, indicating the maximum traffic under normal conditions. is the current network traffic rate, is the minimum flow rate during the baseline period, is the maximum flow rate during the baseline period, The value range is between 0 and 1. , it indicates an abnormality.

[0051] Preferably, the specific process of the identity authentication module includes the sender selecting a basis vector and preparing an identity authentication bit string, the receiver measuring the identity authentication information, sending the encrypted preset shared key, the sender decrypting and verifying the preset shared key, and exception handling;

[0052] The sender selects the preparation basis of the bit string for identity authentication according to the basis selection rule, and uses different wavelengths to send the quantum states of the identity authentication bit string and the key bit string to ensure that they are distinguished at the receiver;

[0053] The receiver measures the received quantum state to obtain identity authentication information, and compares the measured identity authentication information with the basis vector selection rule to verify the identity of the sender;

[0054] If the receiver passes the verification, that is, the measured identity authentication information is consistent with the basis vector selection rule, the receiver sends an encrypted pre-shared key to the sender. The pre-shared key is agreed upon by both parties in advance and is used in the subsequent key distribution process.

[0055] After receiving the encrypted pre-shared key, the sender uses its own decryption key to decrypt it and compares the decrypted pre-shared key with the local pre-shared key to verify the identity of the receiver. If the decrypted key is consistent with the local key, the verification is successful and both parties continue with the subsequent key distribution process; if they are inconsistent, the identity authentication fails, the communication is interrupted, and the quantum key distribution process ends to prevent potential security risks;

[0056] During the identity authentication process, if the sender or receiver finds any abnormality or error, such as identity authentication failure, data tampering, etc., the quantum key distribution process will be terminated immediately and corresponding security measures will be taken.

[0057] The present invention provides a key generation and distribution system based on quantum random numbers. It has the following beneficial effects:

[0058] 1. The key generation and distribution system based on quantum random numbers uses the randomness principle in quantum mechanics through a quantum random number generator to generate a truly unpredictable random number sequence, and uses the random number sequence as the basis of the key, fundamentally improving the unpredictability and security of the key. Compared with the traditional key generation method based on pseudo-random numbers, quantum random numbers have higher randomness and lower predictability risk, can effectively resist various cryptanalysis attacks, ensure the unbreakable nature of the key, and provide an indestructible security guarantee for information communication.

[0059] 2. The key generation and distribution system based on quantum random numbers, combined with the anomaly identification index, monitors network traffic and system status, and promptly detects abnormal behavior and potential denial of service attacks. By calculating the anomaly identification index and analyzing its trend, it identifies behaviors that deviate from normal patterns, and then determines whether there are third-party eavesdroppers. The real-time monitoring and response capabilities enable the system to take measures at the early stages of an attack, such as blocking suspicious IP addresses, limiting abnormal traffic, etc., thereby effectively resisting network attacks and protecting communication security. Through this mechanism, not only can the secure distribution of keys be provided, but also the stability and reliability of the entire communication process can be ensured. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a module structure diagram of the key generation and distribution system based on quantum random numbers of the present invention;

[0061] Figure 2 is a flow chart of extracting the security key sequence of the present invention;

[0062] Figure 3 This is a flow chart for identifying abnormal behaviors and potential denial of service attacks of the present invention. DETAILED DESCRIPTION

[0063] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The embodiments of the present invention are provided for the purpose of illustration and description, and are not intended to be exhaustive or to limit the present invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention, and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.

