User roaming method, device and system, electronic equipment and computer storage medium

Abstract

The embodiment of the invention provides a user roaming method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of quantum communication, and the method comprises the steps: obtaining a query request which is sent by a user terminal and is used for querying routing information; determining a user charging place corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal based on the query request; if the original quantum cryptography service node corresponding to the user charging place is different from the target quantum cryptography service node, sending a target charging key distribution request to the original quantum cryptography service node; and sending the first node information of the target quantum cryptography service node to the user terminal. According to the embodiment of the invention, the security of cross-domain movement of the user terminal is ensured.

Description

Technical Field

[0001] The present invention relates to the field of quantum communication technology, and in particular to a user roaming method, a user roaming device, a user roaming system, an electronic device and a computer-readable storage medium. Background Art

[0002] Using secure media and pre-charging keys, and then using pre-charging keys to protect working keys, can be used to protect the security of data transmission such as voip, volte, satellite calls, official documents, etc. When a user carries a terminal device that uses secure media and moves across security domains, if the terminal device is still connected to the original security domain through secure media, the network transmission performance during key transmission will be reduced. At the same time, if the transmission link is too long, the security of the entire link will also be reduced. Summary of the invention

[0003] In view of the above problems, embodiments of the present invention are proposed to provide a user roaming method, a user roaming device, a user roaming system, an electronic device and a computer-readable storage medium that overcome the above problems or at least partially solve the above problems.

[0004] In order to solve the above problem, an embodiment of the present invention discloses a user roaming method, the method comprising:

[0005] Obtaining a query request sent by a user terminal for querying routing information;

[0006] Determine, based on the query request, a user charging location corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal;

[0007] If the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, a target charging key distribution request is sent to the original quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the target quantum cryptography service node;

[0008] The first node information of the target quantum cryptography service node is sent to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

[0009] In one or more embodiments, determining the user charging location corresponding to the user terminal and the target quantum cryptography service node closest to the user terminal based on the query request includes:

[0010] Using the terminal information of the user terminal in the query request to query, obtain the user charging location corresponding to the user terminal;

[0011] The address information in the query request is used to query to obtain the target quantum cryptography service node closest to the user terminal.

[0012] In one or more embodiments, sending a target injection key distribution request to the original quantum cryptography service node includes:

[0013] Sending a target injection key distribution request directly to the original quantum cryptography service node;

[0014] or,

[0015] The second node information of the original quantum cryptography service node is sent to the user terminal, so that the user terminal uses the second node information to send a target injection key distribution request to the original quantum cryptography service node.

[0016] In one or more embodiments, the original quantum cryptography service node responds to the target injection key distribution request by obtaining relay routing information of the quantum network, and sends the target injection key to the quantum key distribution node corresponding to the target quantum cryptography service node through the corresponding quantum key distribution node according to the relay routing information.

[0017] In one or more embodiments, the target pricing key is a full pricing key or a partial pricing key of a complete pricing key.

[0018] Accordingly, an embodiment of the present invention discloses a user roaming device, the device comprising:

[0019] An acquisition module, used to acquire a query request sent by a user terminal for querying routing information;

[0020] A determination module, configured to determine, based on the query request, a user charging location corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal;

[0021] A sending module, configured to send a target charging key distribution request to the original quantum cryptography service node if the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the target quantum cryptography service node;

[0022] The sending module is further used to send the first node information of the target quantum cryptography service node to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

[0023] In one or more embodiments, the determining module is specifically configured to:

[0024] Using the terminal information of the user terminal in the query request to query, obtain the user charging location corresponding to the user terminal;

[0025] The address information in the query request is used to query to obtain the target quantum cryptography service node closest to the user terminal.

[0026] In one or more embodiments, the sending module is specifically used to:

[0027] Sending a target injection key distribution request directly to the original quantum cryptography service node;

[0028] or,

[0029] The second node information of the original quantum cryptography service node is sent to the user terminal, so that the user terminal uses the second node information to send a target injection key distribution request to the original quantum cryptography service node.

