Quantum device discovery method, device and system

Abstract

The invention discloses a method, a device and a system for discovering quantum equipment, and belongs to the technical field of networks. The application device obtains the IP address and the port number of the quantum device, and the port number is used for the quantum device to provide the quantum key for the application device. The application device sends a quantum device discovery message to other application devices, the quantum device discovery message including an IP address and a port number of the quantum device. According to the application, the IP address and the port number of the quantum device are automatically diffused through the application device, so that the overall efficiency and convenience of obtaining the quantum key by the application device in a communication network can be improved, and wide application of the quantum key in a classic network can be realized.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a method, device and system for discovering quantum devices. Background Art

[0002] With the development of quantum computing, quantum attacks pose a huge threat to the currently widely used cryptographic systems. Quantum attacks are attack algorithms running on quantum computers that can crack currently widely used symmetric encryption algorithms such as the Advanced Encryption Standard (AES) algorithm and the SM4 block cipher algorithm. Quantum computers are expected to be available in the next few decades. If an eavesdropper intercepts and saves data that is encrypted using the current encryption algorithm and transmitted over the network, and then uses a quantum attack to crack the encryption algorithm used by the saved data after the quantum computer is available, the decrypted plaintext data can be obtained. This is a huge threat to confidential information that needs to be preserved for a long time. Therefore, it is urgent to design cryptographic technology that can resist quantum attacks.

[0003] Quantum key distribution (QKD) is a secure key distribution technology that can achieve secure transmission of quantum keys (QK) between two distant communication terminals. The security of quantum key distribution is guaranteed by the basic principles of quantum mechanics. In quantum networks, the transmission of quantum keys is theoretically unconditionally secure. Quantum keys are generated and distributed by quantum devices. If application devices in classical networks want to use quantum keys, they need to request quantum keys from quantum devices. How to enable application devices to obtain quantum keys conveniently and quickly is the premise and basis for the widespread application of quantum keys in classical networks. Summary of the invention

[0004] The present application provides a quantum device discovery method, apparatus and system, which can improve the efficiency and convenience of application devices in obtaining quantum keys.

[0005] In a first aspect, a method for discovering a quantum device is provided. A first application device obtains an Internet Protocol (IP) address and a port number of a quantum device, and the port number is used by the quantum device to provide a quantum key to the application device. The first application device sends a first quantum device discovery message to a second application device, and the first quantum device discovery message includes the IP address and port number of the quantum device. In this application, the IP address and port number of the quantum device are collectively referred to as quantum device information.

[0006] This application automatically spreads quantum device information through application devices, without the need to manually configure quantum device information on each application device. Therefore, it can improve the overall efficiency and convenience of application devices in communication networks in obtaining quantum keys, and help realize the widespread application of quantum keys in classical networks.

[0007] Optionally, the first quantum device discovery message is a Border Gateway Protocol (BGP) update message, and the IP address and port number of the quantum device are in a path attribute field of the BGP update message.

[0008] This application extends the BGP update message to carry the IP address and port number of the quantum device, which is simple to implement and has a wide range of applications.

[0009] Optionally, before the first application device sends the first quantum device discovery message to the second application device, the first application device sends a capability negotiation request message to the second application device, and the capability negotiation request message is used to determine whether the second application device has the ability to parse quantum device information from the first quantum device discovery message. The first application device receives a capability negotiation response message corresponding to the capability negotiation request message sent by the second application device, and the capability negotiation response message indicates that the second application device has the ability to parse quantum device information from the first quantum device discovery message. The quantum device information includes the IP address and port number of the quantum device.

[0010] In this application, the application devices first negotiate their capabilities, and after determining that the other party has the ability to parse quantum device information from the quantum device discovery message, they send the quantum device discovery message to the other party, which can improve the reliability and effectiveness of the transmission of quantum device information.

[0011] Optionally, the capability negotiation request message is a BGP open message, and the BGP open message carries target address family information. The target address family information is used by the second application device to determine whether it has the ability to parse quantum device information from the first quantum device discovery message.

[0012] This application performs capability negotiation by extending BGP open messages and BGP address families, and has a simple implementation and a wide range of applications.

[0013] Optionally, the capability negotiation response message is a BGP keep-alive message.

[0014] Optionally, the capability negotiation request message includes an authentication credential, which is used by the second application device to perform security authentication on the first application device. The second application device performs security authentication on the first application device, which can be understood as the second application device determining whether the second application device and the first application device are located in the same security domain.

[0015] This application pre-configures a security domain so that quantum device information can be diffused within the security domain, thereby improving the transmission security and reliability of quantum device information.

[0016] Optionally, the authentication credential is a preconfigured shared key. Alternatively, the authentication credential includes a random number generated by the first application device and a signature of the random number by the first application device using a private key of the first application device.

[0017] Optionally, an implementation method for the first application device to obtain the IP address and port number of the quantum device includes: the first application device receives a notification message sent by the quantum device, the notification message includes address information of the quantum device, and the address information is used by the application device to request a quantum key from the quantum device. The first application device obtains the IP address and port number of the quantum device according to the address information. In the present application, the address information of the quantum device at least includes the port number of the quantum device. Optionally, the address information of the quantum device also includes the IP address of the quantum device. In other words, the address information of the quantum device is equivalent to the quantum device information, or the address information of the quantum device only includes the port number of the quantum device.

[0018] This application uses quantum devices to actively notify application devices of their address information, so that application devices can automatically discover quantum devices with quantum key distribution capabilities. Since there is no need to manually configure quantum device information on application devices, the efficiency and convenience of application devices in obtaining quantum keys can be improved, which helps to realize the widespread application of quantum keys in classical networks.

[0019] Optionally, another implementation manner in which the first application device obtains the IP address and port number of the quantum device includes: the first application device receives a second quantum device discovery message sent by a third application device, where the second quantum device discovery message includes the IP address and port number of the quantum device.

[0020] In the present application, after an application device receives quantum device information sent by another application device, it can realize automatic discovery of quantum devices by multiple application devices by further spreading the quantum device information.

[0021] In a second aspect, a method for discovering a quantum device is provided. A second application device receives a quantum device discovery message sent by a first application device, the quantum device discovery message including an IP address and a port number of the quantum device, the port number being used by the quantum device to provide a quantum key to the application device. The second application device parses the quantum device discovery message to obtain the IP address and port number included in the quantum device discovery message. The second application device stores the obtained IP address and port number.

