Distributed quantum key management system and method
Through the offline and online combination of distributed quantum key management system, the problem of high cost and low efficiency of quantum key distribution is solved, efficient and secure distribution of keys is achieved, and the implementation of quantum communication is promoted.
Patent Information
- Application Number
- CN202411630178.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-15
- Publication Date
- 2025-01-10
AI Technical Summary
The existing quantum key distribution technology has problems such as high cost, low efficiency and difficulty in operation and maintenance, and it is difficult to achieve the widespread implementation of quantum communication.
Adopt a distributed quantum key management system, combining offline and online methods, through the collaborative work of key management center, key distribution agency and key application equipment, the mixing and replacement of keys is achieved, ensuring the security and efficiency of keys. distribution.
It reduces hardware costs, improves key distribution efficiency, ensures the security of keys and information transmission, and realizes the widespread use and implementation of quantum keys.
Smart Images
Figure CN119299094A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of quantum key management, and in particular to a distributed quantum key management system and method. Background Art
[0002] With the emergence of supercomputers and quantum computing, the computing power of computers has been greatly improved. Traditional encryption algorithms based on specific mathematical problems, including classical symmetric algorithms and asymmetric algorithms, are at risk of being cracked. The existing cryptographic security system will gradually become unsuitable. The world urgently needs a new technology to ensure the security of information transmission.
[0003] Quantum communication based on quantum key technology can counter the risk of key cracking caused by the increase in computing power, and its absolute security has been strictly proven in principle. Quantum communication uses a one-time one-key method. Each communication is encrypted with a random quantum key, and the other end uses the same quantum key for decryption. During the communication process, the quantum key is not transmitted over the network, and there is no risk of leakage. Therefore, the security of the key ensures the security of the information, and how to distribute the quantum key securely is crucial.
[0004] At present, there are two main modes of quantum key distribution: online quantum key distribution mode and offline quantum key distribution mode:
[0005] The online quantum key distribution mode is also called Quantum Key Distribution (QKD), and its security is guaranteed by the basic principles of quantum mechanics. Any eavesdropping on the quantum key distribution process may change the quantum state itself, causing a high bit error rate, thereby making the eavesdropping discovered. Generally speaking, the transmission of quantum states in the QKD process is achieved by encoding, transmitting, and measuring photons. This requires users to use dedicated fiber optic connections or physically controlled free-space transmitters. If quantum keys are to be used and implemented in large quantities, QKD backbone networks, metropolitan area networks, relay networks, etc. must be deployed. Due to hardware costs and deployment difficulties, it is difficult to achieve in the short term.
[0006] The offline quantum key distribution mode adds a quantum random number generator (QRNG) to achieve offline quantum key distribution, expand offline key applications, and solve the cost problem of QKD firmware. The key pairing between nodes is distributed by manual back-transmission. For a large number of nodes, the subsequent key supplementation has relatively high labor costs, complex operation and maintenance, and low key distribution efficiency.
[0007] Based on the respective shortcomings of the above two modes, how to distribute and manage quantum keys with low cost, high efficiency and security has become an urgent need for the development of quantum communications. Summary of the invention
[0008] Purpose of the invention: In view of the above-mentioned shortcomings, the present invention proposes a distributed quantum key management system and method that combines offline and online, so as to solve the problems of high cost, low efficiency and difficult operation and maintenance in the prior art, making the implementation of quantum communication technology possible.
[0009] Technical solution: The present invention includes a distributed quantum key management system, including:
[0010] The key management center is used to receive quantum keys through the intranet. The key management center adopts a distributed deployment, and each key management center provides key distribution for key distribution agencies and key application devices in their respective distribution areas.
[0011] The key distribution agency is connected to the key management center in an offline manner to receive the key distributed by the key management center; and is connected to the key application device in an offline manner to distribute the key to the key application device;
[0012] A key application device includes a first device and a second device paired with the first device for communication, and is used to receive a first key distributed by a key distribution agency and a second key distributed by a key distribution agency or a key management center, and select keys from the first key and the second key according to a preset hashing ratio to obtain a hashed key, select a replacement key from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are working keys for communication between the first device and the second device.
