Negotiation method of point-to-point communication key center

Abstract

The invention discloses a negotiation method of a point-to-point communication key center. As the first access base station and the second access base station find the possible shared key center through the key center lists maintained by the first access base station and the second access base station respectively, the distributed resource matching mode can significantly improve the efficiency of resource scheduling. Meanwhile, the shared key center is determined through the intersection, and resource waste and complexity increase caused by selection of a plurality of key centers are avoided. And the shared key center distributes distribution identifiers for the two quantum security terminals in point-to-point communication, so that the security and traceability of the key distribution process are ensured. The distribution identifier is used as a unique identifier of the session, so that each key distribution operation can be accurately tracked and verified, and the risks of key leakage and unauthorized access are effectively prevented.

Description

Technical Field

[0001] The present application relates to the technical field of information security and quantum encryption technology, and in particular to a negotiation method for a point-to-point communication key center. Background Art

[0002] With the rapid development of quantum information technology, quantum secure communication has gradually become an important means to ensure the security of information transmission due to its unbreakable security. In a global quantum secure communication network, it is crucial to achieve secure communication between any two quantum secure terminals. However, the classical quantum secure communication method relies on access to the base station for key relay. Although this method can ensure communication security to a certain extent, it has significant limitations, especially in application scenarios with extremely high real-time requirements.

[0003] Specifically, the key relay method through access to the base station requires a complex key transmission process between the encryption end and the decryption end, which inevitably introduces waiting delays and may cause decryption failures due to abnormalities in the key or ciphertext. In addition, the key relay process will also occupy valuable network bandwidth and terminal processing resources, increasing the complexity and operating costs of the system. For services that require extremely high real-time performance, such as driving navigation, remote surgery, and high-precision real-time monitoring, these delays and resource occupation may directly lead to a decline in service quality or even business interruption.

[0004] In order to overcome these limitations and improve the real-time performance and efficiency of quantum secure communication, we can consider using a method that allows direct point-to-point communication between two quantum secure terminals connected to the global quantum secure network terminal. The core of this method is to allow the two quantum secure terminals to directly establish a communication link, reduce or eliminate the dependence on the access base station, thereby shortening the communication delay and improving the communication efficiency. However, how to allow the two quantum secure terminals connected to the global quantum secure network terminal to autonomously negotiate whether to conduct point-to-point communication is a prerequisite for achieving point-to-point communication. Summary of the invention

[0005] The present application provides a negotiation method of a point-to-point communication key center, which is used to realize autonomous negotiation between two quantum security terminals connected to a global quantum security network terminal on whether to conduct point-to-point communication.

[0006] The present application provides a negotiation method for a point-to-point communication key center, the method comprising:

[0007] The first quantum security terminal sends a pairing communication application to the first access base station to which it is connected; wherein the pairing communication application carries a symmetric allocation identifier, the first communication protocol parameter, a first network access identifier of the first quantum security terminal, and a second network access identifier of the second quantum security terminal;

[0008] The first access base station receives the pairing communication application; obtains a first key center list that can allocate a pairing key to the first quantum security terminal; and sends a point-to-point communication request to a second access base station to which the second quantum security terminal is connected through the second network access identifier; wherein the point-to-point communication request carries the first network access identifier, the first communication protocol parameter, and the first key center list;

[0009] The second access base station receives the point-to-point communication request; obtains a second key center list that can allocate pairing keys to the second quantum security terminal; determines the shared key center according to the intersection of the first key center list and the second key center list; sends a pairing distribution application to the shared key center; wherein the pairing distribution application carries the first network access identifier and the second network access identifier;

[0010] The shared key center generates the distribution identifier in response to the pairing distribution application; stores the first network access identifier, the second network access identifier, and the distribution identifier in correspondence; and sends the pairing distribution response carrying the distribution identifier to the second access base station;

[0011] The second access base station receives the pairing distribution response; sends a point-to-point pairing request to the second quantum security terminal; wherein the point-to-point pairing request carries the central address information of the shared key center, the distribution identifier, and the first communication protocol parameter;

[0012] The second quantum security terminal receives the point-to-point pairing request; stores the center address information, the first communication protocol parameter, and the distribution identifier in correspondence; and sends the point-to-point pairing response to the second access base station; wherein the point-to-point pairing response carries the second communication protocol parameter of the second quantum security terminal;

[0013] The second access base station receives the point-to-point pairing response; sends a pairing communication response to the first access base station, so as to send the pairing communication response to the first quantum security terminal through the first access base station; wherein the pairing communication response carries the center address information, the second communication protocol parameters and the distribution identifier.

[0014] The beneficial effects of this application are as follows:

[0015] 1. The first access base station and the second access base station search for possible shared key centers through the key center lists maintained by each of them. This distributed resource matching method can significantly improve the efficiency of resource scheduling. At the same time, by determining the shared key center through the intersection, it also avoids the waste of resources and increased complexity caused by selecting multiple key centers.

[0016] 2. The shared key center assigns distribution identifiers to the two quantum security terminals for point-to-point communication, ensuring the security and traceability of the key distribution process. The distribution identifier is the unique identifier of the session, so that each key distribution operation can be accurately tracked and verified, thereby effectively preventing the risk of key leakage and unauthorized access.

[0017] 3. During the point-to-point communication process, the first quantum security terminal and the second quantum security terminal also exchanged communication protocol parameters, which is not only the basis for establishing a communication link, but also the key to ensuring protocol compatibility. By negotiating the communication protocol parameters supported by each other, the first quantum security terminal and the second quantum security terminal can achieve seamless connection at the protocol level while ensuring security, providing a strong guarantee for subsequent quantum security communications.

