5G quantum encryption communication method and device based on RedCap

Abstract

The 5G RedCap quantum encryption method and the 5G RedCap quantum encryption device which are oriented to wireless public network access and support 5G communication, quantum keys and an IPSec protocol are formed by taking productization, practicability and light weight as targets, the quantum keys which are distributed in real time based on a quantum key service platform and are better in randomness and faster in updating frequency are adopted to construct a quantum encryption tunnel, and the quantum encryption efficiency is improved. And the data security of the 5G wireless channel for transmitting real-time service information, running state monitoring and the like is improved. Based on the 5G RedCap quantum CPE terminal, safe, efficient and reliable access of power distribution automation, unmanned aerial vehicle inspection and inspection robot business can be realized, so that the safe access level of power business is improved.

Description

Technical Field

[0001] The patent of this invention relates to the field of quantum secure communication technology, and specifically to a 5G quantum encryption communication method and device based on RedCap. Background Art

[0002] At present, new power system businesses such as distribution automation, drone inspections and inspection robots are growing rapidly, data interaction between terminals and business master stations is becoming more frequent, and there is a risk of data transmission security being cracked.

[0003] Quantum secure communication technology is based on the basic principles of quantum mechanics and combined with Shannon's "one-time one-pad" theory, which can realize unconditional secure communication in information theory and provide a new technical means for power grid security. In the field of power grids, quantum secure communication technology is mainly aimed at the terminal business nodes of the power grid, deploying 4G / 5G quantum CPE terminals, building a quantum key service platform, realizing offline filling and online distribution of quantum keys, and relying on 5G network to transmit back to the main station for real-time business information and operation status monitoring data of the power grid.

[0004] However, the existing 5G quantum encryption communication technology and terminals have high power consumption and low resource utilization, making them difficult to promote on a large scale. Therefore, a lightweight 5G quantum encryption communication method is urgently needed. Summary of the invention

[0005] In order to solve the problems of high power consumption and low resource utilization of existing 5G quantum encryption communication technology and terminals, the present invention provides a 5G quantum encryption communication method based on RedCap, comprising:

[0006] S1. The 5G RedCap quantum CPE terminal initiates network access authentication to the quantum cryptographic service platform based on the preset injection key;

[0007] S2. After the quantum cryptographic service platform passes the network access authentication test, it establishes an application session between the 5G RedCap quantum CPE terminal and the quantum encryption gateway, and applies for a session key from the quantum cryptographic service platform;

[0008] S3, compare the consistency of the session key in the quantum encryption gateway and the session key that the quantum cryptographic service platform is going to send to the 5G RedCap quantum CPE terminal, and dispatch the session key that passes the consistency comparison to the 5G RedCap quantum CPE terminal;

[0009] The S4 and 5G RedCap quantum CPE terminals decrypt the session keys issued by the quantum cryptographic service platform, obtain the session key plaintext data, and then use the session key to encrypt the business data plaintext, and finally obtain the business data ciphertext for data transmission.

[0010] Furthermore, the 5G RedCap quantum CPE terminal supports offline charging / online distribution of quantum keys, supports 3GPP Release 17 (5G RedCap) protocol, supports 4G / 5G communications, supports the national secret standard IPSec protocol to achieve encrypted tunnel communications, supports national secret SM2, SM3, and SM4 algorithm encryption, and supports the use of TR069 protocol to achieve remote network management.

[0011] Furthermore, the pre-set charging key of the 5G RedCap quantum CPE terminal is a QRNG key, which is charged using encryption hardware, and the encryption hardware is a U shield or TF card.