[0013] Furthermore, the first key and the second key distributed by the key distribution agency are distributed in an offline manner, and the second key distributed by the key management center is distributed in an online manner.
[0014] Furthermore, the keys are selected from the first key and the second key according to a preset hashing ratio and are hashed to obtain a hashed key:
[0015] (1) Let the preset hashing ratio be 1:n, where n is a positive integer greater than or equal to 2; that is, the ratio of the key selected from the first key to the key selected from the second key is 1:n;
[0016] (2) The key selected from the second key is decomposed into n district keys according to the length of the key selected from the first key, where n is a positive integer greater than or equal to 2, and the length of each district key is the same as the length of the key selected from the first key. Then, the key selected from the first key is subjected to an XOR operation with the n district keys respectively, and the n district keys after XOR are recombined according to the decomposition rules to form a hash key.
[0017] Furthermore, after the first device and the second device both obtain the first key, a consistency check is performed. If the check is consistent, the first key is retained, otherwise the first key is redistributed; after the first device and the second device both obtain the second key, a consistency check is performed. If the check is consistent, the second key is retained, otherwise the second key is redistributed; after the first device and the second device both obtain the hashed key, a consistency check is performed. If the check is consistent, a replacement key is selected from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are the working keys for communication between the first device and the second device, otherwise the key hashing is performed again.
[0018] Furthermore, after receiving the quantum key, the key management center forms corresponding key index information and stores it in its internal memory; wherein the key index information includes: the hash value of the key, the key storage path, the key size, the key availability status and the key generation time, and the hash value of the key is obtained by performing a hash operation on the key.
[0019] Furthermore, the key management center forms corresponding key index information after receiving the quantum key through the key receiving module set therein. The key management center also copies the key to the key distribution agency in an offline manner through the key copy module set therein, and downloads the key to the key application device in an online manner through the key download module set therein.
[0020] Furthermore, the key receiving module queries the amount of available keys in the key management center and the percentage of storage space occupied by them, and determines whether it is necessary to receive the key. If the amount of available keys is less than a preset threshold and the percentage of storage space occupied by them is less than a preset threshold, the key receiving module receives the quantum key; otherwise, the key receiving module does not receive the quantum key.
[0021] The key copy module or the key download module queries the available key quantity in the key management center, distributes keys when the available key quantity is greater than the key request value, and updates the corresponding key index information in the key management center.
[0022] Furthermore, the key management center is connected to one or more key generation modules through an intranet to receive the quantum key generated by the key generation module; the key generation module generates the quantum key through a quantum random number generator.
[0023] The present invention also includes a management method using the above-mentioned distributed quantum key management system, comprising the steps of:
[0024] (1) The key management center receives the quantum key;
[0025] (2) The key management center distributes quantum keys to the key distribution agency in an offline manner;
[0026] (3) The key distribution agency distributes the first key to the first device and the second device in the key application device in an offline manner; then the key distribution agency distributes the second key to the first device and the second device in the key application device in an offline manner, or the key management center distributes the second key to the first device and the second device in the key application device in an online manner, or the key distribution agency distributes the second key to the first device in the key application device in an offline manner, and the key management center distributes the second key to the second device in the key application device in an online manner;
[0027] (4) The first device and the second device select keys from the first key and the second key respectively according to a preset hashing ratio to obtain a hashed key, select a replacement key from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are working keys for communication between the first device and the second device.
[0028] Furthermore, after the first device and the second device both obtain the first key, a consistency check is performed. If the check is consistent, the first key is retained, otherwise the first key is redistributed; after the first device and the second device both obtain the second key, a consistency check is performed. If the check is consistent, the second key is retained, otherwise the second key is redistributed; after the first device and the second device both obtain the hashed key, a consistency check is performed. If the check is consistent, a replacement key is selected from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are the working keys for communication between the first device and the second device, otherwise the key hashing is performed again.