[0022] This application automatically spreads quantum device information through application devices, without the need to manually configure quantum device information on each application device. Therefore, it can improve the overall efficiency and convenience of application devices in communication networks in obtaining quantum keys, and help realize the widespread application of quantum keys in classical networks.

[0023] Optionally, the quantum device discovery message is a BGP update message, and the IP address and port number of the quantum device are in a path attribute field of the BGP update message.

[0024] Optionally, before the second application device receives the quantum device discovery message sent by the first application device, the second application device receives a capability negotiation request message sent by the first application device, and the capability negotiation request message is used to determine whether the second application device has the ability to parse quantum device information from the quantum device discovery message. The second application device sends a capability negotiation response message corresponding to the capability negotiation request message to the first application device, and the capability negotiation response message indicates that the second application device has the ability to parse quantum device information from the quantum device discovery message. The quantum device information includes the IP address and port number of the quantum device.

[0025] Optionally, the capability negotiation request message is a BGP open message, and the BGP open message carries target address family information. The second application device determines, based on the target address family information, that the second application device has the capability to parse quantum device information from the quantum device discovery message.

[0026] Optionally, the capability negotiation response message is a BGP keep-alive message.

[0027] Optionally, the capability negotiation request message includes an authentication credential, and the second application device performs security authentication on the first application device according to the authentication credential. The second application device performs security authentication on the first application device according to the authentication credential, which can be understood as the second application device determining whether the second application device is located in the same security domain as the first application device according to the authentication credential.

[0028] This application pre-configures a security domain so that quantum device information can be diffused within the security domain, thereby improving the transmission security and reliability of quantum device information. This implementation method enables application devices to only receive and parse quantum device information provided by application devices within the same security domain, thereby improving the source reliability of quantum device information obtained by application devices.

[0029] Optionally, the authentication credential is a preconfigured shared key. The implementation method of the second application device performing security authentication on the first application device according to the authentication credential includes: the second application device determines whether the shared key is configured in the second application device. If the shared key is configured in the second application device, the second application device determines that the first application device passes the security authentication. In this implementation method, multiple application devices located in the same security domain are configured with the same shared key.

[0030] Optionally, the authentication credentials include a random number generated by the first application device and a signature of the random number by the first application device using the private key of the first application device. The implementation method in which the second application device performs security authentication on the first application device based on the authentication credentials includes: the second application device verifies the signature using the public key of the first application device. If the second application device verifies the signature successfully, the second application device determines that the first application device has passed the security authentication. In this implementation method, multiple application devices located in the same security domain can obtain the certificates or public keys of other application devices in the security domain.

[0031] In a third aspect, an application device is provided. The application device includes multiple functional modules, and the multiple functional modules interact with each other to implement the method in the first aspect and its respective embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on specific implementations.

[0032] In a fourth aspect, an application device is provided. The application device includes multiple functional modules, and the multiple functional modules interact with each other to implement the method in the second aspect and its respective embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on specific implementations.

[0033] In a fifth aspect, an application device is provided, comprising: a memory, a network interface, and at least one processor. The memory is used to store program instructions, and after the at least one processor reads the program instructions stored in the memory, the quantum device executes the method in the first aspect and its respective embodiments.

[0034] In a sixth aspect, an application device is provided, comprising: a memory, a network interface, and at least one processor. The memory is used to store program instructions, and after the at least one processor reads the program instructions stored in the memory, the application device executes the method in the second aspect and its respective embodiments.

[0035] In a seventh aspect, a quantum device discovery system is provided, including: a first application device and a second application device. The first application device is used to execute the method in the first aspect and its respective embodiments, and the second application device is used to execute the method in the second aspect and its respective embodiments.

[0036] For example, after obtaining the IP address and port number of the quantum device, the first application device is used to send a quantum device discovery message to the second application device, the quantum device discovery message including the IP address and port number of the quantum device, and the port number is used for the quantum device to provide the quantum key to the application device. The second application device is used to receive the quantum device discovery message, parse the quantum device discovery message to obtain the IP address and port number included in the quantum device discovery message, and store the obtained IP address and port number.

[0037] Optionally, the second application device is used to send a key acquisition request to the quantum device according to the IP address and port number of the quantum device. The quantum device is used to send a key acquisition response corresponding to the key acquisition request to the second application device, and the key acquisition response includes the quantum key assigned by the quantum device to the second application device.

[0038] Optionally, the first application device is used to send a key acquisition request to the quantum device according to the IP address and port number of the quantum device. The quantum device is used to send a key acquisition response corresponding to the key acquisition request to the first application device, and the key acquisition response includes the quantum key assigned by the quantum device to the first application device.

[0039] Optionally, the system further includes a quantum device. The quantum device is used to send a notification message to the first application device, the notification message including address information of the quantum device, the address information is used by the application device to request a quantum key from the quantum device. The first application device is used to obtain an IP address and a port number of the quantum device according to the address information.

[0040] Optionally, the first application device and the quantum device are located in the same broadcast domain. Alternatively, a tunnel is established between the first application device and the quantum device.

[0041] In an eighth aspect, a computer-readable storage medium is provided, on which instructions are stored. When the instructions are executed by a processor of an application device, the method in the above-mentioned first aspect and its various embodiments and / or the method in the above-mentioned second aspect and its various embodiments are implemented.

[0042] In a ninth aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor of an application device, implements the method in the above-mentioned first aspect and its various embodiments and / or the method in the above-mentioned second aspect and its various embodiments.

[0043] In the tenth aspect, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip is running, it implements the method in the above-mentioned first aspect and its various embodiments and / or the method in the above-mentioned second aspect and its various embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0045] Figure 2 It is a schematic diagram of the implementation process of a quantum device discovery method provided in an embodiment of the present application;

[0046] Figure 3 This is a schematic diagram of an implementation scenario provided by an embodiment of the present application;

[0047] Figure 4 This is a schematic diagram of the structure of a notification message provided by an embodiment of the present application;

[0048] Figure 5 This is a schematic diagram of the structure of a quantum device discovery message provided by an embodiment of the present application;

[0049] Figure 6 This is a schematic diagram of the structure of another quantum device discovery message provided in an embodiment of the present application;

[0050] Figure 7 This is a schematic diagram of the structure of a capability negotiation request message provided in an embodiment of the present application;

[0051] Figure 8 It is a schematic diagram of the implementation process of another quantum device discovery method provided in an embodiment of the present application;

[0052] Fig. 9 This is a schematic diagram of the implementation process of another quantum device discovery method provided in an embodiment of the present application;

[0053] Fig.10 This is a schematic diagram of the implementation process of another quantum device discovery method provided in an embodiment of the present application;

[0054] Fig.11 It is a structural diagram of a communication system provided in an embodiment of the present application;

[0055] Fig.12 It is a schematic diagram of the hardware structure of an application device provided in an embodiment of the present application;

[0056] Fig.13 It is a structural schematic diagram of an application device provided in an embodiment of the present application;

[0057] Fig.14It is a structural schematic diagram of another application device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0059] In order to facilitate the reader's understanding of the present application, some terms are first explained below.