[0012] Furthermore, the specific steps of the network access authentication are as follows:

[0013] Step 11: After the 5G RedCap quantum CPE terminal device is started, it initiates the first frame of network access authentication to the quantum secret service platform;

[0014] Step 12: After receiving the first frame of network access authentication, the quantum cryptographic service platform queries the exchange cipher information and charging key information that provide the preset charging key source from the database;

[0015] Step 13: The quantum secret service platform selects the charging key identifier from the queried charging key information, generates a random number a, returns the charging key identifier and random number a to the 5G RedCap quantum CPE terminal, and completes the response to the first frame of the network access authentication;

[0016] Step 14: After the 5G RedCap quantum CPE terminal receives the response of the first frame of network access, it parses the response to obtain the injection key identifier and random number a;

[0017] Step 15: The encryption hardware generates a random number b as local information for authentication confirmation, finds the charging key ciphertext in the charging key file according to the charging key identifier, and decrypts it to obtain the charging key plaintext; uses the CBC_MAC algorithm of the national encryption algorithm SM4 to calculate the authentication check code MAC1, and immediately destroys the charging key used this time;

[0018] Step 16: The encryption hardware returns the calculated authentication verification code MAC1 to the 5G RedCap quantum CPE terminal, and at the same time sends the authentication verification code MAC1, random number a, random number b, and injection key identifier to the quantum cryptographic service platform to initiate the second frame of network access authentication;

[0019] Step 17: After receiving the second frame of the network access authentication, the quantum cryptographic service platform queries the random number a and the injection key identifier used for authentication from the local cache, and compares them with the information of the first frame of the network access authentication. If the comparison results are consistent, an instruction to calculate the authentication MAC is sent to the exchange cipher described in step 1;

[0020] Step 18: The exchange cipher machine searches the quantum key storage library for the corresponding charging key ciphertext according to the charging key identifier provided by the quantum key service platform, decrypts it using the internal cipher card, and returns the obtained authentication verification code MAC2 to the quantum key service platform;

[0021] Step 19: The quantum secret service platform compares the two authentication verification codes MAC1 and MAC2. If the comparison results are consistent, an authentication token is generated for the 5G RedCap quantum CPE terminal, and a validity period is set for the authentication token;

[0022] Step 110: The 5G RedCap quantum CPE terminal obtains the authentication token, completes the network access authentication, and obtains the session key online within the validity period of the authentication token.

[0023] Furthermore, the S2 comprises the following steps:

[0024] Step 21: Use the 5G RedCap quantum CPE terminal as the sender and the quantum encryption gateway as the receiver to establish an application session and apply for a session key from the quantum encryption service platform;

[0025] Step 22: After the quantum cryptographic service platform verifies the identity authentication token, it queries the exchange cipher equipment information of the sender and the receiver, and sends session key acquisition instructions to the exchange cipher machines of the sender and the receiver respectively;

[0026] Step 23: The exchange cipher machine at the sending end receives the session key acquisition instruction and returns the sender's session key to the quantum cryptographic service platform. The key ciphertext pre-charged in the 5G RedCap quantum CPE terminal and the session key ciphertext to be output are decrypted in the cipher card of the exchange cipher machine at the sending end, and the decrypted charge key plaintext is used to encrypt the session key plaintext to obtain the session key ciphertext; at the same time, the receiving end has the same session key as the sending end with the help of the QKD device.

[0027] Step 24: The quantum encryption service platform returns the sender's session key ciphertext to the 5G RedCap quantum CPE terminal, and temporarily caches the receiver's session key ciphertext locally, waiting for the receiver's quantum encryption gateway to obtain it.

[0028] Further, the S4 comprises the following steps:

[0029] Step 41: The power service terminal sends service data to the locally connected 5G RedCap quantum CPE terminal;

[0030] Step 42: The 5G RedCap quantum CPE terminal uses the internal encryption hardware to decrypt the session key ciphertext, calls the cryptographic module of the encryption hardware to encrypt the service data plaintext, and returns the service data ciphertext to the 5G RedCap quantum CPE terminal, which is then sent to the quantum encryption gateway via the wireless network.

[0031] Step 43: After receiving the business data ciphertext, the quantum encryption gateway performs data parsing and then calls the internal encryption hardware for decryption;

[0032] Step 44: The encryption hardware of the quantum encryption gateway returns the decrypted business data to the quantum encryption gateway, and the quantum encryption gateway sends the business data in plain text to the business master station system.