[0029] Furthermore, after both the first device and the second device obtain the first key, the specific process of performing consistency verification is as follows:
[0030] 1) The first device and the second device are both provided with the same preset hash algorithm. The first device selects a hash algorithm from the preset hash algorithms and uses the hash algorithm to calculate a hash value of the first key, which is recorded as h(first key);
[0031] 2) The first device sends the hash value h (first key) to the second device and informs the second device of the hash algorithm selected. After receiving it, the second device selects the same hash algorithm as the hash algorithm selected by the first device to perform a hash operation on its own first key to obtain a hash value, recorded as h′ (first key). If the hash value h′ (first key) calculated by the second device is the same as the hash value h (first key), the verification passes and is returned to the first device, and the first device and the second device retain the first key; otherwise, the verification fails and the first key is redistributed.
[0032] Beneficial effects: The distributed quantum key management system and method of the present invention provide key distribution services for key application devices, and realize the sharing of distributed quantum keys by multiple devices in combination with quantum key distribution, which solves the cost problem (no dedicated optical fiber is required) and the distance problem (Internet is sufficient), making it possible to use and implement quantum keys in large quantities; moreover, through the scheme of the present invention, each time the key is mixed, the key in the used first key will be overwritten. Even if the first key is not updated, the key in the first key participating in the mixing each time is newly generated and unused, and there is no risk of leakage or cracking, which further improves the security of the key; the second key downloaded through the Internet theoretically has the risk of leakage, but after being mixed with the first key, the new key generated is the working key. Because the first key has no risk of leakage and is random, the mixed key is also safe in theory, which further ensures the security of information transmission. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] Figure 1 A network topology diagram of the system of the present invention;
[0034] Figure 2 is an architecture diagram of the system of the present invention;
[0035] Figure 3 This is a flow chart of dual offline key distribution of the present invention;
[0036] Figure 4 This is a dual online key distribution flow chart of the present invention;
[0037] Figure 5 This is a flow chart of the offline and online combined key distribution method of the present invention. DETAILED DESCRIPTION
[0038] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments.
[0039] like Figure 1 As shown, a distributed quantum key management system of the present invention includes a key management center 1, a key distribution mechanism 2 and a key application device 3; the key management center 1 is used to receive a quantum key through an intranet, and the quantum key is generated by a key generation module 4. After receiving the quantum key from the key generation module 4, the key management center 1 forms corresponding key index information and stores it in a memory therein; the key index information includes but is not limited to the following information: a hash value of the key, a storage path of the key, a size of the key, an available state of the key and a generation time of the key, wherein the hash value of the key is obtained by performing a hash operation on the key; the available state of the key is whether it is available, which means that the state of the key changes to unavailable after being used, otherwise, it is available.
[0040] The key distribution agency 2 is connected to the key management center 1 in an offline manner to receive the key distributed by the key management center 1; and is connected to the key application device 3 in an offline manner to distribute the key to the key application device 3;
[0041] The key application device 3 includes a first device and a second device paired with the first device for communication, both of which are connected to the key distribution agency 2 in an offline manner and connected to the key management center 1 in an online manner. The key application device 3 is used to receive the first key distributed by the key distribution agency 2 and the second key distributed by the key distribution agency 2 or the key management center 1, and select keys from the first key and the second key according to a preset hashing ratio to obtain a hashed key, select a replacement key from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are the working keys for communication between the first device and the second device.
[0042] In the present invention, considering the region, operator, etc., the key management center 1 adopts a distributed deployment, and each key management center 1 provides key distribution services to the key distribution agency 2 and key application device 3 in their respective distribution areas according to distance, operator, etc. The key distribution service includes key copying and key downloading. Considering the efficiency of quantum key generation, the key generation module 4 connected to each key management center 1 can also be set to one or more, and all are connected to the key management center 1 through a local area network, which is not accessible to the public network, so there is no risk of network leakage;
[0043] The key management center 1 distributes the quantum key stored in its memory to the key distribution agency 2 in an offline manner; or distributes the quantum key stored in its memory to the key application device 3 in an online manner; the key distribution agency 2 distributes the quantum key stored in it to the key application device 3 in an offline manner; wherein the offline method adopts hardware insertion or local area network connection, wherein the hardware device includes but is not limited to general-purpose devices or special-purpose devices such as hard disks, U disks, pads or mobile computers; the online method adopts Internet connection.