[0030] In one or more embodiments, the original quantum cryptography service node responds to the target injection key distribution request by obtaining relay routing information of the quantum network, and sends the target injection key to the quantum key distribution node corresponding to the target quantum cryptography service node through the corresponding quantum key distribution node according to the relay routing information.

[0031] In one or more embodiments, the target pricing key is a full pricing key or a partial pricing key of a complete pricing key.

[0032] Accordingly, an embodiment of the present invention discloses a user roaming system, which includes a user terminal, a quantum cryptography service management platform, an original quantum cryptography service node, and a target quantum cryptography service node;

[0033] The user terminal sends a query request for querying routing information to the quantum cryptography service management platform;

[0034] The quantum cryptography service management platform obtains a query request for querying routing information sent by a user terminal;

[0035] If the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, the quantum cryptography service management platform or the user terminal sends a target charging key distribution request to the original quantum cryptography service node;

[0036] The original quantum cryptography service node sends the target injection key to the target quantum cryptography service node in response to the target injection key distribution request;

[0037] The quantum cryptography service management platform sends the first node information of the target quantum cryptography service node to the user terminal;

[0038] When the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

[0039] Accordingly, an embodiment of the present invention discloses an electronic device, including: a processor, a memory, and a computer program stored in the memory and capable of running on the processor, and when the computer program is executed by the processor, each step of the above-mentioned user roaming method embodiment is implemented.

[0040] Accordingly, an embodiment of the present invention discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, each step of the above-mentioned user roaming method embodiment is implemented.

[0041] The embodiments of the present invention include the following advantages:

[0042] After obtaining the query request for querying routing information sent by the user terminal, the quantum cryptography service management platform can determine the user charging location corresponding to the user terminal and the target quantum cryptography service node closest to the user terminal based on the query request; if the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, a target charging key distribution request is sent to the original quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the target quantum cryptography service node; and then the first node information of the target quantum cryptography service node is sent to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target charging key. In this way, when the user terminal moves across domains, causing the quantum cryptography service node that the user terminal needs to connect to be different from the quantum cryptography service node corresponding to the user's charging location, the quantum cryptography service node corresponding to the user's charging location can be notified to send the charging key to the quantum cryptography service node that the user terminal needs to connect to. When the user terminal successfully establishes a connection with the quantum cryptography service node that needs to be connected, the quantum cryptography service node that needs to be connected can use the charging key to verify the user terminal, thereby ensuring the security of the user terminal's cross-domain movement. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 is a flow chart of steps of an embodiment of a user roaming method of the present invention;

[0044] Figure 2 is a schematic diagram of the architecture of the user roaming system of the present invention;

[0045] Figure 3 It is a structural block diagram of an embodiment of a user roaming device of the present invention. DETAILED DESCRIPTION

[0046] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0047] One of the core concepts of the embodiments of the present invention is that, when a user terminal moves across domains, resulting in the quantum cryptography service node that the user terminal needs to connect to being different from the quantum cryptography service node corresponding to the user charging location, the quantum cryptography service node corresponding to the user charging location can be notified to send the charging key to the quantum cryptography service node that the user terminal needs to connect to. When the user terminal successfully establishes a connection with the quantum cryptography service node that needs to be connected, the quantum cryptography service node that needs to be connected can use the charging key to verify the user terminal, thereby ensuring the security of the cross-domain movement of the user terminal.

[0048] Reference Figure 1 , shows a step flow chart of an embodiment of a user roaming method of the present invention, which can be applied to a quantum cryptography service management platform, and the quantum cryptography service management platform can be deployed in a user roaming system.

[0049] Reference Figure 2 , shows a schematic diagram of the architecture of the user roaming system. Specifically, the user roaming system may include a user terminal, a quantum cryptography service management platform, a quantum cryptography service node and a QKD (Quantum Key Distribution) node.

[0050] The quantum cryptography service management platform includes all quantum cryptography service node data and user data. All built and deployed quantum cryptography service nodes will be registered in the quantum cryptography service management platform, and the quantum cryptography service nodes and the quantum cryptography service management platform are connected in one direction.

[0051] Quantum cryptography service nodes provide encryption key and identity authentication functions.