[0064] The first embodiment, as Figure 1 , Figure 2As shown, the present invention provides a technical solution: a key generation and distribution system based on quantum random numbers, the system includes a quantum random number generation module, a light source control module, a quantum key distribution module, a detector module, a data processing module, a communication control module, a network anomaly monitoring module and an identity authentication module, wherein the modules are connected by electrical signals;

[0065] The quantum random number generation module generates unpredictable true random numbers based on the intrinsic randomness of the quantum random number generator and quantum mechanics. As the basis for key generation, it provides a highly secure random number source to ensure the unpredictability and security of the key. In the quantum random number generator, a superconducting quantum system of quantum bits is prepared as a random number source. In the superconducting quantum system, the two states of single photon survival (existence) and death (non-existence) are used as the basis of quantum bits. The polarization state or path state of the photon is used to represent the quantum bit. The survival and death states of the single photon can be mapped to the quantum bit. and In terms of state, by applying the Hadamard gate (H gate) operation and using the superposition principle of quantum mechanics, the quantum bit is placed in a superposition state, making it simultaneously and The H gate is a quantum logic gate that acts on a single quantum bit and converts it from the ground state to the superposition state. , after applying the H gate, the state of the quantum bit becomes: , the quantum bit in the superposition state is measured. According to the collapse hypothesis of quantum mechanics, the measurement operation will cause the quantum state to collapse, and the state of the quantum bit will be randomly determined as or , since the result of quantum measurement is random, each measurement will generate a new random bit, which will be the result of each measurement ( or ) are recorded in binary form to form a random number sequence. Due to the nature of the quantum system, the measurement results cannot be predicted, so the generated random number sequence is truly random. The generated random number sequence is subjected to randomness tests, including frequency tests and sequence tests, to ensure that the generated random numbers are random in all aspects. The frequency test is used to check whether the frequency of occurrence of each possible result (0 and 1) is close to the theoretical probability (50%), and the sequence test is used to check the pattern of consecutive bits in the random number sequence to ensure that there is no identifiable pattern or deviation.

[0066] The light source control module generates photon signals for quantum key distribution according to the needs of the quantum key distribution system, controls the transmission path of the photon signals in the quantum key distribution system, provides a stable light source, ensures the generation and transmission quality of quantum states, ensures that the photon signals can be accurately transmitted to the receiver, and realizes the preparation and measurement of the quantum state of photons. The light source control module uses a laser as a light source to generate photon signals according to the needs of the quantum key distribution system. The wavelength light signal emitted by the laser is 850nm. The photon signal will serve as a carrier of the quantum state. The light source control module is started to preheat and stabilize the light source, and the transmission path and measurement parameters are configured to put the system in standby mode to ensure that light source equipment such as lasers can operate stably and avoid performance fluctuations caused by temperature changes or unstable initial states of the equipment. The light signal emitted by the light source is modulated by a modulator (electro-optical modulator) to generate the required quantum state. The modulation process includes intensity modulation and phase modulation to ensure that the light The quantum state of the signal meets the expected characteristics, among which intensity modulation is used to control the energy of the optical pulse to ensure that the number of photons in each pulse meets the requirements (single photon or few photon state), phase modulation is used to change the phase of the optical pulse, and an adjustable attenuator is used to attenuate the modulated optical signal to the single photon level to ensure that each optical pulse contains only one photon, which meets the requirements of quantum key distribution, and by controlling the optical switch and fiber coupler devices, the transmission path of the photon signal in the quantum key distribution system is controlled to ensure that the photon signal can be accurately transmitted to the receiver to avoid signal loss and interference. After the configuration of the photon signal transmission path is completed, the system is calibrated and tested to ensure the quality and stability of the optical signal, including fine-tuning the intensity, phase and polarization of the optical signal to meet the specific requirements of quantum key distribution. After all configurations and calibrations are completed, the system enters the standby state and waits for the start of the quantum key distribution process. In the standby state, the system maintains the stability of the light source and the transmission path, and is ready to start key distribution at any time;