[0044] like Figure 2 As shown, specifically, the key management center 1 receives the quantum key generated by the key generation module 4 through the key receiving module 11 provided therein to form the corresponding key index information, and the key management center 1 also copies the key to the key distribution mechanism 2 in an offline manner through the key copying module 12 provided therein, and downloads the key to the key application device 3 in an online manner through the key downloading module 13 provided therein;
[0045] Among them, before receiving the quantum key generated by the key generation module 4, the key receiving module 11 first queries the amount of available keys in the memory of the key management center 1 and the percentage of the storage space they occupy, and determines whether it is necessary to receive the key. If the amount of available keys is less than a preset threshold and the percentage of the storage space they occupy is less than the preset threshold, the key receiving module 11 receives the quantum key; otherwise, the key receiving module 11 does not receive the quantum key; the preset threshold is a custom numerical limit. When the amount of available keys in the memory of the key management center 1 is lower than the custom numerical limit, it is necessary to receive the quantum key.
[0046] Before distributing keys, the key copy module 12 or the key download module 13 first queries the available key quantity in the memory of the key management center 1, and distributes keys when the available key quantity is greater than the key request value, and updates the corresponding key index information in the key management center 1.
[0047] In the present invention, each key distribution agency 2 has its unique device number and enters its device number in the key management center 1. When the key distribution agency 2 is connected to the key management center 1 in an offline manner, the key management center 1 verifies its device number for authentication.
[0048] The key generation module 4 is used for quantum key generation, including but not limited to generating quantum keys through a quantum random number generator. The present invention may also adopt other quantum key generation methods.
[0049] The key distribution agency 2 receives the keys distributed by the key management center 1 and updates its distributable key quantity; the first key and the second key distributed by the key distribution agency 2 are distributed in an offline manner, and the second key distributed by the key management center 1 is distributed in an online manner.
[0050] The first key in the key application device 3 is distributed by the key distribution agency 2 in an offline manner, and the second key can be distributed by the key distribution agency 2 or distributed by the key management center 1 in an online manner. After both the first device and the second device obtain the first key, a consistency check is performed. If the check is consistent, the first key is retained, otherwise the first key is redistributed; after both the first device and the second device obtain the second key, a consistency check is performed. If the check is consistent, the second key is retained, otherwise the second key is redistributed; after both the first device and the second device obtain the hashed key, a consistency check is performed. If the check is consistent, a replacement key is selected from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are the working keys for communication between the first device and the second device, otherwise the key hashing is performed again.
[0051] After both the first device and the second device obtain the first key, the specific process of performing consistency verification is as follows: 1) the first device and the second device are both provided with the same preset hash algorithm, the first device selects a hash algorithm from the preset hash algorithms, and uses the hash algorithm to calculate the hash value of the first key, which is recorded as h (first key);
[0052] 2) The first device sends the hash value h (first key) to the second device and informs the second device of the hash algorithm selected. After receiving it, the second device selects the same hash algorithm as the hash algorithm selected by the first device to perform a hash operation on its own first key to obtain a hash value, recorded as h′ (first key). If the hash value h′ (first key) calculated by the second device is the same as the hash value h (first key), the verification passes and is returned to the first device, and the first device and the second device retain the first key; otherwise, the verification fails and the first key is redistributed.
[0053] The consistency check of the second key and the consistency check of the mixed key are both performed using the above method to ensure the accuracy of key distribution.
[0054] After the first key and the second key in the key application device 3 are distributed, keys are selected from the first key and the second key according to a preset hashing ratio to obtain a hashed key, and a replacement key is selected from the hashed key to replace the key selected from the first key during hashing. The remaining keys in the hashed key are the working keys for communication between the first device and the second device.