[0018] 4. The quantum security terminal is mainly responsible for receiving, storing and sending information during the negotiation process of the point-to-point communication key center, while the complex calculation and matching work is completed by the reliable access base station and key center in the global quantum security network. This design reduces the complexity and cost requirements of the quantum security terminal, allowing more devices to easily access the global quantum security network and also ensure the security of the entire negotiation process as much as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0020] Figure 1 A schematic diagram of a negotiation process of a point-to-point communication key center provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of a negotiation process of a specific point-to-point communication key center provided in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of a specific pairing key request process provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0024] The global quantum security network can support secure and efficient quantum communication between any quantum security terminals connected to the network, regardless of their geographical location. A core of the global quantum security network is to use the access base station as a communication hub to connect quantum security terminals to the global quantum security network, and to achieve key relay between terminals connected to the global quantum security network.

[0025] During the access process, when a quantum security terminal accesses an access base station, the access base station will assign a network access identifier to the terminal, that is, a unique terminal identifier for the entire global quantum security network, which is used to identify the terminal. The network access identifier carries information about the country, operator, region, cell, access base station, and terminal. With this network access identifier, the terminal can be identified in the global quantum security network through this network access identifier within the time range that the terminal has this identifier. Subsequently, the quantum security terminal can apply for services and request resources from the global quantum security network through the access base station.

[0026] During the key relay process, the encryption end will relay the key through the encryption end access base station through the global quantum security network to the access base station of the decryption end, and then the decryption end access base station will forward the key to the decryption end, so as to ensure that a symmetric quantum security key is formed between the encryption end and the decryption end, and encryption and decryption communication can be achieved. The global quantum security network also includes a key center, which mainly distributes keys, i.e. quantum keys, to quantum security terminals connected to the global quantum security network.

[0027] Through this global quantum security network, the key relay process can be separated from the ciphertext transmission process, thereby further improving the security of ciphertext transmission. However, the key relay method through access to the base station requires a complex key transmission process between the encryption end and the decryption end, which inevitably introduces waiting delays and may cause decryption failures due to abnormalities in the key or ciphertext. In addition, the key relay process will also occupy valuable network bandwidth and terminal processing resources, increasing the complexity and operating costs of the system. For services that require extremely high real-time performance, such as driving navigation, remote surgery, and high-precision real-time monitoring, these delays and resource occupation may directly lead to a decline in service quality or even business interruption.

[0028] In order to overcome these limitations and improve the real-time performance and efficiency of quantum secure communication, we can consider using a method that allows direct point-to-point communication between two quantum secure terminals connected to the global quantum secure network terminal. The core of this method is to allow the two quantum secure terminals to directly establish a communication link, reduce or eliminate the dependence on the access base station, thereby shortening the communication delay and improving the communication efficiency. However, how to allow the two quantum secure terminals connected to the global quantum secure network terminal to autonomously negotiate whether to conduct point-to-point communication is a prerequisite for achieving point-to-point communication.

[0029] Based on this, the present application provides a negotiation method for a point-to-point communication key center to enable autonomous negotiation between two quantum security terminals connected to a global quantum security network terminal as to whether to conduct point-to-point communication.

[0030] Embodiment 1:

[0031] Figure 1 A schematic diagram of a negotiation process of a point-to-point communication key center provided in an embodiment of the present application, the process includes:

[0032] S101: The first quantum security terminal sends a pairing communication application to the first access base station to which it is connected; wherein the pairing communication application carries a symmetric allocation identifier, the first communication protocol parameter, a first network access identifier of the first quantum security terminal, and a second network access identifier of the second quantum security terminal.

[0033] All quantum security terminals connected to the global quantum security network are assigned corresponding network access identifiers, so that the network access identifier can accurately identify the location of the quantum security terminal in the global quantum security network. When the quantum security terminal needs to conduct point-to-point communication with a quantum security terminal in the global quantum security network, the quantum security terminal can actively initiate a pairing communication application to the quantum security terminal at the other end through the global quantum security network to negotiate with the quantum security terminal at the other end whether to conduct point-to-point communication. For the convenience of description, the quantum security terminal that actively initiates the pairing communication application is referred to as the first quantum security terminal, and the quantum security terminal that passively responds to the pairing communication application is referred to as the second quantum security terminal.

[0034] Exemplarily, the first quantum security terminal can generate a pairing communication application, and then send the pairing communication application to the access base station (recorded as the first access base station) accessed by the first quantum security terminal. Among them, the pairing communication application carries a symmetric allocation identifier, the communication protocol parameters of the first quantum security terminal (recorded as the first communication protocol parameters), the network access identifier of the first quantum security terminal (recorded as the first network access identifier), and the network access identifier of the second quantum security terminal (recorded as the second network access identifier). Among them, the symmetric allocation identifier is used to characterize the shared key center that needs to be determined by the global quantum security network to allocate pairing keys to the first quantum security terminal and the second quantum security terminal. The first communication protocol parameter defines the communication protocol specifications that need to be followed during point-to-point communication between the first quantum security terminal and the second quantum security terminal, including but not limited to one or more of the following: the key size of the pairing key, the encryption algorithm, the key expansion algorithm, the hash algorithm, and the current communication identifier.

[0035] In a possible implementation, since a quantum security terminal connected to the global quantum security network will store a symmetric key with the access base station it is connected to, quantum encryption communication between the quantum security terminal and the access base station can be realized. Based on this, in this application, the first quantum security terminal can encrypt and send the pairing communication application to the first access base station based on the symmetric key to protect the security of the data carried in the pairing communication application. When the first access base station receives the encrypted pairing communication application, it can also decrypt the encrypted pairing communication application based on the symmetric key paired with the first quantum security terminal.

[0036] S102: The first access base station receives the pairing communication application; obtains a first key center list that can allocate pairing keys to the first quantum security terminal; sends a point-to-point communication request to the second access base station to which the second quantum security terminal accesses through the second network access identifier; wherein the point-to-point communication request carries the first network access identifier, the first communication protocol parameters and the first key center list.