[0052] QKD is a secure way to transmit keys, which can be used to send keys between two distant communication terminals. In the process of confidential communication, keys are needed to encrypt and decrypt information, and the security of the keys ensures the security of the information. The existing actual quantum key distribution system mainly uses the BB84 protocol, which was proposed by Bennett and Brassard in 1984. Unlike the classical cryptographic system, the security of quantum key distribution is based on the basic principles of quantum mechanics. Even if the eavesdropper controls the channel line, as long as the eavesdropper does not have the ability to break into the legitimate user's device, quantum key distribution technology can allow spatially separated users to share secure keys. The academic community calls this security "information-theoretic security" (also known as "unconditional security"), which refers to security with rigorous mathematical proof.

[0053] Since QKD technology was proposed in 1984, it has been studied for more than 30 years and has achieved fruitful results. From the BB84 protocol that encodes the polarization or phase of photons in the initial discrete variables, to the E91 protocol based on entangled light sources, the DPS protocol and COW protocol in the phase distributed reference protocol, and even the continuous variable QKD protocol and the measurement device independent (MDI-QKD) protocol, progress has been made in theory and experiment. At the same time, the production of QKD commercial systems, the construction of QKD networks, and the research on QKD applications around the world also mark the progress of QKD technology towards practical application.

[0054] Unlike existing cryptographic technologies, the security of QKD is based on physical principles. Its basic method is to use quantum states to encode information, and to achieve the purpose of securely distributing random numbers, i.e. keys, by preparing, transmitting and detecting quantum states. The regulations for encoding, transmitting and measuring methods of quantum states are called QKD protocols. The security of the QKD protocol is based on the following quantum physical principles:

[0055] A single quantum is indivisible. A quantum is the smallest unit of change in a physical quantity, and a single quantum is indivisible. If quantum key distribution uses a single quantum (usually a single photon) as an information carrier, an attacker cannot obtain key information by stealing part of a single quantum and measuring its state.

[0056] Unknown single quantum states cannot be accurately measured. According to the Heisenberg uncertainty principle, a pair of non-commutative quantum quantities cannot be accurately measured at the same time. An eavesdropper may want to intercept a single photon and measure its state, and then send a new photon to the receiver based on the measurement result. However, according to the Heisenberg uncertainty principle, the eavesdropper cannot accurately measure the state of the intercepted photon, and the retransmitted photon cannot be consistent with the original photon. Therefore, the sender and receiver can detect the eavesdropper's measurement of the photon, thereby verifying the security of the key established between them.

[0057] Unknown single quantum states cannot be accurately copied. An eavesdropper may want to intercept a single photon and then copy it to eavesdrop, but the no-cloning principle of quantum mechanics ensures that unknown quantum states cannot be accurately copied.

[0058] The security of quantum key distribution is based on the basic principles of quantum mechanics as described above. It does not rely on the requirements and assumptions of computational complexity. Its security and theoretical completeness can be fully guaranteed. Even under the condition that quantum computing technology is mature, its key distribution process has reliable security. Quantum key distribution can effectively deal with the serious threats to traditional cryptographic systems brought by the rapid development of computing technology and quantum computing.

[0059] QKD nodes can be based on internationally used quantum key distribution protocols such as BB84 protocol and BBM92, so that both communicating parties can generate and share a random, secure key for encrypting and decrypting messages.

[0060] Furthermore, an access routing service can be deployed in the quantum cryptography service management platform, and the access routing service is used to query routing information. Of course, the access routing service can also be deployed independently from the quantum cryptography service management platform. In the embodiment of the present invention, the deployment of the access routing service in the quantum cryptography service management platform is used as an example for explanation. In actual applications, the deployment method of the access routing service can be adjusted according to actual needs, and the embodiment of the present invention does not limit this.

[0061] The specific steps may include:

[0062] Step 101: obtaining a query request for querying routing information sent by a user terminal.

[0063] Specifically, when the user terminal establishes a connection with the quantum cryptography service node, it can initiate a query request to the access routing service to query the routing information of the user terminal. In other words, the access routing service in the quantum cryptography management service management platform can obtain the query request initiated by the user terminal in real time.

[0064] Step 102: determining, based on the query request, a user charging location corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal.