[0055] The specific hashing key obtained by hashing is:
[0056] (1) Let the preset hashing ratio be 1:n, where n is a positive integer greater than or equal to 2; that is, the ratio of the key selected from the first key to the key selected from the second key is 1:n;
[0057] (2) The key selected from the second key is decomposed into n district keys according to the length of the key selected from the first key, where n is a positive integer greater than or equal to 2, and the length of each district key is the same as the length of the key selected from the first key. Then, the key selected from the first key is subjected to an XOR operation with the n district keys respectively, and the n district keys after XOR are recombined according to the decomposition rules to form a hash key.
[0058] The method of hashing the key in the present invention is an XOR method. Of course, the existing symmetric encryption method (such as AES or DES or national encryption SM4) can also be used for hashing.
[0059] The working key is the key used for encryption / decryption on the key application device 3. The key is not transmitted during the communication process, only the key index information is transmitted. There is no risk of key leakage. Since the key verification of both parties is completely consistent, the receiver can easily find the key used by the sender, thereby conducting secure communication.
[0060] In the present invention, each key application device 3 also has its unique device number, and its device number is entered into the key distribution agency 2. When the key application device 3 is connected to the key distribution agency 2 in an offline manner, the key distribution agency 2 verifies its device number for authentication.
[0061] The present invention also provides a management method using the above-mentioned distributed quantum key management system, comprising the steps of:
[0062] (1) The key management center 1 receives the quantum key;
[0063] The key management center 1 receives the quantum key from the key generation module 4 through the key receiving module 11, forms the corresponding key index information, and stores it in the memory therein; wherein, before receiving the quantum key generated by the key generation module 4, the key receiving module 11 first queries the amount of available keys in the memory of the key management center 1 and the percentage of the storage space occupied by them, and determines whether it is necessary to receive the key. If the amount of available keys is less than a preset threshold and the percentage of the storage space occupied by them is less than the preset threshold, the key receiving module 11 receives the quantum key; otherwise, the key receiving module 11 does not receive the quantum key; the preset threshold is a user-defined numerical limit, and when the amount of available keys in the memory of the key management center 1 is lower than the user-defined numerical limit, it is necessary to receive the quantum key;
[0064] (2) The key management center 1 distributes the quantum key to the key distribution agency 2 in an offline manner;
[0065] The key distribution agency 2 is connected to the key management center 1 through hardware insertion or local area network, and the key management center 1 authenticates it according to the device number; after the authentication is passed, the key copy module 12 queries the available key quantity in the memory of the key management center 1, and copies the key to the key distribution agency 2 for key distribution when the available key quantity is greater than the key copy request quantity; the key distribution agency 2 saves the key distributed by the key management center 1 and updates the distributable key quantity information therein;
[0066] (3) The key distribution mechanism 2 distributes the first key to the first device and the second device in the key application device 3 in an offline manner; then the key distribution mechanism 2 distributes the second key to the first device and the second device in the key application device 3 in an offline manner, or the key management center 1 distributes the second key to the first device and the second device in the key application device 3 in an online manner, or the key distribution mechanism 2 distributes the second key to the first device in the key application device 3 in an offline manner, and the key management center 1 distributes the second key to the second device in the key application device 3 in an online manner;
[0067] The specific process is:
[0068] First key distribution of key application device 3:
[0069] The first device in the key application device 3 is connected to the key distribution agency 2 through hardware insertion or local area network, and the key distribution agency 2 authenticates it; after the authentication is passed, the key distribution agency 2 distributes the first key to the first device; the second device in the key application device 3 is connected to the key distribution agency 2 through hardware insertion or local area network, and the key distribution agency authenticates it; after the authentication is passed, the key distribution agency 2 distributes the first key to the second device; after the first device and the second device both obtain the first key, a consistency check is performed, and if the check is consistent, the first key is retained, otherwise the first key is redistributed;
[0070] The specific process of performing consistency check is as follows: 1) the first device and the second device are both provided with the same preset hash algorithm, the first device selects a hash algorithm from the preset hash algorithms, and uses the hash algorithm to calculate the hash value of the first key, which is recorded as h (first key);
[0071] 2) The first device sends the hash value h (first key) to the second device and informs the second device of the hash algorithm selected. After receiving it, the second device selects the same hash algorithm as the hash algorithm selected by the first device to perform a hash operation on its own first key to obtain a hash value, recorded as h′ (first key). If the hash value h′ (first key) calculated by the second device is the same as the hash value h (first key), the verification passes and is returned to the first device, and the first device and the second device retain the first key; otherwise, the verification fails and the first key is redistributed.