[0060] 1. Classical computer: A physical device that uses binary (0 or 1) to store and process data. The application device involved in this application belongs to a classical computer.

[0061] 2. Quantum computer: A physical device that follows the laws of quantum mechanics and processes information based on the principles of quantum computing. Quantum computers use quantum bits to store and process data. Quantum bits have more states than binary. Quantum computers have the capabilities of classical computers. Quantum computers can more efficiently solve certain problems that are difficult for classical computers to solve. The quantum device involved in this application belongs to a quantum computer.

[0062] 3. Classical network: a communication network composed of classical computers, for example, a digital transmission network composed of network devices and transmission devices, which transmits classical digital signals (0 / 1). Network devices include but are not limited to routers, switches, firewalls, wireless controllers, wireless access points, personal computers or servers. Transmission devices include but are not limited to microwave systems, synchronous digital hierarchy (SDH) devices or wavelength division multiplexing (WDM) devices. In the embodiments of the present application, the devices in the classical network (including but not limited to network devices) are collectively referred to as application devices.

[0063] 4. Quantum network: It is a new type of secure communication network. It uses quantum entanglement and quantum teleportation to bring real security to the network, as well as a qualitative leap in computing and science. Communication nodes communicate through quantum networks, which can be understood as using quantum key distribution technology to share quantum keys between communication nodes and communicate based on quantum keys. Quantum computers can communicate through quantum networks.

[0064] 5. Quantum attack: It is an attack algorithm running on a quantum computer, such as Shor's algorithm, Grover's algorithm, etc., which can efficiently crack certain passwords.

[0065] 6. Quantum Key Distribution (QKD): It is a secure key distribution technology that uses the Heisenberg uncertainty principle of quantum mechanics and the quantum state non-cloning theorem. In the process of quantum key distribution, a quantum key is generated by a quantum device and transmitted to another quantum device through a quantum network, so that a shared quantum key is formed between the two quantum devices. In the process of quantum key distribution, the quantum key is transmitted in the form of a quantum state. Quantum key distribution has unconditional security. Even if the eavesdropper is given unlimited computing resources, he cannot crack the quantum key using any decryption algorithm. The security basis of quantum key distribution is that the key source cannot be predicted and the channel eavesdropping is detectable. The key source cannot be predicted means that the QKD key source is a quantum true random number and therefore cannot be predicted. The channel eavesdropping is detectable means that the quantum state sent into the channel satisfies the quantum non-cloning theorem, and the eavesdropping behavior in the channel will disturb the quantum state, which can be detected by the receiver.

[0066] 7. Quantum key (QK): It is a symmetric key generated by both communicating parties based on the QKD protocol. In this application, the quantum key is generated and distributed by quantum devices.

[0067] 8. Symmetric encryption algorithm: refers to an algorithm in which the sender and the receiver use the same key for encryption and decryption. Currently commonly used symmetric encryption algorithms include the AES algorithm, the SM4 block cipher algorithm, and the data encryption standard (DES) algorithm.

[0068] 9. Link Layer Discovery Protocol (LLDP): It is a layer 2 protocol that provides a standard link layer discovery method. LLDP enables a device connected to the network to send its main capabilities, management address, device identification, interface identification and other information to other devices connected to the same LAN. LLDP only supports information notification and does not confirm communication information. When a device receives information from other devices on the network through LLDP frames, the device stores this information in the form of MIB, and then the user confirms how to use the MIB information. Optionally, the LLDP frame is encapsulated in Ethernet II format or in Sub-Network Access Protocol (SNAP) format.

[0069] 10. Digital signature (signature for short): It is a means of protecting the sender's data. The sender signs the message with a private key. Any third party without the private key cannot forge the signature. Any third party with the public key corresponding to the private key held by the sender can verify the signature to confirm the source and integrity of the message.

[0070] 11. Signature verification (referred to as signature verification): After receiving the data, the recipient uses the public key to verify the signature and outputs a Boolean value, indicating that the signature is legal (verification passed) or illegal (verification failed). If the signature verification passes, it means that the data has not been tampered with. If the signature verification fails, it means that the data has been tampered with. Signature verification can be used to verify the integrity of the data (not tampered with) and the reliability of the data source (not false or forged data).

[0071] 12. Digital certificate (certificate for short): It is the identity card of a device, user or application in the digital world. The certificate contains the applicant information and the signature of the certificate authority (CA) on the applicant information. The applicant information includes the public key in the key pair held by the applicant. Optionally, the applicant information also includes the applicant's identity information. For example, if the applicant is a device, the applicant's identity information is the device identifier that can uniquely identify the device. Optionally, the device identifier of a device includes but is not limited to one or more of the device serial number, the device's Media Access Control (MAC) address or the device's IP address. After the recipient receives the certificate from the sender, it uses the public key in the "unified key pair" of the certificate authority (also called the CA root certificate) to verify the certificate, and can confirm whether the public key in the certificate comes from the sender.

[0072] The communication network can adopt the open system interconnection (OSI) reference model or the transmission control protocol / Internet protocol (TCP / IP) reference model. The OSI reference model is a seven-layer model, which divides the communication network from low to high into the physical layer, data link layer, network layer, transport layer, session layer, presentation layer and application layer. The TCP / IP reference model is a five-layer model, which divides the communication network from low to high into the physical layer, data link layer, network layer, transport layer and application layer. Among them, the data link layer is also called the MAC layer. At present, the application equipment supports secure data transmission for each layer of the communication network, and usually adopts the symmetric encryption algorithm in the existing cryptographic algorithm system. For example, the secure shell (SSH) protocol is adopted for various application programs at the application layer. The transport layer security (TLS) protocol or the datagram transport layer security (DTLS) protocol is adopted for the transport layer. The Internet Protocol security (IPSec) protocol is adopted for the network layer. For the data link layer, point to point protocol (PPP) or media access control security (MACSec) protocol is used. For the physical layer, data encryption is implemented through optical modules.