[0065] Since the quantum cryptography service management platform includes all quantum cryptography service node data and user data, after obtaining the query request, the user charging location corresponding to the user terminal (the user charging location belongs to "user data") and the quantum cryptography service node closest to the user terminal can be determined according to the query request (the quantum cryptography service node belongs to "quantum cryptography service node data"; for easy distinction, it is recorded as "target quantum cryptography service node").

[0066] In an embodiment of the present invention, determining the user charging location corresponding to the user terminal and the target quantum cryptography service node closest to the user terminal based on the query request includes:

[0067] Using the terminal information of the user terminal in the query request to query, obtain the user charging location corresponding to the user terminal;

[0068] The address information in the query request is used to query to obtain the target quantum cryptography service node closest to the user terminal.

[0069] Specifically, since the query request may include the terminal information of the user terminal, after obtaining the query request, the quantum cryptography service management platform may query the user data according to the terminal information to obtain the user charging location corresponding to the user terminal.

[0070] Furthermore, the query request may also include the address information of the query request, such as an IP (Internet Protocol) address. In this way, after obtaining the query request, the quantum cryptography service management platform may also query the quantum cryptography service node data according to the address information to obtain the target quantum cryptography service node closest to the user terminal.

[0071] Step 103: If the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, a target charging key distribution request is sent to the original quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the quantum key distribution node corresponding to the target quantum cryptography service node through the corresponding quantum key distribution node.

[0072] After determining the user charging location and the target quantum cryptography service node, the quantum cryptography service management platform can detect whether the quantum cryptography service node corresponding to the user charging location (referred to as the "original quantum cryptography service node") is the same as the target quantum cryptography service node.

[0073] If the two are not the same, a distribution request for the target injection key can be sent to the original quantum cryptography service node. After obtaining the target injection key distribution request, the original quantum cryptography service node sends the target injection key of the user terminal through the corresponding quantum key distribution node (referred to as the "original quantum key distribution node") to the quantum key distribution node corresponding to the target quantum cryptography service node (referred to as the "target quantum key distribution node"), and the target quantum cryptography service node can obtain the target injection key from the target quantum key distribution node.

[0074] In an embodiment of the present invention, the step of sending a target injection key distribution request to the original quantum cryptography service node includes:

[0075] Sending a target injection key distribution request directly to the original quantum cryptography service node;

[0076] or,

[0077] The second node information of the original quantum cryptography service node is sent to the user terminal, so that the user terminal uses the second node information to send a target injection key distribution request to the original quantum cryptography service node.

[0078] Specifically, the quantum cryptography service management platform can send a target injection key distribution request directly to the original quantum cryptography service node through the access routing service.

[0079] The quantum cryptography service management platform can also send the node information of the original quantum cryptography service node (recorded as "second node information") to the user terminal through the access routing service. After the user terminal obtains the second node information, it indicates that the original quantum cryptography service node is different from the target quantum cryptography service node. At this time, the user terminal can use the second node information to send a target injection key distribution request to the original quantum cryptography service node.

[0080] Furthermore, a quantum security middleware may be provided in the user terminal, and the quantum security middleware is used to process key reading, data encryption and interaction with the quantum cryptography management service system on the quantum security chip. Based on this, the user terminal may use the quantum security middleware to send a target injection key distribution request. Of course, the user terminal may also use other methods to send a target injection key distribution request to the original quantum cryptography service node. In practical applications, the specific method of sending may be set according to actual needs, and the embodiment of the present invention does not limit this.

[0081] Furthermore, after obtaining the target injection key distribution request, the original quantum cryptography service node can obtain the relay routing information of the quantum network, and then send the target injection key to the target quantum cryptography service node according to the relay routing information.

[0082] It should be noted that the target charging key can be the entire charging key of the complete charging key, or it can be a partial charging key of the complete charging key. That is to say, in the embodiment of the present invention, it can be selected whether to obtain the complete charging key according to the needs. For example, when the bandwidth of the quantum network is low, it can be selected to obtain the partial charging key for verification from the complete charging key. When the bandwidth of the quantum network is high, it can be selected to obtain the complete charging key. In practical applications, whether to obtain the complete charging key can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0083] Step 104: Send the first node information of the target quantum cryptography service node to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

[0084] After determining the target quantum cryptography service node, the quantum cryptography service management platform can send the node information of the target quantum cryptography service node (referred to as "first node information") to the user terminal.