[0072] Second key distribution of key application device 3:
[0073] There are three ways to distribute the second key: dual online, dual offline, and offline-online combination. The dual online distribution method can reduce operation and maintenance costs, solve cost and distance problems, and make it possible to use and implement quantum keys in large quantities. For enterprises with large key volumes or higher security, such as military industry, government, banks, etc., dual offline distribution of the second key can be selected, which has higher distribution efficiency. Offline distribution is not transmitted in the network, and the security requirement level is also higher. For more special scenarios, such as when one of the key application devices is not in the key center service list or is connected to the key center LAN (such as the application device is a backend server), a hybrid distribution method combining offline and online can be used.
[0074] a: Dual online distribution of the second key
[0075] like Figure 4 As shown, the first device in the key application device 3 requests the key management center 1 to download the second key online, and the key management center 1 distributes the second key and its corresponding second key index information to the first device online through the key download module 13 set therein according to the request of the first device; the first device sends the second key index information to the second device in the key application device 3, and the second device initiates a key download request to the key management center 1 according to the second key index information, and the key management center 1 distributes the second key to the second device through the key download module 13; after the first device and the second device both obtain the second key, a consistency check is performed, and if the check is consistent, the second key is retained, otherwise the second key is redistributed; the second key consistency check is the same as the first key consistency check process, so it will not be described again;
[0076] b: Second key dual offline distribution
[0077] like Figure 3 As shown, the first device in the key application device 3 is connected to the key distribution agency 2 through hardware insertion or local area network, and the key distribution agency 2 authenticates it; after the authentication is passed, the key distribution agency 2 distributes the second key to the first device; the second device in the key application device 3 is connected to the key distribution agency 2 through hardware insertion or local area network, and the key distribution agency authenticates it; after the authentication is passed, the key distribution agency 2 distributes the second key to the second device; after the first device and the second device both obtain the second key, a consistency check is performed, if the check is consistent, the second key is retained, otherwise the second key is redistributed; the second key consistency check is the same as the first key consistency check process, so it will not be described again;
[0078] c: Second key offline and online distribution
[0079] like Figure 5As shown, the first device in the key application device 3 is connected to the key distribution agency 2 through hardware insertion or local area network, and the key distribution agency 2 authenticates it; after the authentication is passed, the key distribution agency 2 distributes the second key and its corresponding second key index information to the first device. It should be noted that: a part of the keys in the key distribution agency 2 are used for offline and online combined distribution. These keys are distributed by the key management center 1 to the key distribution agency 2, and the key index information corresponding to these keys is also sent to the key distribution agency 2. When the key distribution agency 2 knows that the key is used for offline and online combined distribution, it will also send the key index information corresponding to the key to the device at the same time. The device requests the key management center 1 to distribute the corresponding key based on the key hash value and other information in the key index information; the first device sends the second key index information to the second device in the key application device 3, and the second device initiates a key download request to the key management center 1 based on the second key index information. The key management center 1 distributes the second key to the second device through the key download module 13; after the first device and the second device both obtain the second key, a consistency check is performed. If the check is consistent, the second key is retained, otherwise the second key is redistributed; the second key consistency check is the same as the first key consistency check process, so it will not be described again;
[0080] (4) The first device and the second device select keys from the first key and the second key respectively according to a preset hashing ratio to obtain a hashed key. After the first device and the second device obtain the hashed key, a consistency check is performed. The hashed key consistency check is the same as the first key consistency check process, so it is not described again. If the check is consistent, a replacement key is selected from the hashed key to replace the key selected from the first key during hashing. The remaining keys in the hashed key are the working keys for communication between the first device and the second device. Otherwise, the key hashing is performed again.