[0033] Furthermore, S4 uses physical hardware mechanisms to ensure the security of business data encryption and decryption. The decryption of session key ciphertext is only implemented when business data needs to be encrypted and decrypted, and the operations of session key ciphertext decryption and business data encryption and decryption are all performed in the encryption hardware.

[0034] The present invention also discloses a 5G quantum encryption communication device based on RedCap. When the device is running, the steps of the above method can be implemented. The device includes:

[0035] 5G RedCap quantum CPE terminal, used to charge quantum keys; use session keys to encrypt plaintext business data; establish application calls with quantum encryption gateways to transmit encrypted business data;

[0036] The quantum secret service platform is used to compare the consistency of session keys; authenticate the 5G RedCap quantum CPE terminal for network access; and issue session keys;

[0037] Quantum encryption gateway, used to receive encrypted business data and decrypt the encrypted business data.

[0038] Beneficial effects: The present invention has overcome the fusion technology of 5G wireless communication, IPsec protocol, RedCap and quantum encryption, and proposed a "5G+quantum+channel encryption" application solution based on RedCap and a 5G RedCap quantum CPE device that supports 5G communication, quantum key and IPSec protocol. Based on the real-time updated quantum key, a quantum encryption tunnel is constructed to solve the problems of insufficient access flexibility of power grid terminal business terminals such as distribution automation, drone inspection and inspection robots, and low data collection security and reliability. While improving the security of 5G wireless channel transmission business data, it effectively reduces the complexity of data encryption and the cost of device research and development. It is a lightweight 5G quantum encryption communication method. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a structural diagram of the 5G RedCap quantum CPE terminal hardware architecture;

[0040] Figure 2 This is the structural diagram of the 5G RedCap quantum CPE terminal software architecture;

[0041] Figure 3 This is a schematic diagram of the 5G RedCap quantum CPE terminal network access certification process;

[0042] Figure 4 This is a schematic diagram of the process of 5G RedCap quantum CPE terminal obtaining session keys;

[0043] Figure 5 It is a schematic diagram of the session key consistency comparison process;

[0044] Figure 6 This is a schematic diagram of the process of 5G RedCap quantum CPE terminal establishing an encrypted tunnel to encrypt and decrypt business data;

[0045] Figure 7 This is a schematic diagram of the process of online distribution of 5G RedCap quantum CPE terminal quantum encryption to instances. DETAILED DESCRIPTION

[0046] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, various equivalent forms of modifications to the present invention by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0047] The 5G RedCap quantum CPE terminal is developed in accordance with the principles of "lightweight, stability first, shared reuse, and interface specification". On the premise of ensuring business application requirements, non-essential functions are cut based on the general architecture of wireless encryption communication equipment to achieve lightweight design of quantum encryption equipment and meet differentiated requirements in power consumption, form, interface, electromagnetic compatibility, etc. The specific functions of the 5G RedCap quantum CPE terminal meet the following requirements:

[0048] Supports offline charging / online distribution of quantum keys, supports 3GPP Release 17 (5G RedCap) protocol, supports 4G / 5G communications, supports switching between quantum keys and classical keys, supports national standard IPSec protocol to achieve encrypted tunnel communication, supports national standard SM2, SM3, and SM4 algorithm encryption, and supports remote network management using TR069 protocol.

[0049] According to the application requirements of different business scenarios, the 5G RedCap quantum CPE terminal is designed based on application form, power supply mode, overall power consumption requirements, main control CPU processing power, memory configuration, peripheral resource configuration, protection level, communication capability and performance indicators. In this embodiment, the hardware platform architecture is divided into functional modules, such as Figure 1 The main hardware configuration is as follows:

[0050] DDR RAM memory of no less than 4Gbit; FLASH storage of no less than 4Gbit; 4G or 5G wireless communication modules can be used according to on-site requirements, and Ethernet port transmission can also be used; Ethernet port communication or RS232 serial port communication can be used according to on-site requirements; USIM card or eSIM chip can be used according to on-site requirements; quantum security TF card for storing quantum charging keys, which is used for identity authentication with the quantum secret service platform and protection of obtaining session keys.