[0037] The access base station in the global quantum security network will maintain a key center information library that supports the distribution of keys for the quantum security terminals under the access base station. The key center information library contains detailed information of multiple key centers, which are used to evaluate and determine which key center is most suitable for distributing keys to the quantum security terminals under it. Among them, the key center information library includes but is not limited to whether the key center supports the distribution of pairing keys, the load information of the key center, the location information of the key center, the address information of the key center, etc. When the first access base station obtains the pairing communication application sent by the first quantum security terminal, a list containing multiple candidate key centers and their detailed information, i.e., the first key center list, can be generated from the maintained key center information library. Each key center in this key center list has the ability to distribute pairing keys to the first quantum security terminal.

[0038] Next, the first access base station generates a point-to-point communication request based on the first key center list and the paired communication application. Using the second network access identifier of the second quantum security terminal, the point-to-point communication request is sent to the access base station accessed by the second quantum security terminal (referred to as the second access base station). This point-to-point communication request contains several key information: the first network access identifier, the first communication protocol parameters, and the first key center list.

[0039] S103: The second access base station receives the point-to-point communication request; obtains a second key center list that can allocate pairing keys to the second quantum security terminal; determines the shared key center according to the intersection of the first key center list and the second key center list; sends a pairing distribution application to the shared key center; wherein the pairing distribution application carries the first network access identifier and the second network access identifier.

[0040] In the global quantum security network, when the second access base station receives a point-to-point communication request from the first access base station, it will process and respond to this request according to a series of steps to ensure that the second quantum security terminal can securely establish a communication connection with the first quantum security terminal.

[0041] Exemplarily, after receiving the point-to-point communication request, the second access base station queries the key center information base it maintains to obtain a list of key centers that can distribute pairing keys for the second quantum security terminal (referred to as the second key center list). This second key center list also contains information about multiple candidate key centers and their detailed information, and these key centers are capable of generating and distributing pairing keys for the second quantum security terminal.

[0042] In order to ensure that the first quantum security terminal and the second quantum security terminal can use the same key center for key distribution, the second access base station will compare the first key center list and the second key center list to find their intersection. The key center in this intersection can distribute pairing keys for both the first quantum security terminal and the second quantum security terminal. A key center is determined from the intersection as a shared key center, that is, a key center used to distribute pairing keys for the first quantum security terminal and the second quantum security terminal.

[0043] In an example, if the network access identifier of the quantum security terminal includes country information, operator information, regional information, and cell information, the second access base station determines the shared key center according to the intersection of the first key center list and the second key center list, including:

[0044] For each key center in the intersection, based on the first network access identifier and the second network access identifier, determine the sum of the distances from the first quantum security terminal and the second quantum security terminal to the key center respectively;

[0045] Determine a key center corresponding to the sum of the minimum distances as the shared key center;

[0046] Wherein, for any key center, determining the distance from the quantum security terminal to the key center based on the network access identifier of the quantum security terminal includes:

[0047] If it is determined based on the network access identifier that the quantum security terminal and the key center are located in the same cell, the distance is a pre-configured first-level distance;

[0048] If it is determined based on the network access identifier that the quantum security terminal and the key center are located in different cells of the same region, then the distance is a pre-configured second level distance;

[0049] If, based on the network access identifier, it is determined that the quantum security terminal and the key center are located in different regions of the same operator, then the distance is a pre-configured third level distance;

[0050] If, based on the network access identifier, it is determined that the quantum security terminal and the key center are located in different operators in the same country, then the distance is a pre-configured fourth level distance;

[0051] If it is determined based on the network access identifier that the quantum security terminal and the key center are located in different countries, the distance is a pre-configured fifth level distance;

[0052] Among them, in the order from the first level to the fifth level, the distance of the latter level is greater than twice the distance of the previous level, and the distance of the first level is greater than or equal to 0.

[0053] In the present application, when the second access base station determines a shared key center according to the intersection of the first key center list and the second key center list, the distances from the first quantum security terminal and the second quantum security terminal to the shared key center can be considered to minimize the sum of the distances between the two. The distance can be calculated based on the network access identification of the quantum security terminal, which includes national information, operator information, regional information, and cell information.

[0054] Exemplarily, the second access base station first finds the intersection of the first key center list and the second key center list, and the key centers in these intersections are potential candidates for shared key centers. For each key center in the intersection, the second access base station needs to determine the distance from the first quantum security terminal to the key center (referred to as the first distance) based on the network access identifier of the first quantum security terminal and the geographical location information of the key center, and determine the distance from the second quantum security terminal to the key center (referred to as the second distance) based on the network access identifier of the second quantum security terminal and the geographical location information of the key center, and add these two distances to obtain the sum of the distances. After determining the sum of the distances corresponding to all the key centers in the intersection, the second access base station can determine a key center corresponding to the minimum sum of distances as the shared key center.

[0055] Specifically, when determining the distance from the quantum security terminal to the key center based on the network access identification of the quantum security terminal and the geographical location information of the key center, if the quantum security terminal and the key center are located in the same cell, the distance is a pre-configured first-level distance, for example, 0 or a very small positive number. If the quantum security terminal and the key center are located in different cells in the same region, the distance is a second-level distance. If the quantum security terminal and the key center are located in different regions of the same operator, the distance is a third-level distance. If the quantum security terminal and the key center are located in different operators in the same country, the distance is a fourth-level distance. If the quantum security terminal and the key center are located in different countries, the distance is a fifth-level distance. Among them, these levels of distances are pre-configured, and in order from the first level to the fifth level, the distance of the latter level is greater than twice the distance of the previous level to ensure that the distance of the geographical location has a significant impact on the distance calculation.

[0056] In a possible implementation, if it is determined that the sum of the minimum distances corresponds to multiple key centers, then a key center may be randomly determined from the multiple key centers as a shared key center.

[0057] In another possible implementation, if it is determined that the sum of the minimum distances corresponds to multiple key centers, the second access base station may determine a shared key center from the multiple key centers in a round-robin manner. The specific implementation of the round-robin may depend on a variety of factors, such as the ID, name, and timestamp of joining the list of the key center. For example, if the multiple key centers are arranged in a certain order (such as in ascending order of ID), then the first key center in the front of the order may be simply selected as the shared key center. Then, the next time a shared key center needs to be selected, the next key center in the order is selected, and so on.