[0073] With the development of quantum computing, traditional keys may be cracked by quantum attacks in the future, resulting in the inability to guarantee the security of data encrypted and transmitted using traditional keys. This is a huge threat to confidential information that needs to be stored for a long time (such as identity data, financial data, and medical data). Therefore, the symmetric encryption algorithm used in the above security protocols for data encryption transmission in communication networks needs to support keys that are resistant to quantum attacks. Applying quantum keys to the symmetric encryption algorithms used in the above security protocols can effectively solve this problem. Quantum keys are generated and distributed by quantum devices. If an application device wants to use quantum keys, it needs to request quantum keys from the quantum device.

[0074] In the related art, the IP address and port number of the quantum device are configured on the application device by manual configuration. The application device establishes a connection with the quantum device according to the configuration information, and then obtains the quantum key from the quantum device. In this way, both application devices that need to use quantum keys for data encryption transmission obtain the same quantum key through the configured quantum devices respectively, and establish a secure channel, such as an IPSec channel, based on the quantum key. The process of both application devices obtaining quantum keys from quantum devices can replace the key negotiation process in security protocols such as IPSec, and inject the quantum key into the session as the session key.

[0075] However, in related technologies, the information of quantum terminals on application devices is completely dependent on manual configuration. On the one hand, manual configuration is highly complex and inefficient. For scenarios where a large number of application devices need to obtain quantum keys from quantum devices, it will cause a huge configuration workload, and the correctness and speed of online access cannot be guaranteed, resulting in low reliability. On the other hand, the network is changing rapidly, and equipment going online, network failures, or network attacks may all trigger network changes, and manual configuration solutions cannot respond to network changes in a timely manner.

[0076] Based on this, the present application proposes a technical solution for automatically discovering quantum devices. In the technical solution provided by the present application, after obtaining the IP address and port number of the quantum device, the application device sends the obtained IP address and port number of the quantum device to other application devices, so that other application devices can also discover quantum devices with quantum key distribution capabilities, and then other application devices can request to obtain quantum keys from the corresponding quantum devices according to the obtained IP address and port number of the quantum device. Compared with the related art, the present application automatically spreads the information of quantum devices through application devices, and there is no need to manually configure the quantum device information on each application device, so it can improve the overall efficiency and convenience of application devices in the communication network to obtain quantum keys, which is helpful to realize the wide application of quantum keys in classical networks. In addition, the present application solution can better respond to network changes, thereby improving network reliability. For example, when the number of application devices in the communication network increases, by applying the present application solution, the quantum device information is spread from the old application devices in the communication network to the newly added application devices, so that the newly added application devices can automatically discover quantum devices that can provide quantum keys.

[0077] The following is a detailed introduction to this technical solution from multiple angles, including application scenarios, method flow, system, hardware devices, and software devices.

[0078] The following is an example of an application scenario of the embodiment of the present application.

[0079] For example, Figure 1Schematic diagram of an application scenario provided by an embodiment of the present application. The application scenario mainly involves two types of devices, namely application devices and quantum devices. Among them, the quantum device is located in the quantum key distribution network. The application device is located in the classical network. See Figure 1 The application scenario includes multiple application devices 101A-101C (collectively referred to as application devices 101) located in a classical network and a quantum device 102 located in a quantum key distribution network. Figure 1 The number of application devices is only used as an example and is not intended to limit the application scenarios of the embodiments of the present application.

[0080] Optionally, the application device 101 includes but is not limited to network devices such as routers, switches, or firewalls. Alternatively, the application device 101 is a terminal device such as a computer, a mobile phone, or an Internet of Things (IoT) terminal. Alternatively, the application device 101 is other devices with communication needs such as a server or a cloud platform. The quantum device 102 is a quantum computer capable of generating or storing quantum keys. The quantum device 102 is used to provide quantum services for the application device 101, that is, the quantum device 102 can distribute quantum keys to the application device 101. The quantum device in the embodiment of the present application may also be referred to as a quantum key distribution device.

[0081] Optionally, the quantum device 102 and the application device 101 communicate directly or indirectly. For example, the quantum device 102 and the application device 101 communicate via a quantum key server ( Figure 1 Optionally, the quantum device 102 communicates with the application device 101 via a classical network. For example, the quantum device 102 communicates with the application device 101 based on the Transmission Control Protocol / Internet Protocol (TCP / IP).

[0082] For example, in Figure 1 In the application scenario shown, the application device 101A stores the IP address and port number of the quantum device 102, and the application device 101A can request the quantum device 102 to obtain the quantum key according to the IP address and port number of the quantum device 102. Optionally, the IP address and port number of the quantum device 102 stored in the application device 101A are manually configured or provided by the quantum device 102. For example, see Figure 1, the quantum device 102 provides the address information of the quantum device 102 to the application device 101A. The application device 101A obtains the IP address and port number of the quantum device 102 according to the address information provided by the quantum device 102 and saves it locally. Optionally, the application device 101A is located in the broadcast domain of the quantum device 102. Alternatively, a tunnel is established between the application device 101A and the quantum device 102.

[0083] Please continue to see Figure 1 , application device 101A sends the IP address and port number of quantum device 102 to application device 101B, so that application device 101B can request quantum device 102 to obtain the quantum key according to the IP address and port number of quantum device 102. Optionally, application device 101B further sends the IP address and port number of quantum device 102 to application device 101C, so that application device 101C can request quantum device 102 to obtain the quantum key according to the IP address and port number of quantum device 102. Optionally, application device 101A and application device 101B are located in the same security domain. Application device 101B and application device 101C are located in the same security domain. Optionally, application device 101A and application device 101C are located in different security domains. A security domain is also called a trust domain, and application devices located in the same security domain trust each other. In an embodiment of the present application, multiple application devices located in the same security domain are configured with the same shared key. Alternatively, multiple application devices in the same security domain can obtain certificates or public keys of other application devices in the security domain. Optionally, multiple application devices in the same security domain are pre-configured with certificates or public keys of other application devices in the security domain, or application devices in the same security domain can obtain certificates or public keys of other application devices in the security domain from a public key server.

[0084] The following is an example of the method flow of the embodiment of the present application.

[0085] For example, Figure 2 2 is a schematic diagram of the implementation process of a quantum device discovery method 200 provided in an embodiment of the present application. Figure 2 As shown, method 200 includes but is not limited to the following steps 201 to 203. Optionally, method 200 also includes the following steps 204 to 205. Optionally, the quantum device in method 200 is Figure 1 The quantum device 102 in the method 200 is Figure 1 The application device 101A in the embodiment, the application device 2 is Figure 1 The application device 101B in the embodiment, the application device 3 is Figure 1 Application device 101C in.