[0051] In this embodiment, the software system of the 5G RedCap quantum CPE terminal is as follows Figure 2 As shown in the figure, according to the characteristics of power business, it can be divided into two parts: underlying software and application software.

[0052] Bottom-level software: mainly includes the tailored Linux kernel, bottom-level drivers, and related software supporting application development.

[0053] According to the interface requirements of the terminal, the underlying drivers include serial port, USB, and network card drivers. The USB serial port connected to the communication module can be virtualized into a network port to facilitate the network communication design of the application layer. In addition, it also includes storage management of Flash and RAM underlying operation drivers and kernel clock management. Other default kernel-related drivers such as process management and interrupts use modules that come with the operating system. The underlying software should also include the establishment of UBI or ramdisk file system, the transplantation of TCP / IP protocol stack, the establishment of related library files, and the integration of compilers.

[0054] Application software: mainly includes quantum encryption authentication module, serial port forwarding module, data communication module, configuration management module and communication network management module, etc.

[0055] The quantum encryption authentication module is responsible for identity authentication and obtaining quantum keys with the quantum cryptographic service platform, and at the same time, it conducts identity authentication and key negotiation based on digital certificates with the peer gateway to establish a quantum encryption tunnel; the serial port forwarding module is responsible for connecting serial port type business terminals. After the device establishes a socket with the main station, the serial port data is packaged into TCP / IP packets and forwarded to the main station; the data communication module is responsible for the dial-up of the wireless module, reading the Ethernet port communication data, and forwarding the data; the configuration management module is responsible for managing the relevant parameters, configuration, parameter storage, etc. of the system, and provides configuration and parameter support for other modules; the communication network management module is responsible for the system's fault alarm, parameter configuration, remote upgrade, status monitoring, log download, and remote reset, providing communication support for communication equipment to meet the wireless communication resource management and integrated monitoring system.

[0056] Next, the 5G quantum encryption communication method described in the present invention will be further described in combination with this embodiment.

[0057] S1. The 5G RedCap quantum CPE terminal initiates network access authentication to the quantum cryptographic service platform based on the preset QRNG injection key. The detailed process of the 5G RedCap quantum CPE terminal performing network access authentication to the quantum cryptographic service platform is as follows: Figure 3 The specific steps of S1 are as follows:

[0058] Step 11: After the 5G RedCap quantum CPE terminal device is started, it initiates the first frame of network access authentication to the quantum secret service platform, and uploads the device application information and the connected U shield / TF card information to the quantum secret service platform through the HTTPS protocol.

[0059] Step 12: After receiving the first frame of network authentication, the quantum cryptographic service platform starts to query the database for information about the exchange cipher machine that provides the preset charging key source for the U-Shield / TF card and related information about the charging key in the U-Shield / TF card.

[0060] Step 13: The quantum secret service platform selects the injection key identifier required for this network access authentication from the queried injection key information, and generates a random number a for authentication. At the same time, the selected key identifier information and random number a are also cached inside the quantum secret service platform. Finally, the injection key identifier and random number a are returned to the 5G RedCap quantum CPE terminal to complete the response to the first frame of the network access authentication.

[0061] Step 14: After the 5G RedCap quantum CPE terminal receives the response to the first frame of network access, it parses the response to obtain the injection key identifier required for authentication and the random number a issued by the platform. The 5G RedCap quantum CPE terminal begins to call the quantum key and cryptographic algorithm in the U shield / TF card to calculate the authentication verification code MAC.