[0058] In a possible implementation, after determining the shared key center, the second access base station may record the selection result so as to be able to refer to or update the selection in future communication requests, for example, if the shared key center fails or performance degrades, a shared key center may be reallocated.

[0059] Once the shared key center is determined, the second access base station will send a pairing distribution application to the shared key center. This pairing distribution application contains the network access identifiers of the first quantum security terminal and the second quantum security terminal (i.e., the first network access identifier and the second network access identifier), so that the shared key center can identify and process subsequent pairing key application requests from the two quantum security terminals.

[0060] In some possible implementations, the method further comprises:

[0061] If the second access base station determines that there is no intersection between the first key center list and the second key center list, a request failure response is generated; and the request failure response is notified to the first quantum security terminal through the first access base station.

[0062] In the global quantum security network, if it is found that there is no intersection between the first key center list and the second key center list, it means that there is no common key center that can provide services to two quantum security terminals at the same time. In this case, the second access base station will generate a request failure response. Among them, this request failure response can include the reason for the failure so that the first quantum security terminal can understand why the pairing communication request failed. The second access base station then sends the request failure response to the first access base station, and the request failure response is forwarded to the first quantum security terminal through the first access base station.

[0063] S104: The shared key center generates the distribution identifier in response to the pairing distribution application; stores the first network access identifier, the second network access identifier, and the distribution identifier in correspondence; and sends the pairing distribution response carrying the distribution identifier to the second access base station.

[0064] In the global quantum security network, when two quantum security terminals request to establish secure communication, the shared key center plays a vital role. The shared key center is responsible for handling the distribution and management of pairing keys to ensure the confidentiality and integrity of point-to-point communication. When the shared key center receives the pairing distribution application sent by the second access base station, the shared key center can generate a unique distribution identifier, which will be used to track and verify the various steps of the key distribution process during the duration of the point-to-point communication, ensuring that only the two quantum security terminals in the point-to-point communication can request the shared key center for key distribution. Then, the shared key center saves the first network access identifier, the second network access identifier, and the newly generated distribution identifier in correspondence, so as to ensure that the subsequently generated keys can be correctly distributed to the two parties requesting communication through this correspondence. Once the distribution identifier generates and saves the necessary correspondence, the shared key center will send a pairing distribution response carrying the distribution identifier to the second access base station. This pairing distribution response notifies the second access base station that the key distribution process has begun and provides a distribution identifier for subsequent steps.

[0065] S105: The second access base station receives the pairing distribution response; sends a point-to-point pairing request to the second quantum security terminal; wherein the point-to-point pairing request carries the central address information of the shared key center, the distribution identifier, and the first communication protocol parameters.

[0066] After receiving the pairing distribution response sent by the shared key center, the second access base station can generate a point-to-point pairing request according to the distribution identifier, the central address information of the shared key center and the first communication protocol parameter, and then send the point-to-point pairing request to the second quantum security terminal.

[0067] In a possible implementation, the second access base station may encrypt the point-to-point pairing request and send it to the second quantum security terminal based on the symmetric key paired with the second quantum security terminal. The second quantum security terminal may decrypt the received encrypted point-to-point pairing request based on the symmetric key paired with the second access base station to obtain the point-to-point pairing request.

[0068] S106: The second quantum security terminal receives the point-to-point pairing request; stores the center address information, the first communication protocol parameters, and the distribution identifier in correspondence; and sends the point-to-point pairing response to the second access base station; wherein the point-to-point pairing response carries the second communication protocol parameters of the second quantum security terminal.

[0069] When the second quantum security terminal receives a point-to-point pairing request, it can save the central address information, the first communication protocol parameters, and the distribution identifier carried in the point-to-point pairing request to ensure that it can accurately and securely communicate with the first quantum security terminal in accordance with the established rules and protocols in the future, and also to manage and maintain various communication sessions in the network. Subsequently, the second quantum security terminal will send a point-to-point pairing response to the second access base station. This point-to-point pairing response not only confirms the acceptance of the pairing communication application of the first quantum security terminal, but also carries the communication protocol parameters of the second quantum security terminal (recorded as the second communication protocol parameters).

[0070] In a possible implementation, the second quantum security terminal may send a point-to-point pairing response to the second access base station by using encrypted communication.

[0071] In one example, after the second quantum security terminal receives the point-to-point pairing request and before the center address information, the first communication protocol parameter, and the distribution identifier are correspondingly saved, the method further includes:

[0072] Determine to support the first communication protocol parameter; wherein the first communication protocol parameter includes one or more of the following: the key size of the pairing key, the encryption algorithm, the key expansion algorithm, the hash algorithm, and the current communication identifier.

[0073] In order to ensure the feasibility of subsequent point-to-point communication, in this application, when the second quantum security terminal obtains the point-to-point pairing request, it can check whether the first communication protocol parameters are within its support range according to its own configuration and capabilities. If all or part of the parameters in the first communication protocol parameters are not supported, the second quantum security terminal can take some measures, such as forwarding the error response to the first quantum security terminal through the second access base station, indicating which parameters are not supported, or trying to negotiate the use of alternative communication protocol parameters. If the second quantum security terminal determines that the first communication protocol parameters are supported, it will continue to execute the subsequent steps, that is, save the center address information, the first communication protocol parameters and the distribution identifier accordingly, and send a point-to-point pairing response to the second access base station. In this way, it can be ensured that the communicating parties have reached a consensus on the communication protocol parameters before the communication begins, thereby avoiding compatibility issues or security vulnerabilities that may arise later.

[0074] S107: The second access base station receives the point-to-point pairing response; sends a pairing communication response to the first access base station, so as to send the pairing communication response to the first quantum security terminal through the first access base station; wherein the pairing communication response carries the center address information, the second communication protocol parameters and the distribution identifier.