[0067] The quantum key distribution module implements the quantum key distribution protocol, transmits keys through quantum states, ensures the security of keys during transmission, can detect eavesdropping, provides information-theoretic security keys, selects the quantum key distribution protocol of the BB84 protocol, sets the parameters of the quantum channel and the classical channel, including wavelength, pulse width, and repetition frequency, and configures the device parameters of the sender and the receiver to ensure that both parties can communicate normally. Among them, a wavelength of 850nm is selected to ensure the transmission efficiency of optical signals in optical fibers, the pulse width is set to control the emission time of a single photon, and the repetition frequency of the pulse, that is, the frequency at which the light source emits photons, is determined. The sender uses the light source to generate photons of different polarizations, randomly selects a set of basis vectors, and randomly prepares a polarization state of photons under the selected basis vectors and sends it to the receiver. The prepared quantum state is transmitted to the receiver through the quantum channel. During the transmission process, it is ensured that the quantum state is not affected by environmental noise and interference. The receiver receives the After the quantum state is transmitted, a set of basis vectors are randomly selected to measure the quantum state, and the measurement results and the measurement basis vectors used are recorded. Through the classical channel, the sender and the receiver exchange the basis vector information selected during transmission and measurement. The two parties compare the basis vectors. If the basis vectors are the same, the result of this measurement is retained as part of the key; if the basis vectors are different, the result of this measurement is discarded. Due to the characteristics of quantum measurement, if the measurement basis of the receiver is consistent with the coding basis of the sender, the bit value sent by the sender will be accurately obtained. If they are inconsistent, the measurement result will be random. After the quantum state transmission is completed, the sender and the receiver publicly disclose their respective selected measurement bases through the classical channel, without disclosing the specific measurement results, and compare their respective basis vector selections. Only when the selection is consistent, the measurement result will be retained. The sender and the receiver generate a shared key based on the consistent measurement results. By eliminating the bits with inconsistent basis vector selections, the bit sequence finally obtained by both parties is the shared key.

[0068] The detector module is used to detect the transmitted photon signal at the receiving end, convert it into an electrical signal, realize the measurement of quantum state, and output the original detection result for subsequent key negotiation and post-processing. The detector module performs initialization operations at startup, including setting working parameters (sensitivity, response time), calibrating the detector, and configuring the detector module with two sets of measurement bases in orthogonal polarization directions, namely 0° / 90° and 45° / -45°, based on the BB84 quantum key distribution protocol. The two sets of measurement bases are used to distinguish the different polarization states of the received photon signal. The transmitted photon signal passes the amount The subchannel reaches the receiver and is received by the detector module. The received photon signal is detected using a single-photon detector. The received photon signal is converted into an electrical signal using the principle of photoelectric effect, and the polarization, wave vector, and phase characteristics of the photon are detected. The detector module records the converted electrical signal to form the original detection result, which includes the number of detected photons, timestamp, and measurement basis information. The original detection result will be used to generate a quantum key. According to the BB84 protocol, the sender and the receiver compare the photon results detected under the same measurement basis to generate a shared key.

[0069] The data processing module is used to post-process the original detection results output by the detector module, including basis vector comparison, key accumulation, error correction and privacy amplification steps, extract the security key sequence from the original detection results, and compress and purify the key to ensure its security. The data processing module receives the original detection results from the detector module, performs basis vector comparison, and obtains the key error rate and key generation rate, detection rate data after basis vector comparison, calculates the error evaluation index, presets the evaluation threshold P, evaluates the key error rate, and determines whether there is a third-party eavesdropper. The data processing module accumulates the key bits retained in multiple measurement cycles until a predetermined value is reached. The key length is used to form a preliminary key sequence. The error correction algorithm of the Cascade algorithm is used to correct the error bits in the preliminary key sequence to ensure the key consistency of the sender and the receiver, and to obtain the corrected key sequence. After the error is corrected, the corrected key sequence is processed by the hash function to amplify the privacy of both parties and eliminate the information that may be leaked to the eavesdropper, and then the final generated security key sequence is obtained. After obtaining the security key sequence, verification is performed and the serial number of the security key sequence is synchronized and managed to ensure the consistency and security of the key. The verified security key sequence is sent to the key management system of both parties for subsequent encrypted communication.