[0086] Step 201: Application device 1 obtains the IP address and port number of the quantum device.

[0087] The port number of the quantum device is used by the quantum device to provide the quantum key to the application device. There are many ways for the application device 1 to obtain the IP address and port number of the quantum device. For example, the IP address and port number of the quantum device are pre-configured in the application device 1 by manual configuration, and the application device 1 obtains the IP address and port number of the quantum device from the configuration information. Alternatively, the application device 1 receives a notification message sent by the quantum device, and the notification message includes the address information of the quantum device, and the application device 1 obtains the IP address and port number of the quantum device according to the address information. Among them, the address information of the quantum device is used by the application device to request the quantum key from the quantum device. In other words, the notification message is used to instruct the application device that receives the notification message to request the quantum key from the quantum device based on the address information carried in the notification message. The address information of the quantum device includes the port number of the quantum device, that is, the port number carried in the address information is the port number used by the quantum device to provide the quantum key. Optionally, the address information of the quantum device also includes the IP address of the quantum device. The following describes the implementation method of the application device 1 obtaining the IP address and port number of the quantum device according to the notification message sent by the quantum device.

[0088] In one possible implementation, the application device 1 is located in the broadcast domain of the quantum device. The implementation method for the application device 1 to receive the notification message sent by the quantum device is that the application device 1 receives the notification message broadcast by the quantum device. In this implementation, the address information of the quantum device carried in the notification message includes the IP address and port number of the quantum device. The quantum device publishes a notification message in the broadcast domain, so that the application devices located in the broadcast domain can obtain the IP address and port number of the quantum device, and further can request the quantum device to obtain the quantum key based on the IP address and port number of the quantum device. Optionally, a broadcast domain is a local area network.

[0089] In this implementation, there is no need to configure the information of application device 1 on the quantum device, nor is there any need to configure the quantum device information on application device 1. By publishing a notification message in the broadcast domain by the quantum device, the application devices in the broadcast domain can find the quantum device that can provide the quantum key and the address information that can be used to request the quantum key, thereby realizing the automatic discovery of the quantum device.

[0090] Optionally, the quantum device periodically publishes notification messages in the broadcast domain. In this way, if a new application device accesses the broadcast domain of the quantum device, the application device can automatically discover the quantum device that can provide the quantum key, thereby improving the efficiency and convenience of the application device in obtaining the quantum key. This implementation method can cope with network changes, thereby improving network reliability.

[0091] Another possible implementation is that a tunnel is established between the application device 1 and the quantum device. The implementation method for the application device 1 to receive the notification message sent by the quantum device is that the application device 1 receives the notification message sent by the quantum device through the tunnel. In this implementation, the address information of the quantum device carried in the notification message includes at least the port number of the quantum device. Before the application device 1 receives the notification message sent by the quantum device, the application device 1 needs to establish a tunnel with the quantum device based on the IP address of the quantum device. In other words, before the quantum device sends a notification message to the application device 1, the quantum device needs to establish a tunnel with the application device 1 based on the IP address of the application device 1.

[0092] Optionally, the quantum device is configured with the IP address of the application device 1. The quantum device sends a tunnel establishment request to the application device 1 according to the IP address of the application device 1, and the tunnel establishment request includes the IP address of the quantum device. Then the application device 1 sends a tunnel establishment response corresponding to the tunnel establishment request to the quantum device, thereby completing the tunnel establishment between the quantum device and the application device 1. In this case, the application device 1 can obtain the IP address used by the quantum device to establish the tunnel with the application device 1 during the process of establishing the tunnel with the quantum device.

[0093] Alternatively, the IP address of the quantum device is configured in the application device 1. The application device 1 sends a tunnel establishment request to the quantum device according to the IP address of the quantum device, and the tunnel establishment request includes the IP address of the application device 1. Then the quantum device sends a tunnel establishment response corresponding to the tunnel establishment request to the application device 1, thereby completing the tunnel establishment between the quantum device and the application device 1. In this case, before establishing a tunnel with the quantum device, the application device 1 can obtain the IP address used by the quantum device to establish a tunnel with the application device 1 from the configuration information.

[0094] In this implementation, since the application device 1 can obtain the IP address of the quantum device during or before establishing a tunnel with the quantum device, the notification message sent by the quantum device through the tunnel may only include the port number of the quantum device, but not the IP address of the quantum device. Of course, the embodiment of the present application does not exclude the implementation method in which the notification message sent by the quantum device through the tunnel also includes the IP address of the quantum device. In addition, in this implementation, it is necessary to configure the IP address of the application device 1 in the quantum device so that the quantum device can actively establish a tunnel with the application device 1. Alternatively, it is necessary to configure the IP address of the quantum device in the application device 1 so that the application device 1 can actively establish a tunnel with the quantum device. Compared with the related art, this implementation requires less information to be manually configured in the device, so it can reduce the configuration complexity and improve the configuration efficiency.

[0095] For example, Figure 3 This is a schematic diagram of an implementation scenario provided by an embodiment of the present application. Figure 3 As shown, the implementation scenario includes a quantum device and multiple application devices, and the multiple application devices include application device A and application device B. Among them, the quantum device is located in a quantum key distribution network. Multiple application devices are located in a classical network. Application device A is located in the broadcast domain of the quantum device, and the quantum device publishes a notification message in the broadcast domain, and the notification message includes the IP address and port number of the quantum device, so that application device A obtains the IP address and port number of the quantum device. A tunnel is established between application device B and the quantum device, and the quantum device sends a notification message to application device B through the tunnel, and the notification message includes the port number of the quantum device, so that application device B obtains the port number of the quantum device. Optionally, the physical link for implementing the tunnel passes through application device A and an Internet service provider (ISP) network. Optionally, the tunnel includes but is not limited to a generic routing encapsulation (GRE) tunnel, a virtual extensible local area network (VXLAN) tunnel, or an IPSec tunnel. In Figure 3 In the illustrated implementation scenario, the application device 1 is, for example, application device A or application device B.

[0096] Optionally, the notification message is a Link Layer Discovery Protocol (LLDP) frame, and the address information of the quantum device is carried in the type-length-value (TLV) field of the LLDP frame. After receiving the LLDP frame, the application device 1 parses the data field of the LLDP frame to obtain the address information of the quantum device, and further stores the IP address and port number of the quantum device obtained according to the address information of the quantum device in the management information base (MIB). Afterwards, the application device 1 can obtain the IP address and port number of the quantum device from the MIB. In this implementation mode, both the quantum device and the application device 1 need to support LLDP. Specifically, the quantum device needs to support the LLDP extended TLV capability. The application device 1 needs to support the LLDP extended TLV parsing capability.