[0062] Step 15: The U-Shield / TF card generates a random number b as the local information for authentication confirmation of the 5G RedCap quantum CPE terminal, and then finds the ciphertext of the charging key in the key file according to the charging key identifier, and calls the cryptographic algorithm in the U-Shield / TF card to load the charging key ciphertext into the secure area in the U-Shield / TF card for decryption. Then, the decrypted charging key plaintext and random numbers a and b are used to calculate the authentication check code MAC1 using the CBC_MAC algorithm of the national secret algorithm SM4, and the charging key used this time is immediately destroyed.

[0063] Step 16: The U-Shield / TF card returns the calculated authentication verification code MAC1 to the 5G RedCap quantum CPE terminal, which then sends the authentication verification code MAC1, random numbers a, b, the injection key identifier used for authentication, and other information to the quantum secret service platform to initiate the second frame of network access authentication.

[0064] Step 17: After receiving the second frame of the network access authentication, the quantum cryptographic service platform queries the random number a and the injection key identifier used for authentication from the local cache, and compares them with the information in the first frame of the network access authentication to see if they are consistent. If the information is consistent, an instruction to calculate the authentication MAC is sent to the exchange cipher machine that provides the preset injection key source to the U-Shield / TF card.

[0065] Step 18: The exchange cipher machine searches for the corresponding charging key ciphertext in the quantum key storage library according to the charging key identifier for authentication provided by the quantum cryptographic service platform, uses the internal password card to call the charging key ciphertext for decryption, calculates the random numbers a and b used for authentication using the MAC calculation algorithm specified by the quantum cryptographic service platform, and finally returns the calculated authentication verification code MAC2 to the quantum cryptographic service platform.

[0066] Step 19: The quantum secret service platform compares the two authentication verification codes MAC1 and MAC2 to verify whether the two are consistent. If they are consistent, it generates an authentication token for the 5G RedCap quantum CPE terminal, sets a validity period for the authentication token, and caches the authentication token locally to ensure that one device account can only log in to one 5G RedCap quantum CPE terminal at a time, thereby enhancing the security of the device account.

[0067] Step 110: After the 5G RedCap quantum CPE terminal obtains the authentication token, it can obtain the session key online within the validity period of the authentication token. By default, the validity period of the authentication token is 24 hours. In the management interface of the quantum secret service platform, the validity period of the authentication token can be manually modified. When the validity period expires, the 5G RedCap quantum CPE terminal needs to log in again to obtain the authentication token.

[0068] S2. After the quantum cryptographic service platform passes the network access authentication, it establishes an application session between the 5G RedCap quantum CPE terminal and the quantum encryption gateway, and applies for a session key from the quantum cryptographic service platform. The detailed process of the 5G RedCap quantum CPE terminal obtaining the session key is as follows: Figure 4 The specific steps of S2 are as follows:

[0069] Step 21: After the 5G RedCap quantum CPE terminal establishes an application session with the quantum encryption gateway, it applies to the quantum encryption service platform for the session key required for service encryption based on the application session ID, the information of the sending 5G RedCap quantum CPE terminal, the information of the receiving quantum encryption gateway, and the identity authentication token.

[0070] Step 22: After the quantum encryption service platform verifies the identity authentication token of the 5G RedCap quantum CPE terminal, it queries the information of the exchange cipher device for charging the key for the U-shield / TF card in the sender and receiver based on the information of the sender's 5G RedCap quantum CPE terminal and the receiver's quantum encryption gateway, as well as the information of the charging keys of the sender and receiver.

[0071] Since the injection keys of the sender and the receiver come from different exchange cipher machines, in order to have the same session key between the two devices, the QKD device is required. In the process of obtaining the session key in this embodiment, the quantum secret service platform only needs to query whether the amount of quantum keys stored between the exchange cipher machines of the sender and the receiver is sufficient. If the amount of keys is sufficient, the quantum secret service platform will send session key acquisition instructions to the exchange cipher machines of the sender and the receiver respectively. If the amount of keys is insufficient, a quantum key generation instruction will be issued to the exchange cipher machine. Taking into account the number of terminal devices connected to the power system, the exchange cipher machine will take a local cache of a certain amount of quantum keys negotiated between QKD transceiver devices. When it is lower than the cache amount, the quantum key generation instruction will be automatically triggered, and the quantum key will be obtained from the QKD quantum network distribution system for supplementation to ensure that the amount of session keys between quantum application devices in the power system is sufficient.