[0070] Furthermore, the calculation formula of the error evaluation index is:

[0071] ;

[0072] in, is the error evaluation index, is the key error rate, is the key generation rate, that is, the number of key bits generated per unit time, is the adjustment coefficient, which is used to adjust the sensitivity of the formula. The maximum allowed key error rate is preset. If the value exceeds this value, the system will be considered unsafe. The preset benchmark key generation rate is used to evaluate whether the current key generation rate is within an acceptable range. The value range is between 0 and 1. When it is close to 0, that is, the error rate is very low, Tends to 1, indicating that the system is very safe. near , that is, when the error rate is very high, If it approaches 0, it means the system may be eavesdropped and unsafe. If the value approaches or exceeds , The value of will increase, indicating that the key generation rate is high and the system is more secure. , indicating that the system is safe;

[0073] The communication control module realizes the classic channel connection between the sender and the receiver, transmits control information and negotiates the key, ensures that the sender and the receiver can communicate in real time, and collaboratively complete the key negotiation and post-processing process;

[0074] The network anomaly monitoring module monitors network traffic and system status in real time, identifies abnormal behaviors and potential denial of service attacks, and responds to security threats of denial of service attacks to ensure the stable operation of the system and the security of the key distribution process;

[0075] The identity authentication module uses an authentication algorithm to authenticate the network interaction data during the quantum key distribution process, verify the identities of the communicating parties, ensure that the data is not tampered with or stolen by a third party during transmission, and improve the security of the system.

[0076] The second embodiment is based on the first embodiment. Figure 3 As shown in the figure, in the network anomaly monitoring module, the identification process of abnormal behavior and potential denial of service attacks includes:

[0077] Use the network traffic monitoring tool (NetFlow Analyzer) installed on the server to monitor the traffic in and out of the network, including inbound and outbound data packets. The monitored indicators are traffic size, protocol type, source / destination address, so as to fully understand the network traffic status, and collect system logs and performance indicators, including CPU utilization, memory usage, disk I / O, and establish a normal behavior pattern baseline of network traffic and system performance based on historical traffic data and system status data collected during normal operation. The baseline includes network traffic size, protocol distribution, regular patterns of source / destination addresses, and regular usage of system resources. The baseline is a reference model of normal network and system behavior, which is used for comparison with real-time data. Monitor the current network traffic and system status in real time, compare the current network traffic and system status with the baseline data, calculate the anomaly recognition index, analyze the trend of the anomaly recognition index, and identify The behavior that deviates from the normal mode is detected. The higher the anomaly identification index is, the greater the difference between the network traffic or system status and the normal mode is, and the existence of abnormal behavior is detected. The anomaly threshold K is set. When the anomaly identification index exceeds the anomaly threshold, the signature matching method is triggered to identify abnormal behavior, and the detected anomaly is analyzed and compared with the known denial of service attack and distributed denial of service attack patterns in the signature library to determine whether it is a potential attack sign (such as denial of service attack, distributed denial of service attack). According to the signature matching results, the potential denial of service attack or distributed denial of service attack is identified, and the attack characteristics of the attack type, attack source, and attack time are analyzed, and the security response measures are initiated, and the alarm is sent to the network administrator in real time. The alarm information includes the key information of the attack type, attack source, and attack time so that the administrator can respond quickly;

[0078] Furthermore, the calculation formula of the anomaly recognition index is:

[0079] ;

[0080] in, is the anomaly recognition index, is the instant value of the current CPU usage. is the average CPU usage during the baseline period, indicating the reference value for normal operation. is the standard deviation of CPU usage during the baseline period, measuring the degree of normal fluctuation. is the instant value of current network traffic usage. is the maximum value of network traffic during the baseline period, indicating the maximum traffic under normal conditions. is the current network traffic rate, is the minimum flow rate during the baseline period, is the maximum flow rate during the baseline period, The value range is between 0 and 1. Indicates that the current state is very close to the baseline and no abnormalities are detected. Indicates that the current state is very different from the baseline and there is a serious abnormality. near hour, When it tends to 0, it indicates that the network traffic or system status is normal. Significant deviation hour, will increase rapidly, indicating a potential abnormality, The larger the value, the higher the current traffic or resource usage. Increase, The closer the value is to ,but When it tends to 1, it means the abnormality is increasing. , it indicates an abnormality;