[0085] After obtaining the first node information, the user terminal can use the first node information to establish a connection with the target quantum cryptography service node. When the connection is successfully established, the target quantum cryptography service node can use the target injection key to authenticate the user terminal.

[0086] In an embodiment of the present invention, after obtaining a query request for querying routing information sent by a user terminal, the quantum cryptography service management platform can determine the user charging location corresponding to the user terminal and the target quantum cryptography service node closest to the user terminal based on the query request; if the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, a target charging key distribution request is sent to the original quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the target quantum cryptography service node; and then the first node information of the target quantum cryptography service node is sent to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target charging key. In this way, when the user terminal moves across domains, causing the quantum cryptography service node that the user terminal needs to connect to be different from the quantum cryptography service node corresponding to the user's charging location, the quantum cryptography service node corresponding to the user's charging location can be notified to send the charging key to the quantum cryptography service node that the user terminal needs to connect to. When the user terminal successfully establishes a connection with the quantum cryptography service node that needs to be connected, the quantum cryptography service node that needs to be connected can use the charging key to verify the user terminal, thereby ensuring the security of the user terminal's cross-domain movement.

[0087] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0088] Reference Figure 3 , shows a structural block diagram of an embodiment of a user roaming device of the present invention, which may specifically include the following modules:

[0089] The acquisition module 301 is used to acquire a query request sent by a user terminal for querying routing information;

[0090] A determination module 302 is used to determine a user charging location corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal based on the query request;

[0091] A sending module 303 is used to send a target charging key distribution request to the original quantum cryptography service node if the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the target quantum cryptography service node;

[0092] The sending module is further used to send the first node information of the target quantum cryptography service node to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

[0093] In the embodiment of the present invention, the determining module is specifically used to:

[0094] Using the terminal information of the user terminal in the query request to query, obtain the user charging location corresponding to the user terminal;

[0095] The address information in the query request is used to query to obtain the target quantum cryptography service node closest to the user terminal.

[0096] In the embodiment of the present invention, the sending module is specifically used for:

[0097] Sending a target injection key distribution request directly to the original quantum cryptography service node;

[0098] or,

[0099] The second node information of the original quantum cryptography service node is sent to the user terminal, so that the user terminal uses the second node information to send a target injection key distribution request to the original quantum cryptography service node.

[0100] In an embodiment of the present invention, the original quantum cryptography service node responds to the target injection key distribution request by acquiring relay routing information of the quantum network and sending the target injection key to the target quantum cryptography service node according to the relay routing information.

[0101] In the embodiment of the present invention, the target charging key is the entire charging key or a partial charging key of the complete charging key.

[0102] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0103] The embodiment of the present invention further provides a user roaming system, the user roaming system comprising a user terminal, a quantum cryptography service management platform, an original quantum cryptography service node and a target quantum cryptography service node;

[0104] The user terminal sends a query request for querying routing information to the quantum cryptography service management platform;

[0105] The quantum cryptography service management platform obtains a query request for querying routing information sent by a user terminal;

[0106] If the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, the quantum cryptography service management platform or the user terminal sends a target charging key distribution request to the original quantum cryptography service node;

[0107] The original quantum cryptography service node sends the target injection key to the target quantum cryptography service node in response to the target injection key distribution request;

[0108] The quantum cryptography service management platform sends the first node information of the target quantum cryptography service node to the user terminal;

[0109] When the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

[0110] Specifically, when the user terminal establishes a connection with the quantum cryptography service node, it can initiate a query request to the access routing service to query the routing information of the user terminal. In other words, the access routing service in the quantum cryptography management service management platform can obtain the query request initiated by the user terminal in real time.

[0111] Since the quantum cryptography service management platform includes all quantum cryptography service node data and user data, after obtaining the query request, the user charging location corresponding to the user terminal (the user charging location belongs to "user data") and the quantum cryptography service node closest to the user terminal can be determined according to the query request (the quantum cryptography service node belongs to "quantum cryptography service node data"; for easy distinction, it is recorded as "target quantum cryptography service node").