[0075] In the global quantum security network, when the second quantum security terminal successfully responds to the pairing communication request of the first quantum security terminal and sends a point-to-point pairing response containing its second communication protocol parameters, the point-to-point pairing response will first be received by the second access base station. Subsequently, the second access base station will further process the point-to-point pairing response, generate a pairing communication response and forward the pairing communication response to the first access base station, so as to finally convey the pairing communication response to the first quantum security terminal. Among them, the pairing communication response carries the central address information of the shared key center, the second communication protocol parameters and the distribution identifier.

[0076] Through the above-mentioned method, negotiation between the first quantum security terminal and the second quantum security terminal can be achieved, which provides a basis for subsequent point-to-point communication. For any quantum security terminal (including the first quantum security terminal and the second quantum security terminal) in the point-to-point communication, the quantum security terminal can obtain a pairing key from the allocated shared key center. Subsequently, based on the pairing key, point-to-point communication is performed with the quantum security terminal of the other end.

[0077] The beneficial effects of this application are as follows:

[0078] 1. The first access base station and the second access base station search for possible shared key centers through the key center lists maintained by each of them. This distributed resource matching method can significantly improve the efficiency of resource scheduling. At the same time, by determining the shared key center through the intersection, it also avoids the waste of resources and increased complexity caused by selecting multiple key centers.

[0079] 2. The shared key center assigns distribution identifiers to the two quantum security terminals for point-to-point communication, ensuring the security and traceability of the key distribution process. The distribution identifier is the unique identifier of the session, so that each key distribution operation can be accurately tracked and verified, thereby effectively preventing the risk of key leakage and unauthorized access.

[0080] 3. During the point-to-point communication process, the first quantum security terminal and the second quantum security terminal also exchanged communication protocol parameters, which is not only the basis for establishing a communication link, but also the key to ensuring protocol compatibility. By negotiating the communication protocol parameters supported by each other, the first quantum security terminal and the second quantum security terminal can achieve seamless connection at the protocol level while ensuring security, providing a strong guarantee for subsequent quantum security communications.

[0081] 4. The quantum security terminal is mainly responsible for receiving, storing and sending information during the negotiation process of the point-to-point communication key center, while the complex calculation and matching work is completed by the reliable access base station and key center in the global quantum security network. This design reduces the complexity and cost requirements of the quantum security terminal, allowing more devices to easily access the global quantum security network and also ensure the security of the entire negotiation process as much as possible.

[0082] Embodiment 2:

[0083] In order to ensure the security of point-to-point communication, based on the above embodiment, in the present application, if the quantum security terminal includes the first quantum security terminal and the second quantum security terminal, the quantum security terminal obtains the pairing key from the shared key center including:

[0084] The quantum security terminal sends an encryption key request to the shared key center through the access base station to which it is connected; wherein the encryption key request carries the distribution identifier, the network access identifier of the quantum security terminal, encryption key requirement information and the center address information;

[0085] The shared key center allocates an encryption key to the quantum security terminal based on the received encryption key request, and stores the encryption key, the network access identifier, and the distribution identifier in correspondence; and sends the encryption key to the quantum security terminal through the access base station;

[0086] When the quantum security terminal obtains the encryption key, the key download request is encrypted based on the quantum key in the encryption key; wherein the key download request carries the pairing key requirement information and the distribution identifier; and the encrypted key download request is sent to the shared key center according to the center address information;

[0087] The shared key center decrypts the received encrypted key download request based on the quantum key in the encryption key; obtains the pairing key assigned to the quantum security terminal according to the key download request; and encrypts the pairing key and sends it to the quantum security terminal using the quantum key in the encryption key;

[0088] The quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key.

[0089] In order to ensure that quantum security terminals connected to the global quantum security network can communicate quantum securely point-to-point, in this application, it is necessary to assign pairing keys to the two quantum security terminals so that the two quantum security terminals can communicate quantum securely based on the pairing keys. The following is an explanation of the process of any quantum security terminal obtaining a pairing key from the shared key center:

[0090] First, the quantum security terminal needs to request an encryption key from the shared key center to encrypt the distributed pairing key with the encryption key, thereby avoiding the pairing key from being transmitted in plain text in the network. Exemplarily, the quantum security terminal can obtain the encryption key from the shared key center through the access base station it accesses, thereby avoiding the third-party device from eavesdropping on the communication between the quantum security terminal and the shared key center to obtain the encryption key, thereby affecting the security of the subsequent encryption of the pairing key based on the encryption key. Specifically, the quantum security terminal generates an encryption key request, and then sends the encryption key request to the access base station to which the quantum security terminal accesses. Among them, the encryption key request carries a distribution identifier, encryption key requirement information, the network access identifier of the quantum security terminal, and the center address information of the shared key center. The encryption key requirement information is used to guide the shared key center to distribute encryption keys, which includes requirements such as the type, length, and size of the encryption key. After receiving the encryption key request, the access base station can forward the encryption key request to the shared key center according to the center address information. The shared key center receives the encryption key request forwarded by the access base station, and based on the encryption key request, allocates an encryption key to the quantum security terminal, and saves the encryption key, network access identifier and distribution identifier in correspondence.

[0091] In a possible implementation, when the shared key center determines that the distribution identifier is stored and the distribution identifier is associated with the network access identifier, an encryption key is allocated to the quantum security terminal based on the encryption key requirement information.

[0092] After the shared key center obtains the encryption key assigned to the quantum security terminal, it can transmit the encryption key to the access base station so that the encryption key can be sent to the quantum security terminal through the access base station.

[0093] After the quantum security terminal obtains the encryption key, it can perform encrypted communication with the shared key center based on the encryption key. Exemplarily, the quantum security terminal can generate a key download request based on the pairing key requirement information and the distribution identifier. The key download request is encrypted based on the quantum key in the encryption key. Then, the encrypted key download request is sent to the shared key center according to the center address information.

[0094] In a possible implementation, after the quantum security terminal obtains the encryption key, it can determine whether the encryption key passes the security check. Exemplarily, the security check includes one or more of the following:

[0095] 1. Integrity check

[0096] To ensure that the encryption key is not tampered with or damaged during transmission or storage, in this application, the quantum security terminal can perform an integrity check on the received encryption key. For example, by performing a hash check on the encryption key, it is determined whether the encryption key passes the integrity check. If the encryption key passes the integrity check, the quantum security terminal retains the encryption key; if the encryption key does not pass the integrity check, the quantum security terminal discards the encryption key.