[0072] Step 23: After receiving the session key acquisition instruction issued by the quantum secret service platform, the exchange cipher machine at the sending end locally queries the key ciphertext pre-charged in the 5G RedCap quantum CPE terminal at the sending end and the session key ciphertext to be output, decrypts the charging key ciphertext and the session key ciphertext in the password card of the exchange cipher machine at the sending end, and uses the decrypted charging key plaintext to encrypt the session key plaintext to obtain the session key ciphertext. In order to ensure the integrity of the transmission of the session key ciphertext, the transmitted information is generally signed using the SM3 national secret algorithm. Finally, the exchange cipher machine at the sending end returns the session key ciphertext and signature information to the quantum secret service platform. Similarly, the exchange cipher machine at the receiving end returns the session key ciphertext of the receiving end quantum encryption gateway under the unified scheduling of the quantum secret service platform.

[0073] Step 24: The quantum encryption service platform returns the session key ciphertext of the sender to the 5G RedCap quantum CPE terminal, and temporarily caches the session key ciphertext of the receiver locally, waiting for the receiver quantum encryption gateway to obtain it. This caching method greatly shortens the time taken by the quantum encryption gateway to obtain the session key, and improves the timeliness of decryption of power business data.

[0074] S3. Perform consistency comparison between the session key in the quantum encryption gateway and the session key that the quantum cryptographic service platform is going to send to the 5G RedCap quantum CPE terminal, and dispatch the session key that passes the consistency comparison to the 5G RedCap quantum CPE terminal. The consistency comparison process is as follows: Figure 5 As shown, for the session key to be sent to the 5G RedCap quantum CPE terminal, the quantum cryptographic service platform transmits the data carrying the hash value of N blocks of keys and the key number to the quantum encryption gateway, and compares it with the session key existing in the quantum encryption gateway. The quantum encryption gateway returns the key number and verification result.

[0075] The S4 and 5G RedCap quantum CPE terminals decrypt the session keys issued by the quantum cryptographic service platform, obtain the session key plaintext data, and then use the session key to encrypt the business data plaintext, and finally obtain the business data ciphertext for data transmission.

[0076] The session keys obtained by the 5G RedCap quantum CPE terminal and the quantum encryption gateway from the quantum encryption service platform are all ciphertexts. The session keys need to be decrypted before using them to encrypt and decrypt business data. In order to ensure the security of quantum keys in power business terminals, the decryption of session key ciphertexts is only implemented when business data needs to be encrypted and decrypted, and the operations of session key ciphertext decryption and business data encryption and decryption are all performed in the U shield / TF card. The security of business data encryption and decryption is guaranteed by the physical hardware mechanism. The detailed process of the 5G RedCap quantum CPE terminal establishing an encrypted tunnel for business data encryption and decryption is as follows: Figure 6 shown.

[0077] Step 41: The power service terminal sends service data to the locally connected 5G RedCap quantum CPE terminal.

[0078] Step 42: After the 5G RedCap quantum CPE terminal applies to the quantum cryptographic service platform and successfully obtains the session key ciphertext, it uses the internal U-shield / TF card to decrypt the session key ciphertext, calls the password module of the U-shield / TF card to use the SM4 national encryption algorithm to encrypt the business data plaintext, and returns the business data ciphertext to the 5G RedCap quantum CPE terminal, which is sent by the 5GRedCap quantum CPE terminal to the remote quantum encryption gateway via the wireless network.

[0079] Step 43: After receiving the business data ciphertext, the quantum encryption gateway performs data parsing to obtain the session key information for decryption, and then calls the internal U-shield / TF card for decryption. The decryption operation is similar to the encryption process of the SM4 national secret algorithm.