[0097] For example, Figure 4 1 is a schematic diagram of the structure of a notification message provided in an embodiment of the present application. The notification message is obtained by extending LLDP. Figure 4As shown, the notification message includes a destination MAC address, a source MAC address, a type field, a data field, and a frame check sequence (FCS). Among them, the destination MAC address is a fixed multicast MAC address 0x0180-C200-000E. The source MAC address is the port MAC address or device MAC address of the quantum device (if there is a port MAC address, the port MAC address is used, otherwise the device MAC address is used). The type field indicates the message type. If the notification message is an LLDP frame, the type field value is 0x88CC. The data field is an LLDP data unit (LLDPDU), which consists of multiple TLVs, including but not limited to a chassis ID TLV, a port ID TLV, a time to live (TTL) TLV, and an end of LLDPDU TLV. The explanation of these TLVs can refer to the relevant content defined in LLDP, and the embodiments of the present application will not be repeated here. The address information of the quantum device is encoded in TLV and carried in the data field. For example, a QKD TLV is extended in the data field, see Figure 4 , the QKD TLV includes a QKD type field, a QKD length field, and a QKD value field, wherein the QKD type field is used to indicate that the QKD value field carries the address information of the quantum device. The QKD length field is used to indicate the length of the QKD value field. The QKD value field is used to carry the address information of the quantum device. Optionally, the value range of the QKD type field is 9 to 126, for example, the value of the QKD type field is defined as 33. In one possible implementation, the QKD value field includes the IP address and port number of the quantum device. Optionally, the IP address of the quantum device is an Internet Protocol version 4 (IPv4) address with a length of 4 bytes or an Internet Protocol version 6 (IPv6) address with a length of 16 bytes. For example, it is defined that the IP address of the quantum device occupies 0 to 15 bytes of the QKD value field of the QKD TLV, and the port number occupies 16 to 17 bytes of the QKD value field. If the quantum device uses an IPv4 address, the IPv4 address is set in bytes 0 to 3 of the QKD value field, and the following 12 bytes (bytes 4 to 15) are filled with 0.

[0098] Optionally, in addition to being obtained by extending LLDP, the notification message may also be a message in other formats or a message in a custom format. The embodiment of the present application does not limit the message format of the notification message.

[0099] In the embodiment of the present application, the quantum device actively notifies the application device of its address information, so that the application device can automatically discover the quantum device with quantum key distribution capability. Compared with the related technology, the present application does not need to manually configure the quantum device information on the application device, thereby improving the efficiency and convenience of the application device in obtaining the quantum key, and helping to realize the widespread application of quantum keys in classical networks.

[0100] Optionally, if the old IP address and the old port number of the quantum device are stored in the application device 1, after obtaining the new IP address and the new port number provided by the quantum device, the application device 1 updates the stored old IP address and the old port number to the new IP address and the new port number. In this way, when the quantum device changes, such as when the old quantum device goes offline, the application device can obtain the new IP address and the new port number of the changed quantum device in time, thereby improving the reliability of the application device in obtaining the quantum key in the network change scenario.

[0101] Step 202: Application device 1 sends quantum device discovery message 1 to application device 2. Quantum device discovery message 1 includes the IP address and port number of the quantum device.

[0102] Optionally, the quantum device discovery message 1 is a BGP update message, and the IP address and port number of the quantum device are in a path attribute field of the BGP update message.

[0103] For example, Figure 5 and Figure 6 They are schematic diagrams of the structure of a quantum device discovery message provided by an embodiment of the present application. The quantum device discovery message is obtained by extending the BGP update message. Figure 5 and Figure 6 As shown in the figure, the quantum device discovery message includes an Ethernet header, an IP header, a TCP header, a BGP data packet, and an FCS. Among them, the BGP data packet includes a BGP header and a BGP message field. The BGP header includes a maker field, a length field, and a type field (not shown in the figure). Figure 5 FIG. 4 shows the format of the BGP message field for publishing routes defined in the request for comments (RFC) document numbered 4271 (abbreviated as RFC 4271). Figure 5As shown, the BGP message fields include a withdrawn routes length field, a withdrawn routes field, a total path attribute length field, a path attribute field, and network layer reachability information (NLRI). Figure 6 The format of the BGP message fields used to publish routes as defined in RFC 4760 is shown. Figure 6 As shown, the BGP message field includes an address family identifier field, a subsequent address family identifier field, a next hop network address length field, a next hop network address field, a reserved field, an NLRI, and a path attribute field. Among them, the address family identifier, the subsequent address family identifier, the next hop network address length, the next hop network address, the reserved field, and the NLRI are collectively referred to as the multi-protocol reachable NLRI (MP_REACH_NLRI) attribute. The IP address and port number of the quantum device are encoded using TLV and carried in the path attribute field of the BGP message field. For example, see Figure 5 or Figure 6 , the path attribute field includes an extended attribute type field, an attribute length field, and an attribute value field. Among them, the attribute type field includes an attribute flag and an attribute type code, the attribute flag is an extended flag, and the attribute type code is used to indicate that the attribute value field carries the IP address and port number of the quantum device, for example, the attribute type code value is 13. The attribute length field is used to indicate the length of the attribute value field. The attribute value field is used to carry the IP address and port number of the quantum device. Optionally, the IP address of the quantum device is an IPv4 address with a length of 4 bytes or an IPv6 address with a length of 16 bytes. For example, the length of the attribute value field is defined as 18 bytes, the IP address of the quantum device occupies 0 to 15 bytes of the attribute value field, and the port number of the quantum device occupies 16 to 17 bytes of the attribute value field. If the quantum device uses an IPv4 address, the IPv4 address is set to 0 to 3 bytes of the attribute value field, and the subsequent 12 bytes (4 to 15 bytes) are filled with 0.

[0104] Optionally, in addition to being obtained through an extended BGP update message, the quantum device discovery message can also be a message in other formats or a message in a custom format. The embodiment of the present application does not limit the message format of the quantum device discovery message.