[0112] In an embodiment of the present invention, determining the user charging location corresponding to the user terminal and the target quantum cryptography service node closest to the user terminal based on the query request includes:

[0113] Using the terminal information of the user terminal in the query request to query, obtain the user charging location corresponding to the user terminal;

[0114] The address information in the query request is used to query to obtain the target quantum cryptography service node closest to the user terminal.

[0115] Specifically, since the query request may include the terminal information of the user terminal, after obtaining the query request, the quantum cryptography service management platform may query the user data according to the terminal information to obtain the user charging location corresponding to the user terminal.

[0116] Furthermore, the query request may also include the address information of the query request, such as an IP (Internet Protocol) address. In this way, after obtaining the query request, the quantum cryptography service management platform may also query the quantum cryptography service node data according to the address information to obtain the target quantum cryptography service node closest to the user terminal.

[0117] After determining the user charging location and the target quantum cryptography service node, the quantum cryptography service management platform can detect whether the quantum cryptography service node corresponding to the user charging location (referred to as the "original quantum cryptography service node") is the same as the target quantum cryptography service node.

[0118] If the two are not the same, a distribution request for the target injection key can be sent to the original quantum cryptography service node. After obtaining the target injection key distribution request, the original quantum cryptography service node sends the target injection key of the user terminal through the corresponding quantum key distribution node (referred to as the "original quantum key distribution node") to the quantum key distribution node corresponding to the target quantum cryptography service node (referred to as the "target quantum key distribution node"), and the target quantum cryptography service node can obtain the target injection key from the target quantum key distribution node.

[0119] In an embodiment of the present invention, the step of sending a target injection key distribution request to the original quantum cryptography service node includes:

[0120] Sending a target injection key distribution request directly to the original quantum cryptography service node;

[0121] or,

[0122] The second node information of the original quantum cryptography service node is sent to the user terminal, so that the user terminal uses the second node information to send a target injection key distribution request to the original quantum cryptography service node.

[0123] Specifically, the quantum cryptography service management platform can send a target injection key distribution request directly to the original quantum cryptography service node through the access routing service.

[0124] The quantum cryptography service management platform can also send the node information of the original quantum cryptography service node (recorded as "second node information") to the user terminal through the access routing service. After the user terminal obtains the second node information, it indicates that the original quantum cryptography service node is different from the target quantum cryptography service node. At this time, the user terminal can use the second node information to send a target injection key distribution request to the original quantum cryptography service node.

[0125] Furthermore, a quantum security middleware may be provided in the user terminal, and the quantum security middleware is used to process key reading, data encryption and interaction with the quantum cryptography management service system on the quantum security chip. Based on this, the user terminal may use the quantum security middleware to send a target injection key distribution request. Of course, the user terminal may also use other methods to send a target injection key distribution request to the original quantum cryptography service node. In practical applications, the specific method of sending may be set according to actual needs, and the embodiment of the present invention does not limit this.

[0126] Furthermore, after obtaining the target injection key distribution request, the original quantum cryptography service node can obtain the relay routing information of the quantum network, and then send the target injection key to the target quantum cryptography service node according to the relay routing information.

[0127] It should be noted that the target charging key can be the entire charging key of the complete charging key, or it can be a partial charging key of the complete charging key. That is to say, in the embodiment of the present invention, it can be selected whether to obtain the complete charging key according to the needs. For example, when the bandwidth of the quantum network is low, it can be selected to obtain the partial charging key for verification from the complete charging key. When the bandwidth of the quantum network is high, it can be selected to obtain the complete charging key. In practical applications, whether to obtain the complete charging key can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0128] After determining the target quantum cryptography service node, the quantum cryptography service management platform can send the node information of the target quantum cryptography service node (referred to as "first node information") to the user terminal.

[0129] After obtaining the first node information, the user terminal can use the first node information to establish a connection with the target quantum cryptography service node. When the connection is successfully established, the target quantum cryptography service node can use the target injection key to authenticate the user terminal.