[0097] 2.Consistency check

[0098] To prevent errors or inconsistencies in the encryption key during distribution or storage, the quantum security terminal can also perform consistency checks on the encryption key with the access base station. For example, the quantum security terminal can compare the hash value of the encryption key with the hash value of the encryption key received by the access base station to determine whether the encryption key meets the consistency check. If the encryption key passes the consistency check, the quantum security terminal retains the encryption key; if the encryption key fails the consistency check, the quantum security terminal discards the encryption key.

[0099] It should be noted that the quantum security terminal may perform security verification on the encryption key in one or more of the above-mentioned ways. When the security verification includes the above-mentioned multiple verification methods, that is, the security of the encryption key is ensured by combining integrity verification and consistency verification, the quantum security terminal first ensures that the encryption key has not been tampered with during transmission or storage through integrity verification; then, the consistency verification is used to ensure the consistency between the encryption key and the encryption key generated by the shared key center. If the encryption key passes both of these checks at the same time, it can be considered that the encryption key is safe and reliable and can be used for subsequent encrypted communications. If the encryption key fails any of the checks, then corresponding security measures need to be taken, such as discarding the encryption key, re-requesting the encryption key, or reporting a security incident.

[0100] After receiving the key download request encrypted and sent by the quantum security terminal, the shared key center can obtain the encryption key paired with the quantum security terminal. For example, the encryption key associated with the network access identifier is obtained. Then, based on the encryption key, the encrypted key download request is decrypted to obtain the key download request. Based on the key download request, the pairing key assigned to the quantum security terminal is obtained. For example, the shared key center can determine whether the pairing key associated with the distribution identifier is saved. If the pairing key associated with the distribution identifier is saved, the associated pairing key is used as the pairing key of the quantum security terminal; if the pairing key associated with the distribution identifier is not saved, the pairing key is assigned to the quantum security terminal based on the pairing key requirement information carried in the key download request, and the pairing key is associated with the distribution identifier and saved. After obtaining the pairing key, the shared key center encrypts the pairing key and sends it to the quantum security terminal through the quantum key in the encryption key paired with the quantum security terminal.

[0101] The quantum security terminal receives the encrypted pairing key sent by the shared key center and can decrypt the encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key.

[0102] In a possible implementation, after obtaining the pairing key, the quantum security terminal may also perform security verification on the pairing key. The way in which the quantum security terminal performs security verification on the pairing key may refer to the above-mentioned way of performing security verification on the encryption key, and the details may refer to the above-mentioned embodiment, which will not be described in detail here.

[0103] It should be noted that since a reliable encrypted communication channel has not been established between the quantum security terminal and the quantum security terminal at the other end, the communication between the two quantum security terminals is not absolutely safe and reliable. Based on this, in this application, a shared key center can be introduced as a trusted third party, and the consistency check of the pairing key can be performed between the quantum security terminal and the shared key center, so that the pairing keys between the two quantum security terminals in point-to-point communication are consistent, effectively reducing these security risks.

[0104] In some possible implementations, after the quantum security terminal successfully downloads the paired key, the shared key center records the key download status of the quantum security terminal as "successfully downloaded". For example, "successfully downloaded" is associated with the distribution identifier and the network access identifier of the quantum security terminal.

[0105] In order to determine that the quantum security terminal at the other end of the point-to-point communication has also successfully downloaded the pairing key, in this application, the quantum security terminal can generate a query status request based on the distribution identifier and the network access identifier of the quantum security terminal at the other end. Then, the query status request is encrypted by the quantum key in the saved encryption key, and the encrypted query status request is sent to the shared key center.

[0106] After receiving the encrypted query status request, the shared key center can use the same quantum key to decrypt the encrypted query status request. Then, the corresponding key distribution record is found based on the distribution identifier carried by the query status request, and the target key download status of the quantum security terminal at the other end is further obtained based on the network access identifier carried by the query status request. The shared key center can encrypt the query status response carrying the target key download status and send it to the quantum security terminal that initiated the request through the quantum key in the encryption key.

[0107] After receiving the encrypted query status response, the quantum security terminal also uses the same quantum key to decrypt the encrypted query status response. According to the decrypted content (i.e., the target key download status), it is determined whether the quantum security terminal on the other end has successfully downloaded the pairing key. If the target key download status indicates that the quantum security terminal on the other end has successfully downloaded the pairing key, then the quantum security terminal can determine that the two parties have point-to-point quantum encryption communication capabilities. If the target key download status indicates that the quantum security terminal on the other end has not successfully downloaded the pairing key, the quantum security terminal can choose to repeatedly send the query status request until it is confirmed that the quantum security terminal on the other end has successfully downloaded the pairing key. This repeated query mechanism ensures that the communicating parties can perform encrypted communication when the key is ready.

[0108] Embodiment 3:

[0109] The specific peer-to-peer communication key center negotiation method provided by the present application is described below through specific embodiments. Figure 2 A schematic diagram of a negotiation process of a specific point-to-point communication key center provided in an embodiment of the present application, the process includes:

[0110] S201: The first quantum security terminal sends a pairing communication application to the first access base station to which it is connected.

[0111] Among them, the pairing communication application carries a symmetric allocation identifier, a first communication protocol parameter, a first network access identifier of the first quantum security terminal, and a second network access identifier of the second quantum security terminal.

[0112] S202: The first access base station obtains a first key center list that can allocate pairing keys to the first quantum security terminal.

[0113] S203: The first access base station sends a point-to-point communication request to a second access base station to which the second quantum security terminal accesses through the second network access identifier.

[0114] The point-to-point communication request carries a first network access identifier, a first communication protocol parameter, and a first key center list.