[0105] For example, please continue to see Figure 3 , Figure 3 The multiple application devices in the illustrated implementation scenario also include application device C. After application device A obtains the IP address and port number of the quantum device, it sends the IP address and port number of the quantum device to application device C, so that application device C automatically discovers the quantum device that can provide the quantum key. Figure 3 In the illustrated implementation scenario, the application device 1 is, for example, application device A, and the application device 2 is, for example, application device C.

[0106] Step 203: The application device 2 parses the quantum device discovery message 1 to obtain the IP address and port number included in the quantum device discovery message 1, and stores the obtained IP address and port number.

[0107] Optionally, after receiving the quantum device discovery message 1 sent by the application device 1, the application device 2 parses the quantum device discovery message 1 to obtain the IP address and port number of the quantum device, and then stores the IP address and port number of the quantum device in the MIB. Afterwards, the application device 2 can obtain the IP address and port number of the quantum device used to provide the quantum key from the MIB.

[0108] Optionally, if the old IP address and the old port number of the quantum device are stored in the application device 2, after obtaining the new IP address and the new port number provided by the quantum device, the application device 2 updates the stored old IP address and the old port number to the new IP address and the new port number. In this way, when the quantum device changes, such as when the old quantum device goes offline, the application device can obtain the new IP address and the new port number of the changed quantum device in time, thereby improving the reliability of the application device in obtaining the quantum key in the network change scenario.

[0109] In the embodiment of the present application, after obtaining the IP address and port number of the quantum device, the application device sends the obtained IP address and port number of the quantum device to other application devices, so that other application devices can also find quantum devices with quantum key distribution capabilities, and then other application devices can request the corresponding quantum device to obtain the quantum key according to the obtained IP address and port number of the quantum device. By automatically spreading the information of the quantum device through the application device, the overall efficiency and convenience of the application devices in the communication network to obtain the quantum key can be improved, which is conducive to the wide application of quantum keys in classical networks.

[0110] Optionally, after the application device 2 obtains the IP address and port number of the quantum device, it continues to automatically spread the IP address and port number of the quantum device to other application devices. For example, after the application device 2 receives the quantum device discovery message 1 and parses the IP address and port number of the quantum device from the quantum device discovery message 1, it continues to perform the following step 204.

[0111] Step 204: Application device 2 sends quantum device discovery message 2 to application device 3. Quantum device discovery message 2 includes the IP address and port number of the quantum device.

[0112] The implementation method of this step 204 can refer to the implementation method of the above-mentioned step 202, and the embodiment of the present application will not be repeated here.

[0113] For example, please continue to see Figure 3 , Figure 3 The multiple application devices in the illustrated implementation scenario also include application device D. After application device C obtains the IP address and port number of the quantum device, it continues to send the IP address and port number of the quantum device to application device D, so that application device D automatically discovers the quantum device that can provide the quantum key. Figure 3 In the illustrated implementation scenario, the application device 1 is, for example, application device A, the application device 2 is, for example, application device C, and the application device 3 is, for example, application device D.

[0114] Step 205: The application device 3 parses the quantum device discovery message 2 to obtain the IP address and port number included in the quantum device discovery message 2, and stores the obtained IP address and port number.

[0115] Optionally, after receiving the quantum device discovery message 2 sent by the application device 2, the application device 3 parses the quantum device discovery message 2 to obtain the IP address and port number of the quantum device, and then stores the IP address and port number of the quantum device in the MIB. Afterwards, the application device 3 can obtain the IP address and port number of the quantum device used to provide the quantum key from the MIB.

[0116] Optionally, if the old IP address and the old port number of the quantum device are stored in the application device 3, after obtaining the new IP address and the new port number provided by the quantum device, the application device 3 updates the stored old IP address and the old port number to the new IP address and the new port number. In this way, when the quantum device changes, such as when the old quantum device goes offline, the application device can obtain the new IP address and the new port number of the changed quantum device in time, thereby improving the reliability of the application device in obtaining the quantum key in the network change scenario.

[0117] In the embodiment of the present application, after an application device receives quantum device information sent by another application device, it can realize automatic discovery of quantum devices by multiple application devices by further spreading the quantum device information.

[0118] Optionally, before the application device diffuses the quantum device information to other application devices, it first conducts capability negotiation with the other party to determine whether the other party has the ability to parse the quantum device information from the quantum device discovery message. After the application device determines that the other party has the ability to parse the quantum device information from the quantum device discovery message, it diffuses the quantum device information to the other party. The quantum device information includes the IP address and port number of the quantum device. For example, before the above step 202 is executed, the following steps S11 to S12 are executed.

[0119] In step S11 , application device 1 sends a capability negotiation request message to application device 2 , where the capability negotiation request message is used to determine whether application device 2 has the capability to parse quantum device information from quantum device discovery message 1 .

[0120] Optionally, the capability negotiation request message is a BGP open message. For example, after the application device 1 establishes a TCP connection with the application device 2, the application device 1 sends a BGP open message to the application device 2. The BGP open message carries the target address family information. The target address family information is used by the application device 2 to determine whether it has the ability to parse the quantum device information from the quantum device discovery message 1.

[0121] BGP uses address families (AF) to distinguish different network layer protocols. BGP address families are used to indicate supported services. Currently common BGP address families include BGP-IPv4 unicast address family, BGP-IPv4 multicast address family, BGP-IPv6 unicast address family, and BGP-VPNv6 address family. The target address family information is the address family information of a new BGP address family extended by the embodiment of the present application. The new BGP address family is named, for example, the QKD address family, indicating support for negotiating quantum device information. The embodiment of the present application carries the QKD address family information in the BGP open message, which can be used for negotiation between application devices as to whether they have the ability to diffuse quantum device information. For the sender, by carrying the QKD address family information in the BGP open message, it indicates that it has the ability to diffuse quantum device information, that is, it can send a quantum device discovery message carrying the IP address and port number of the quantum device. For the receiver, after receiving the BGP open message carrying the QKD address family information, it determines whether it supports the QKD address family function according to its own BGP configuration. If its own BGP configuration supports the QKD address family function, it means that it has the ability to parse quantum device information from the quantum device discovery message. Optionally, the embodiment of the present application extends new BGP address families for different versions of IP addresses. For example, the BGP-IPv4-QKD address family is extended for IPv4 addresses to negotiate quantum device information using IPv4 addresses. The address family identifier (AFI) of the BGP-IPv4-QKD address family is defined as 00800001, for example. For another example, the BGP-IPv6-QKD address family is extended for IPv6 addresses to negotiate quantum device information using IPv6 addresses. The AFI of the BGP-IPv6-QKD address family is defined as 00810001, for example.