[0130] In an embodiment of the present invention, when a user terminal moves across domains, resulting in the quantum cryptography service node that the user terminal needs to connect to being different from the quantum cryptography service node corresponding to the user charging location, the quantum cryptography service node corresponding to the user charging location can be notified to send the charging key to the quantum cryptography service node that the user terminal needs to connect to. When the user terminal successfully establishes a connection with the quantum cryptography service node that needs to be connected, the quantum cryptography service node that needs to be connected can use the charging key to verify the user terminal, thereby ensuring the security of the cross-domain movement of the user terminal.

[0131] An embodiment of the present invention further provides an electronic device, including:

[0132] It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, each process of the above-mentioned user roaming method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0133] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned user roaming method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0134] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0135] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0136] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0137] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0138] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0139] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0140] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0141] The user roaming method and the user roaming device provided by the present invention are introduced in detail above. The principle and implementation mode of the present invention are explained by using specific examples in this article. The description of the above embodiments is only used to help understand the method and the core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation mode and the scope of application. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A user roaming method, characterized in that: The method comprises: Obtaining a query request sent by a user terminal for querying routing information; Determine, based on the query request, a user charging location corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal; If the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, a target charging key distribution request is sent to the original quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the target quantum cryptography service node; The first node information of the target quantum cryptography service node is sent to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

2. The user roaming method according to claim 1, characterized in that: The determining, based on the query request, a user charging location corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal comprises: Using the terminal information of the user terminal in the query request to query, obtain the user charging location corresponding to the user terminal; The address information in the query request is used to query to obtain the target quantum cryptography service node closest to the user terminal.

3. The user roaming method according to claim 1, characterized in that: The sending a target injection key distribution request to the original quantum cryptography service node comprises: Sending a target injection key distribution request directly to the original quantum cryptography service node; or, The second node information of the original quantum cryptography service node is sent to the user terminal, so that the user terminal uses the second node information to send a target injection key distribution request to the original quantum cryptography service node.

4. The user roaming method according to claim 1, characterized in that: The original quantum cryptography service node responds to the target injection key distribution request by acquiring the relay routing information of the quantum network and sends the target injection key to the quantum key distribution node corresponding to the target quantum cryptography service node through the corresponding quantum key distribution node according to the relay routing information.

5. The user roaming method according to claim 1 or 4, characterized in that: The target charging key is the entire charging key or a partial charging key of the complete charging key.

6. A user roaming device, characterized in that: The device comprises: An acquisition module, used to acquire a query request sent by a user terminal for querying routing information; A determination module, configured to determine, based on the query request, a user charging location corresponding to the user terminal and a target quantum cryptography service node closest to the user terminal; A sending module, configured to send a target charging key distribution request to the original quantum cryptography service node if the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, so that the original quantum cryptography service node responds to the target charging key distribution request and sends the target charging key to the target quantum cryptography service node; The sending module is further used to send the first node information of the target quantum cryptography service node to the user terminal, so that when the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

7. The user roaming device according to claim 6, characterized in that: The determination module is specifically used for: Using the terminal information of the user terminal in the query request to query, obtain the user charging location corresponding to the user terminal; The address information in the query request is used to query to obtain the target quantum cryptography service node closest to the user terminal.

8. A user roaming system, characterized in that: The user roaming system includes a user terminal, a quantum cryptography service management platform, an original quantum cryptography service node and a target quantum cryptography service node; The user terminal sends a query request for querying routing information to the quantum cryptography service management platform; The quantum cryptography service management platform obtains a query request for querying routing information sent by a user terminal; If the original quantum cryptography service node corresponding to the user charging location is different from the target quantum cryptography service node, the quantum cryptography service management platform or the user terminal sends a target charging key distribution request to the original quantum cryptography service node; The original quantum cryptography service node sends the target injection key to the target quantum cryptography service node in response to the target injection key distribution request; The quantum cryptography service management platform sends the first node information of the target quantum cryptography service node to the user terminal; When the user terminal establishes a connection with the target quantum cryptography service node based on the first node information, the target quantum cryptography service node verifies the user terminal based on the target injection key.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the steps of the user roaming method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the user roaming method according to any one of claims 1 to 5 are implemented.

Images