[0081] The specific process of the identity authentication module includes the sender selecting a basis vector and preparing an identity authentication bit string, the receiver measuring the identity authentication information, sending the encrypted preset shared key, the sender decrypting and verifying the preset shared key, and exception handling;

[0082] Among them, the sender selects the preparation basis of the bit string for identity authentication according to the basis vector selection rule, and uses different wavelengths to send the quantum states of the identity authentication bit string and the key bit string to ensure that they are distinguished at the receiver. The receiver measures the received quantum state to obtain identity authentication information, and compares the measured identity authentication information with the basis vector selection rule to verify the identity of the sender. If the receiver passes the verification, that is, the measured identity authentication information is consistent with the basis vector selection rule, then the receiver sends an encrypted preset shared key to the sender. The preset shared key is agreed upon by both parties in advance and is used in the subsequent key distribution process. After receiving the encrypted preset shared key, the sender uses its own decryption key to decrypt it and compares the decrypted preset shared key with the local preset shared key to verify the identity of the receiver. If the decrypted key is consistent with the local key, the verification is successful and both parties continue with the subsequent key distribution process; if they are inconsistent, the identity authentication fails, the communication is interrupted, and the quantum key distribution process ends to prevent potential security risks. During the identity authentication process, if the sender or receiver finds any abnormality or error, such as identity authentication failure, data tampering, etc., the quantum key distribution process is terminated immediately and corresponding security measures are taken.

[0083] Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field and related fields without creative work should fall within the scope of protection of the present invention. The structures, devices and operating methods not specifically described and explained in the present invention are implemented according to the conventional means in the field unless otherwise specified and limited.

Claims

1. A key generation and distribution system based on quantum random numbers, characterized in that: The system includes a quantum random number generation module, a light source control module, a quantum key distribution module, a detector module, a data processing module, a communication control module, a network anomaly monitoring module and an identity authentication module, wherein the modules are connected by electrical signals; The quantum random number generation module generates unpredictable true random numbers based on the intrinsic randomness of the quantum random number generator and quantum mechanics; The light source control module generates a photon signal for quantum key distribution according to the requirements of the quantum key distribution system, and controls the transmission path of the photon signal in the quantum key distribution system; The quantum key distribution module implements the quantum key distribution protocol and transmits the key through the quantum state; The detector module is used to detect the transmitted photon signal at the receiving end, convert it into an electrical signal, realize the measurement of the quantum state, and output the original detection result; The data processing module is used to post-process the original detection results output by the detector module and extract the security key sequence from the original detection results; The communication control module realizes the classic channel connection between the sender and the receiver, transmits control information and negotiates the key; The network anomaly monitoring module monitors network traffic and system status in real time, identifies abnormal behaviors and potential denial of service attacks, and responds to security threats of denial of service attacks; The identity authentication module uses an authentication algorithm to authenticate the network interaction data in the quantum key distribution process and verify the identities of the communicating parties.

2. The key generation and distribution system based on quantum random numbers according to claim 1, characterized in that: In the quantum random number generation module, the process of generating true random numbers includes: In the quantum random number generator, a superconducting quantum system of quantum bits is prepared and used as a random number source. In the superconducting quantum system, the two states of single photon survival and death are used as the basis of quantum bits, and the polarization state of photons is used to represent quantum bits. The survival and death states of single photons can be mapped to the quantum bits. and In terms of status; By applying the Hadamard gate operation and utilizing the superposition principle of quantum mechanics, the quantum bit is placed in a superposition state, making it simultaneously and state; When measuring a quantum bit in a superposition state, according to the collapse hypothesis of quantum mechanics, the measurement operation will cause the quantum state to collapse, randomly determining the state of the quantum bit to be or ; The result of each measurement is recorded in binary form to form a random number sequence, and the generated random number sequence is subjected to randomness tests, including frequency tests and sequence tests.