[0115] S204: The second access base station obtains a second key center list that can allocate pairing keys to the second quantum security terminal, and determines whether there is an intersection between the first key center list and the second key center list. If so, execute S205; otherwise, execute S207.

[0116] S205: The second access base station sends a request failure response to the first access base station.

[0117] S206: The first access base station forwards the request failure response to the first quantum security terminal.

[0118] S207: For each key center in the determined intersection, the second access base station determines the sum of the distances from the first quantum security terminal and the second quantum security terminal to the key center respectively based on the first network access identifier and the second network access identifier.

[0119] S208: The second access base station determines a key center corresponding to the sum of the minimum distances as a shared key center.

[0120] In a possible implementation, if the sum of the minimum distances corresponds to multiple key centers, a shared key center is determined from the multiple key centers in a round-robin manner.

[0121] S209: The second access base station sends a pairing distribution application to the shared key center.

[0122] The pairing distribution application carries the first network access identifier and the second network access identifier.

[0123] S210: The shared key center generates a distribution identifier in response to the pairing distribution application, and stores the first network access identifier, the second network access identifier, and the distribution identifier in correspondence.

[0124] S211: The shared key center sends a pairing distribution response carrying a distribution identifier to the second access base station.

[0125] S212: The second access base station sends a point-to-point pairing request to the second quantum security terminal.

[0126] The point-to-point pairing request carries the central address information of the shared key center, a distribution identifier, and a first communication protocol parameter.

[0127] S213: When the second quantum security terminal determines that it supports the first communication protocol parameter, it stores the center address information, the first communication protocol parameter, and the distribution identifier in correspondence.

[0128] S214: The second quantum security terminal sends a point-to-point pairing response to the second access base station.

[0129] The point-to-point pairing response carries the second communication protocol parameter of the second quantum security terminal.

[0130] S215: The second access base station sends a pairing communication response to the first access base station.

[0131] The pairing communication response carries the center address information, the second communication protocol parameters and the distribution identifier.

[0132] S216: The first access base station sends a pairing communication response to the first quantum security terminal.

[0133] Based on the above embodiment, the first quantum security terminal and the second quantum security terminal obtain the central address information and distribution identifier of the shared key center. Both quantum security terminals can request a pairing key from the shared key center through the distribution identifier and the central address information. The following describes the process of any quantum security terminal obtaining a pairing key from the shared key center. Figure 3 A schematic diagram of a specific pairing key request process provided in an embodiment of the present application, the process includes:

[0134] S301: The quantum security terminal sends an encryption key request to an access base station to which the quantum security terminal accesses.

[0135] Among them, the encryption key request carries the distribution identifier, the network access identifier of the quantum security terminal, the encryption key requirement information and the central address information of the shared key center.

[0136] S302: The access base station forwards the encryption key request to the shared key center based on the center address information carried in the encryption key request.

[0137] S303: The shared key center allocates an encryption key to the quantum security terminal based on the received encryption key request, and stores the encryption key, network access identifier, and distribution identifier in correspondence.

[0138] S304: The shared key center sends the encryption key to the access base station.

[0139] S305: The access base station encrypts the encryption key based on the symmetric key paired with the quantum security terminal and sends it to the quantum security terminal.

[0140] S306: When the quantum security terminal obtains the encryption key, it performs an integrity check on the encryption key and performs a consistency check on the encryption key with the access base station.

[0141] S307: When the quantum security terminal determines that the encryption key passes the integrity check and the consistency check, the key download request is encrypting based on the quantum key in the encryption key.

[0142] The key download request carries pairing key requirement information and a distribution identifier.

[0143] S308: The quantum security terminal sends an encrypted key download request to the shared key center according to the center address information.

[0144] S309: The shared key center decrypts the received encrypted key download request based on the quantum key in the encryption key.

[0145] S310: The shared key center obtains the pairing key allocated to the quantum security terminal according to the key download request.

[0146] S311: The shared key center encrypts the pairing key using the quantum key in the encryption key and sends it to the quantum security terminal.

[0147] S312: The quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key, performs an integrity check on the pairing key, and performs a consistency check on the pairing key with the shared key center.

[0148] S313: When it is determined that the paired key passes the integrity check and the consistency check, the shared key center records the key download status of the quantum security terminal as successful download.

[0149] S314: The quantum security terminal encrypts and sends a query status request to the shared key center using the quantum key in the encryption key.

[0150] The query status request carries the distribution identifier and the network access identifier of the quantum security terminal at the other end.

[0151] S315: The shared key center decrypts the received encrypted query status request based on the quantum key in the encryption key, and obtains the target key download status corresponding to the network access identifier based on the distribution identifier.

[0152] S316: Based on the quantum key in the encryption key, the shared key center encrypts the query status response carrying the target key download status and sends it to the quantum security terminal.

[0153] S317: The quantum security terminal decrypts the received encrypted query status response based on the quantum key in the encryption key, and determines whether the target key download status represents that the quantum security terminal of the network access identification successfully downloads the paired key. If so, execute S318, otherwise, execute S314.

[0154] S318: The quantum security terminal determines that the quantum security terminal and the quantum security terminal with the network access identification have point-to-point quantum encryption communication capabilities.

[0155] It should be noted that, after the quantum security terminal determines that the quantum security terminal and the quantum security terminal of the network access identifier have the capability of point-to-point quantum encryption communication, the quantum security terminal can conduct point-to-point communication with the quantum security terminal of the network access identifier based on the pairing key.