[0080] Step 44: The U-shield / TF card of the quantum encryption gateway returns the decrypted business data to the quantum encryption gateway, and the quantum encryption gateway sends the business data in plain text to the business master station system.

[0081] like Figure 7 The figure shows the process of online distribution of quantum encryption to instances of 5G RedCap quantum CPE terminals. The QRNG key generated by the quantum random number generator is used as the injection key and injected into the 5G RedCap quantum CPE terminal through the encryption hardware. The QKD key generated by the quantum key generator on the quantum secret service platform is used as the session key, and the session key is transmitted to the quantum encryption gateway and 5G RedCap quantum CPE terminal in real time by encrypting the session key with the injection key. The quantum encryption gateway and 5G RedCap quantum CPE terminal use the QKD key to establish an encrypted tunnel to realize encrypted transmission of business data.

Claims

1. A 5G quantum encryption communication method based on RedCap, characterized in that: include: S1. The 5G RedCap quantum CPE terminal initiates network access authentication to the quantum cryptographic service platform based on the preset injection key; S2. After the quantum cryptographic service platform passes the network access authentication test, it establishes an application session between the 5G RedCap quantum CPE terminal and the quantum encryption gateway, and applies for a session key from the quantum cryptographic service platform; S3, compare the consistency of the session key in the quantum encryption gateway and the session key that the quantum cryptographic service platform is going to send to the 5G RedCap quantum CPE terminal, and dispatch the session key that passes the consistency comparison to the 5G RedCap quantum CPE terminal; The S4 and 5G RedCap quantum CPE terminals decrypt the session keys issued by the quantum cryptographic service platform, obtain the session key plaintext data, and then use the session key to encrypt the business data plaintext, and finally obtain the business data ciphertext for data transmission.

2. The encryption communication method according to claim 1, characterized in that: The pre-set charging key of the 5G RedCap quantum CPE terminal is a QRNG key, which is charged using encryption hardware, and the encryption hardware is a U shield or TF card.

3. The encryption communication method according to claim 1, characterized in that: The specific steps of the network authentication are as follows: Step 11: After the 5G RedCap quantum CPE terminal device is started, it initiates the first frame of network access authentication to the quantum secret service platform; Step 12: After receiving the first frame of network access authentication, the quantum cryptographic service platform queries the exchange cipher information and charging key information that provide the preset charging key source from the database; Step 13: The quantum secret service platform selects the charging key identifier from the queried charging key information, generates a random number a, returns the charging key identifier and random number a to the 5G RedCap quantum CPE terminal, and completes the response to the first frame of the network access authentication; Step 14: After the 5G RedCap quantum CPE terminal receives the response of the first frame of network access, it parses the response to obtain the injection key identifier and random number a; Step 15: The encryption hardware generates a random number b as local information for authentication confirmation, finds the charging key ciphertext in the charging key file according to the charging key identifier, and decrypts it to obtain the charging key plaintext; uses the CBC_MAC algorithm of the national encryption algorithm SM4 to calculate the authentication check code MAC1, and immediately destroys the charging key used this time; Step 16: The encryption hardware returns the calculated authentication verification code MAC1 to the 5G RedCap quantum CPE terminal, and at the same time sends the authentication verification code MAC1, random number a, random number b, and injection key identifier to the quantum cryptographic service platform to initiate the second frame of network access authentication; Step 17: After receiving the second frame of the network access authentication, the quantum cryptographic service platform queries the random number a and the injection key identifier used for authentication from the local cache, and compares them with the information of the first frame of the network access authentication. If the comparison results are consistent, an instruction to calculate the authentication MAC is sent to the exchange cipher described in step 1; Step 18: The exchange cipher machine searches the quantum key storage library for the corresponding charging key ciphertext according to the charging key identifier provided by the quantum key service platform, decrypts it using the internal cipher card, and returns the obtained authentication verification code MAC2 to the quantum key service platform; Step 19: The quantum secret service platform compares the two authentication verification codes MAC1 and MAC2. If the comparison results are consistent, an authentication token is generated for the 5G RedCap quantum CPE terminal, and a validity period is set for the authentication token; Step 110: The 5G RedCap quantum CPE terminal obtains the authentication token, completes the network access authentication, and obtains the session key online within the validity period of the authentication token.