3. The key generation and distribution system based on quantum random numbers according to claim 2, characterized in that: In the light source control module, the process of generating a photon signal includes: The light source control module uses a laser as a light source to generate a photon signal according to the requirements of the quantum key distribution system. The wavelength of the light signal emitted by the laser is 850nm, and the photon signal will serve as a carrier of the quantum state. Start the light source control module, preheat and stabilize the light source, and configure the transmission path and measurement parameters; Using the light signal emitted by the light source, the photon signal is modulated by a modulator to generate the required quantum state. The modulation process includes intensity modulation and phase modulation. Intensity modulation is used to control the energy of the light pulse, and phase modulation is used to change the phase of the light pulse. Use an adjustable attenuator to attenuate the modulated optical signal to a single-photon level, and control the transmission path of the photon signal in the quantum key distribution system by controlling optical switches and fiber coupler devices; After the photon signal transmission path is configured, the system is calibrated and tested, including fine-tuning the intensity, phase and polarization of the optical signal. After all configurations and calibrations are completed, the system enters standby mode, waiting to start the quantum key distribution process. In standby mode, the system maintains the stability of the light source and transmission path, ready to start key distribution at any time.

4. The key generation and distribution system based on quantum random numbers according to claim 3 is characterized in that: In the quantum key distribution module, the process of quantum state transmission key includes: Select the quantum key distribution protocol of the BB84 protocol, set the parameters of the quantum channel and the classical channel, including wavelength, pulse width, repetition frequency, and configure the device parameters of the sender and receiver; The sender uses a light source to generate photons of different polarizations, randomly selects a set of basis vectors, and randomly prepares photons of a polarization state under the selected basis vectors and sends them to the receiver, and transmits the prepared quantum state to the receiver through the quantum channel; After receiving the quantum state, the receiver randomly selects a set of basis vectors to measure the quantum state, records the measurement results and the measurement basis vectors used, and exchanges the basis vector information selected by the sender and the receiver during the transmission and measurement through the classical channel. The two parties compare the basis vectors. If the basis vectors are the same, the measurement result is retained as part of the key; if the basis vectors are different, the measurement result is discarded. The sender and receiver generate a shared key based on the consistent measurement results, and select inconsistent bits by eliminating basis vectors. The bit sequence finally obtained by both parties is the shared key.

5. The key generation and distribution system based on quantum random numbers according to claim 4, characterized in that: In the detector module, the output process of the original detection result includes: The detector module performs initialization operations at startup, including setting working parameters and calibrating the detector. Based on the BB84 quantum key distribution protocol, the detector module is configured with two sets of measurement bases in orthogonal polarization directions, namely 0° / 90° and 45° / -45°. The two sets of measurement bases are used to distinguish different polarization states of the received photon signals. The transmitted photon signal reaches the receiver through the quantum channel and is received by the detector module. The received photon signal is detected using a single-photon detector. The received photon signal is converted into an electrical signal using the principle of photoelectric effect, and the polarization, wave vector, and phase characteristics of the photon are detected. The detector module records the converted electrical signal to form the original detection result, which includes the number of detected photons, timestamp, and measurement base information.

6. The key generation and distribution system based on quantum random numbers according to claim 5, characterized in that: In the data processing module, the process of extracting the security key sequence includes: The data processing module receives the original detection results from the detector module, performs basis vector comparison, and after basis vector comparison, obtains the key error rate and key generation rate, detection rate data, calculates the error evaluation index, presets the evaluation threshold P, evaluates the key error rate, and determines whether there is a third-party eavesdropper; The data processing module accumulates the key bits retained in multiple measurement cycles until a predetermined key length is reached to form a preliminary key sequence; The error correction algorithm of the Cascade algorithm is used to correct the error bits in the preliminary key sequence, ensure the key consistency of the sender and the receiver, and obtain the corrected key sequence; After the error is corrected, the correction key sequence is processed through a hash function to amplify the privacy of both parties, thereby obtaining the final generated security key sequence; After obtaining the security key sequence, verification is performed and the serial number of the security key sequence is synchronized and managed, and the verified security key sequence is sent to the key management systems of both parties.