Claims

1. A negotiation method for a point-to-point communication key center, characterized in that: The method comprises: The first quantum security terminal sends a pairing communication application to the first access base station to which it is connected; wherein the pairing communication application carries a symmetric allocation identifier, the first communication protocol parameter, a first network access identifier of the first quantum security terminal, and a second network access identifier of the second quantum security terminal; The first access base station receives the pairing communication application; obtains a first key center list that can allocate a pairing key to the first quantum security terminal; and sends a point-to-point communication request to a second access base station to which the second quantum security terminal is connected through the second network access identifier; wherein the point-to-point communication request carries the first network access identifier, the first communication protocol parameter, and the first key center list; The second access base station receives the point-to-point communication request; obtains a second key center list that can allocate pairing keys to the second quantum security terminal; determines the shared key center according to the intersection of the first key center list and the second key center list; sends a pairing distribution application to the shared key center; wherein the pairing distribution application carries the first network access identifier and the second network access identifier; The shared key center generates the distribution identifier in response to the pairing distribution application; stores the first network access identifier, the second network access identifier, and the distribution identifier in correspondence; and sends the pairing distribution response carrying the distribution identifier to the second access base station; The second access base station receives the pairing distribution response; sends a point-to-point pairing request to the second quantum security terminal; wherein the point-to-point pairing request carries the central address information of the shared key center, the distribution identifier, and the first communication protocol parameter; The second quantum security terminal receives the point-to-point pairing request; stores the center address information, the first communication protocol parameter, and the distribution identifier in correspondence; and sends the point-to-point pairing response to the second access base station; wherein the point-to-point pairing response carries the second communication protocol parameter of the second quantum security terminal; The second access base station receives the point-to-point pairing response; sends a pairing communication response to the first access base station, so as to send the pairing communication response to the first quantum security terminal through the first access base station; wherein the pairing communication response carries the center address information, the second communication protocol parameters and the distribution identifier.

2. The method according to claim 1, characterized in that The method further comprises: If the second access base station determines that there is no intersection between the first key center list and the second key center list, a request failure response is generated; and the request failure response is notified to the first quantum security terminal through the first access base station.

3. The method according to claim 1, characterized in that If the network access identifier of the quantum security terminal includes country information, operator information, regional information, and cell information, the second access base station determines the shared key center according to the intersection of the first key center list and the second key center list, including: For each key center in the intersection, based on the first network access identifier and the second network access identifier, determine the sum of the distances from the first quantum security terminal and the second quantum security terminal to the key center respectively; Determine a key center corresponding to the sum of the minimum distances as the shared key center; Wherein, for any key center, determining the distance from the quantum security terminal to the key center based on the network access identifier of the quantum security terminal includes: If it is determined based on the network access identifier that the quantum security terminal and the key center are located in the same cell, the distance is a pre-configured first-level distance; If it is determined based on the network access identifier that the quantum security terminal and the key center are located in different cells of the same region, then the distance is a pre-configured second level distance; If, based on the network access identifier, it is determined that the quantum security terminal and the key center are located in different regions of the same operator, then the distance is a pre-configured third level distance; If, based on the network access identifier, it is determined that the quantum security terminal and the key center are located in different operators in the same country, then the distance is a pre-configured fourth level distance; If it is determined based on the network access identifier that the quantum security terminal and the key center are located in different countries, the distance is a pre-configured fifth level distance; Among them, in the order from the first level to the fifth level, the distance of the latter level is greater than twice the distance of the previous level, and the distance of the first level is greater than or equal to 0.

4. The method according to claim 3, characterized in that The second access base station determines a key center corresponding to the sum of the minimum distances as the shared key center, including: If the sum of the minimum distances corresponds to multiple key centers, the shared key center is determined from the multiple key centers in a round-robin manner.

5. The method according to claim 1, characterized in that After the second quantum security terminal receives the point-to-point pairing request and before the center address information, the first communication protocol parameter, and the distribution identifier are correspondingly saved, the method further includes: Determine to support the first communication protocol parameters; wherein the first communication protocol parameters include one or more of the following: the key size of the pairing key, the encryption algorithm, the key expansion algorithm, the hash algorithm, and the current communication identifier.

6. The method according to claim 1, characterized in that If the quantum security terminal includes the first quantum security terminal and the second quantum security terminal, the quantum security terminal obtaining the pairing key from the shared key center includes: The quantum security terminal sends an encryption key request to the shared key center through the access base station to which it is connected; wherein the encryption key request carries the distribution identifier, the network access identifier of the quantum security terminal, encryption key requirement information and the center address information; The shared key center allocates an encryption key to the quantum security terminal based on the received encryption key request, and stores the encryption key, the network access identifier, and the distribution identifier in correspondence; and sends the encryption key to the quantum security terminal through the access base station; When the quantum security terminal obtains the encryption key, the key download request is encrypted based on the quantum key in the encryption key; wherein the key download request carries the pairing key requirement information and the distribution identifier; and the encrypted key download request is sent to the shared key center according to the center address information; The shared key center decrypts the received encrypted key download request based on the quantum key in the encryption key; obtains the pairing key assigned to the quantum security terminal according to the key download request; and encrypts the pairing key and sends it to the quantum security terminal using the quantum key in the encryption key; The quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key.

7. The method according to claim 6, characterized in that After the quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key, the method further includes: The shared key center and the quantum security terminal determine that the pairing key passes a consistency check.

8. The method according to claim 7, characterized in that The method further comprises: The shared key center records the key download status of the quantum security terminal as successful download; The quantum security terminal encrypts and sends a query status request to the shared key center through the quantum key in the encryption key; wherein the query status request carries the distribution identifier and the network access identifier of the quantum security terminal of the other end; The shared key center decrypts the received encrypted query status request based on the quantum key in the encryption key; obtains the target key download status corresponding to the network access identifier based on the distribution identifier; and encrypts the query status response carrying the target key download status and sends it to the quantum security terminal based on the quantum key in the encryption key; The quantum security terminal decrypts the received encrypted query status response based on the quantum key in the encryption key; if it is determined that the target key download status represents that the quantum security terminal of the network access identifier has successfully downloaded the pairing key, it is determined that the quantum security terminal and the quantum security terminal of the network access identifier have point-to-point quantum encryption communication capabilities; if it is determined that the target key download status represents that the quantum security terminal of the network access identifier has not successfully downloaded the pairing key, the query status request is repeatedly sent to the shared key center in encrypted form until it is determined that the quantum security terminal and the quantum security terminal of the network access identifier have point-to-point quantum encryption communication capabilities.

Images