4. The encryption communication method according to claim 1, characterized in that: The S2 comprises the following steps: Step 21: Use the 5G RedCap quantum CPE terminal as the sender and the quantum encryption gateway as the receiver to establish an application session and apply for a session key from the quantum encryption service platform; Step 22: After the quantum cryptographic service platform verifies the identity authentication token, it queries the exchange cipher equipment information of the sender and the receiver, and sends session key acquisition instructions to the exchange cipher machines of the sender and the receiver respectively; Step 23: The exchange cipher machine at the sending end receives the session key acquisition instruction and returns the sending end session key to the quantum cryptographic service platform; Step 24: The quantum encryption service platform returns the sender's session key ciphertext to the 5G RedCap quantum CPE terminal, and temporarily caches the receiver's session key ciphertext locally, waiting for the receiver's quantum encryption gateway to obtain it.

5. The encryption communication method according to claim 4, characterized in that: The process of obtaining the sending end session key ciphertext in step 23 is as follows: the key ciphertext pre-charged in the 5G RedCap quantum CPE terminal and the session key ciphertext to be output are decrypted in the cipher card of the sending end exchange cipher machine, and the decrypted charging key plaintext is used to encrypt the session key plaintext to obtain the session key ciphertext; at the same time, with the help of the QKD device, the receiving end has the same session key as the sending end.

6. The encryption communication method according to claim 1, characterized in that: The S3 adopts quantum key consistency verification technology. For the session key to be sent to the 5G RedCap quantum CPE terminal, the quantum cryptographic service platform transmits the data carrying the hash value of N blocks of keys and the key number to the quantum encryption gateway, and compares it with the session key existing in the quantum encryption gateway. The quantum encryption gateway returns the key number and verification result.

7. The encryption communication method according to claim 1, characterized in that: The S4 comprises the following steps: Step 41: The power service terminal sends service data to the locally connected 5G RedCap quantum CPE terminal; Step 42: The 5G RedCap quantum CPE terminal uses the internal encryption hardware to decrypt the session key ciphertext, calls the cryptographic module of the encryption hardware to encrypt the service data plaintext, and returns the service data ciphertext to the 5G RedCap quantum CPE terminal, which is then sent to the quantum encryption gateway via the wireless network. Step 43: After receiving the ciphertext of the business data, the quantum encryption gateway uses national secret encryption algorithms such as AES and DES to call the quantum key to decrypt the data and verify the integrity and authenticity of the data; Step 44: The encryption hardware of the quantum encryption gateway returns the decrypted business data to the quantum encryption gateway, and the quantum encryption gateway sends the business data in plain text to the business master station system.

8. The encryption communication method according to claim 7, characterized in that: S4 uses physical hardware mechanisms to ensure the security of business data encryption and decryption. The decryption of session key ciphertext is only implemented when business data needs to be encrypted and decrypted, and the operations of session key ciphertext decryption and business data encryption and decryption are all performed in the encryption hardware.

9. A 5G quantum encryption communication device based on RedCap, characterized in that: include: 5G RedCap quantum CPE terminal, used to charge quantum keys; Use the session key to encrypt the plain text of business data; Establish an application call with the quantum encryption gateway to transmit encrypted business data; The quantum secret service platform is used to compare the consistency of session keys and authenticate the access of 5G RedCap quantum CPE terminals. Issue session keys; Quantum encryption gateway, used to receive encrypted business data and decrypt the encrypted business data.

10. The quantum encryption communication device according to claim 9, characterized in that: When the device is in operation, the steps of the method according to claims 1 to 8 are implemented.

Images