7. The key generation and distribution system based on quantum random numbers according to claim 6, characterized in that: The calculation formula of the error evaluation index is: ； in, is the error evaluation index, is the key error rate, is the key generation rate, is the adjustment coefficient, is the preset maximum permissible key error rate, is the preset benchmark key generation rate, The value range is between 0 and 1. , indicating that the system is safe.

8. The key generation and distribution system based on quantum random numbers according to claim 7, characterized in that: In the network anomaly monitoring module, the process of identifying abnormal behavior and potential denial of service attacks includes: Use the network traffic monitoring tool installed on the server to monitor the traffic in and out of the network, including inbound and outbound data packets. The monitoring indicators are traffic size, protocol type, source / destination address, and collect system logs and performance indicators, including CPU usage, memory usage, and disk I / O; Establish a baseline of normal behavior patterns of network traffic and system performance based on historical traffic data and system status data collected during normal operations, where the baseline includes network traffic volume, protocol distribution, regular patterns of source / destination addresses, and regular use of system resources; Monitor current network traffic and system status in real time, compare current network traffic and system status with baseline data, calculate anomaly identification index, analyze the trend of anomaly identification index, and identify behaviors that deviate from normal patterns; Set an anomaly threshold K. When the anomaly identification index exceeds the anomaly threshold, trigger the signature matching method to identify abnormal behavior, analyze the detected anomaly, and compare it with the known denial of service attack and distributed denial of service attack patterns in the signature library to determine whether it is a potential attack sign; Based on the signature matching results, potential denial of service attacks or distributed denial of service attacks are identified, the attack characteristics of attack type, attack source, and attack time are analyzed, and security response measures are initiated. Real-time alarms are sent to network administrators, and the alarm information includes key information such as attack type, attack source, and attack time.

9. The key generation and distribution system based on quantum random numbers according to claim 8, characterized in that: The calculation formula of the abnormal identification index is: ； in, is the anomaly recognition index, is the instant value of the current CPU usage. is the average CPU usage during the baseline period, is the standard deviation of CPU usage during the baseline period, is the instant value of current network traffic usage. is the maximum value of network traffic during the baseline period, is the current network traffic rate, is the minimum flow rate during the baseline period, is the maximum flow rate during the baseline period, The value range is between 0 and 1. , it indicates an abnormality.

10. The key generation and distribution system based on quantum random numbers according to claim 9, characterized in that: The specific process of the identity authentication module includes the sender selecting a basis vector and preparing an identity authentication bit string, the receiver measuring the identity authentication information, sending the encrypted preset shared key, the sender decrypting and verifying the preset shared key, and exception handling; The sender selects the preparation basis of the bit string for identity authentication according to the basis selection rule, and uses different wavelengths to send the quantum states of the identity authentication bit string and the key bit string to ensure that they are distinguished at the receiver; The receiver measures the received quantum state to obtain identity authentication information, and compares the measured identity authentication information with the basis vector selection rule to verify the identity of the sender; If the receiver passes the verification, that is, the measured identity authentication information is consistent with the basis vector selection rule, the receiver sends an encrypted preset shared key to the sender, and the preset shared key is agreed upon by both parties in advance; After receiving the encrypted pre-shared key, the sender uses its own decryption key to decrypt it and compares the decrypted pre-shared key with the local pre-shared key to verify the identity of the receiver. If the decrypted key is consistent with the local key, the verification is successful and both parties continue with the subsequent key distribution process; if they are inconsistent, the identity authentication fails, the communication is interrupted, and the quantum key distribution process ends. During the identity authentication process, if the sender or receiver finds any abnormality or error, the quantum key distribution process will be terminated immediately and corresponding security measures will be taken.

Images