[0081] The specific hashing key obtained by hashing is:
[0082] (1) Let the preset hashing ratio be 1:n, where n is a positive integer greater than or equal to 2; that is, the ratio of the key selected from the first key to the key selected from the second key is 1:n;
[0083] (2) The key selected from the second key is decomposed into n district keys according to the length of the key selected from the first key, where n is a positive integer greater than or equal to 2, and the length of each district key is the same as the length of the key selected from the first key. Then, the key selected from the first key is subjected to an XOR operation with the n district keys respectively, and the n district keys after XOR are recombined according to the decomposition rules to form a hash key.
[0084] The method of hashing the key in the present invention is an XOR method. Of course, the existing symmetric encryption method (such as AES or DES or national encryption SM4) can also be used for hashing.
[0085] Through the scheme of the present invention, each time the key is hashed, the key in the used first key will be overwritten, so that even if the first key is not updated, the key in the first key participating in the hashing each time is newly generated and unused, and there is no risk of leakage or cracking, thereby further improving the security of the key.
[0086] The second key downloaded through the Internet theoretically has the risk of leakage, but after being mixed with the first key, the new key generated is the working key. Because the first key has no risk of leakage and is random, the mixed key is also safe in theory.
[0087] In addition, if you do not trust the Internet and do not believe in the mixing of the aforementioned keys, you can also supplement the key by distributing the second key offline. In this way, no key will be transmitted through the Internet, which is more secure.
[0088] Finally, the first key and the second key can be distributed by different key distribution agencies and operators of different key distribution agencies, which is more secure. Even if the operators of the key distribution agencies collude, the keys distributed to the key application devices still need to be mixed, which will generate new working keys. There is no risk of leakage of the quantum keys on the application devices.
[0089] The preferred embodiments of the present invention are described in detail above, but the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, various equivalent transformations (such as quantity, shape, position, etc.) can be made to the technical scheme of the present invention, and these equivalent transformations all belong to the protection scope of the present invention.
Claims
1. A distributed quantum key management system, characterized in that: include: The key management center is used to receive quantum keys through the intranet. The key management center adopts a distributed deployment, and each key management center provides key distribution for key distribution agencies and key application devices in their respective distribution areas. The key distribution agency is connected to the key management center in an offline manner to receive the key distributed by the key management center; and connecting with the key application device in an offline manner to distribute the key to the key application device; A key application device includes a first device and a second device paired with the first device for communication, and is used to receive a first key distributed by a key distribution agency and a second key distributed by a key distribution agency or a key management center, and select keys from the first key and the second key according to a preset hashing ratio to obtain a hashed key, select a replacement key from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are working keys for communication between the first device and the second device.
2. The distributed quantum key management system according to claim 1, characterized in that: The first key and the second key distributed by the key distribution agency are in an offline manner, and the second key distributed by the key management center is in an online manner.
3. The distributed quantum key management system according to claim 1, characterized in that: According to the preset hashing ratio, keys are selected from the first key and the second key for hashing to obtain the hashed key: (1) Let the preset hashing ratio be 1:n, where n is a positive integer greater than or equal to 2; that is, the ratio of the key selected from the first key to the key selected from the second key is 1:n; (2) The key selected from the second key is decomposed into n district keys according to the length of the key selected from the first key, where n is a positive integer greater than or equal to 2, and the length of each district key is the same as the length of the key selected from the first key. Then, the key selected from the first key is subjected to an XOR operation with the n district keys respectively, and the n district keys after XOR are recombined according to the decomposition rules to form a hash key.
4. The distributed quantum key management system according to claim 1, characterized in that: After the first device and the second device both obtain the first key, a consistency check is performed. If the check is consistent, the first key is retained, otherwise the first key is redistributed; after the first device and the second device both obtain the second key, a consistency check is performed. If the check is consistent, the second key is retained, otherwise the second key is redistributed; after the first device and the second device both obtain the hashed key, a consistency check is performed. If the check is consistent, a replacement key is selected from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are the working keys for communication between the first device and the second device, otherwise the key hashing is performed again.
5. The distributed quantum key management system according to claim 1, characterized in that: After receiving the quantum key, the key management center forms the corresponding key index information and stores it in its internal memory; the key index information includes: the hash value of the key, the key storage path, the key size, the key availability status and the key generation time. The hash value of the key is obtained by performing a hash operation on the key.
6. The distributed quantum key management system according to claim 5, characterized in that: The key management center forms corresponding key index information after receiving the quantum key through the key receiving module set therein. The key management center also copies the key to the key distribution agency in an offline manner through the key copy module set therein, and downloads the key to the key application device in an online manner through the key download module set therein.
7. The distributed quantum key management system according to claim 6, characterized in that: The key receiving module queries the amount of available keys in the key management center and the percentage of storage space occupied by them, and determines whether it is necessary to receive the key. If the amount of available keys is less than a preset threshold and the percentage of storage space occupied by them is less than a preset threshold, the key receiving module receives the quantum key; Otherwise, the key receiving module does not receive the quantum key; The key copy module or the key download module queries the available key quantity in the key management center, distributes keys when the available key quantity is greater than the key request value, and updates the corresponding key index information in the key management center.
8. The distributed quantum key management system according to claim 1, characterized in that: The key management center is connected to one or more key generation modules through an intranet to receive the quantum key generated by the key generation module; the key generation module generates the quantum key through a quantum random number generator.
9. A management method using the distributed quantum key management system according to any one of claims 1 to 8, characterized in that: Includes steps: (1) The key management center receives the quantum key; (2) The key management center distributes quantum keys to the key distribution agency in an offline manner; (3) The key distribution agency distributes the first key to the first device and the second device in the key application device in an offline manner; then the key distribution agency distributes the second key to the first device and the second device in the key application device in an offline manner, or the key management center distributes the second key to the first device and the second device in the key application device in an online manner, or the key distribution agency distributes the second key to the first device in the key application device in an offline manner, and the key management center distributes the second key to the second device in the key application device in an online manner; (4) The first device and the second device select keys from the first key and the second key respectively according to a preset hashing ratio to obtain a hashed key, select a replacement key from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are working keys for communication between the first device and the second device.
10. The management method according to claim 9, characterized in that: After the first device and the second device both obtain the first key, a consistency check is performed. If the check is consistent, the first key is retained, otherwise the first key is redistributed; after the first device and the second device both obtain the second key, a consistency check is performed. If the check is consistent, the second key is retained, otherwise the second key is redistributed; after the first device and the second device both obtain the hashed key, a consistency check is performed. If the check is consistent, a replacement key is selected from the hashed key to replace the key selected from the first key during hashing, and the remaining keys in the hashed key are the working keys for communication between the first device and the second device, otherwise the key hashing is performed again.
11. The management method according to claim 10, characterized in that: After both the first device and the second device obtain the first key, the specific process of performing consistency verification is as follows: 1) The first device and the second device are both provided with the same preset hash algorithm. The first device selects a hash algorithm from the preset hash algorithms and uses the hash algorithm to calculate a hash value of the first key, which is recorded as h(first key); 2) The first device sends the hash value h (first key) to the second device and informs the second device of the hash algorithm selected. After receiving it, the second device selects the same hash algorithm as the hash algorithm selected by the first device to perform a hash operation on its own first key to obtain a hash value, recorded as h′ (first key). If the hash value h′ (first key) calculated by the second device is the same as the hash value h (first key), the verification passes and is returned to the first device, and the first device and the second device retain the first key; otherwise, the verification fails and the first key is redistributed.