[0122] Optionally, the target address family information is carried in the optional parameter field of the BGP open message. The optional parameter field includes an address family information field, where the address family information field consists of a 2-byte AFI and a 1-byte subsequent address family identifier (SAFI). If the IP address of the quantum device is an IPv4 address, the AFI in the address information field is set to the AFI value of the defined BGP-IPv4-QKD address family, such as 00800001. If the IP address of the quantum device is an IPv6 address, the AFI in the address information field is set to the AFI value of the defined BGP-IPv6-QKD address family, such as 00810001.

[0123] Optionally, the capability negotiation request message includes authentication credentials, which are used by application device 2 to perform security authentication on application device 1. Application device 2 performs security authentication on application device 1, which can be understood as application device 2 determining whether it is located in the same security domain as application device 1.

[0124] The embodiment of the present application pre-configures a security domain so that quantum device information is diffused within the security domain, thereby improving the transmission security and reliability of quantum device information. In this case, the application device 1 and the application device 2 are located in the same security domain, and the application device 2 and the application device 3 are located in the same security domain. Optionally, the application device 1 and the application device 3 are located in different security domains.

[0125] In one possible implementation, multiple application devices in the same security domain are configured with the same shared key. Optionally, the authentication credential is a preconfigured shared key. In this implementation, application device 2 performs security authentication on application device 1 by determining whether it is configured with the shared key carried in the capability negotiation request message. If application device 2 is configured with the shared key carried in the capability negotiation request message, application device 2 determines that application device 1 has passed the security authentication, that is, application device 2 determines that it is in the same security domain as application device 1.

[0126] In another possible implementation, multiple application devices in the same security domain can obtain the certificates or public keys of other application devices in the security domain. Optionally, the authentication credentials include a random number generated by application device 1 and a signature of the random number by application device 1 using the private key of application device 1. In this implementation, application device 2 performs security authentication on application device 1 by verifying the signature carried in the capability negotiation request message. If application device 2 passes the verification of the signature carried in the capability negotiation request message, application device 2 determines that application device 1 passes the security authentication, that is, application device 2 determines that it is in the same security domain as application device 1.

[0127] Optionally, when the capability negotiation request message is a BGP open message, the authentication credentials are carried in an optional parameter field of the BGP open message. Figure 7 1 is a schematic diagram of a structure of a capability negotiation request message provided in an embodiment of the present application. The capability negotiation request message is obtained by extending a BGP open message. Figure 7As shown, the capability negotiation request message includes a version field, a my autonomous system field, a holdtime field, a BGP identifier field, an optional parameter length field, and an optional parameter field. Among them, the optional parameter field includes an address family information field and a security authentication information field. The address family information field is used to carry target address family information. The security authentication information field is used to carry authentication credentials. The explanation of other fields can refer to the relevant definition of the BGP open message, and the embodiments of the present application will not be repeated here.

[0128] Optionally, in addition to being obtained by extending the BGP open message, the capability negotiation request message may also be a message in other formats or a message in a custom format. The embodiment of the present application does not limit the message format of the capability negotiation request message.

[0129] In step S12, application device 2 sends a capability negotiation response message corresponding to the capability negotiation request message to application device 1, and the capability negotiation response message indicates that application device 2 has the ability to parse quantum device information from quantum device discovery message 1.

[0130] Optionally, if application device 2 does not have the ability to parse quantum device information from quantum device discovery message 1, application device 2 does not send a capability negotiation response message to application device 1, or application device 2 sends a capability negotiation failure message to application device 1, and the capability negotiation failure message indicates that application device 2 does not have the ability to parse quantum device information from quantum device discovery message 1. Accordingly, for application device 1, when application device 1 does not receive a capability negotiation response message within a certain period of time after sending a capability negotiation request message to application device 2, or receives a capability negotiation failure message sent by application device 2, application device 1 determines that application device 2 does not have the ability to parse quantum device information from quantum device discovery message 1.

[0131] Optionally, the capability negotiation request message is a BGP open message. After receiving the BGP open message sent by the application device 1, the application device 2 determines that the application device 2 has the ability to parse the quantum device information from the quantum device discovery message according to the target address family information carried in the BGP open message, and then the application device 2 sends the capability negotiation response message to the application device 1.

[0132] Optionally, the capability negotiation response message is a BGP keepalive message. Alternatively, the capability negotiation response message may also be a message in other formats or a message in a custom format. The embodiment of the present application does not limit the message format of the capability negotiation response message.

[0133] Optionally, the capability negotiation request message includes authentication credentials. Before sending the capability negotiation response message to the application device 1, the application device 2 performs security authentication on the application device 1 according to the authentication credentials. After the application device 2 determines that the application device 1 has passed the security authentication, it sends the capability negotiation response message to the application device 1. This implementation method enables the application device to only receive and parse the quantum device information provided by the application device in the same security domain, thereby improving the source reliability of the quantum device information obtained by the application device.

[0134] Optionally, if application device 2 determines that application device 1 has not passed security authentication, application device 2 does not send a capability negotiation response message to application device 1, or application device 2 sends a capability negotiation failure message to application device 1, and the capability negotiation failure message indicates that application device 2 refuses to receive the quantum device discovery message sent by application device 1. Accordingly, for application device 1, when application device 1 does not receive a capability negotiation response message within a certain period of time after sending a capability negotiation request message to application device 2, or receives a capability negotiation failure message sent by application device 2, application device 1 will no longer send a quantum device discovery message to application device 2 subsequently.

[0135] In a possible implementation, the authentication credential is a preconfigured shared key. The implementation of the application device 2 performing security authentication on the application device 1 according to the authentication credential includes: the application device 2 determines whether the shared key is configured in the application device 2. If the shared key is configured in the application device 2, the application device 2 determines that the application device 1 passes the security authentication.

[0136] In another possible implementation, the authentication credentials include a random number generated by application device 1 and a signature of the random number by application device 1 using the private key of application device 1. The implementation of application device 2 performing security authentication on application device 1 according to the authentication credentials includes: application device 2 verifies the signature using the public key of application device 1. If application device 2 verifies the signature successfully, application device 2 determines that application device 1 passes the security authentication. Among them, the public key of application device 1 used by application device 2 to verify the signature and the private key of application device 1 used by application device 1 to sign are a set of public-private key pairs.

[0137] Optionally, before executing the above step 204, the following steps S21 to S22 are executed.

[0138] In step S21, application device 2 sends a capability negotiation request message to application device 3, where the capability negotiation request message is used to determine whether application device 3 has the ability to parse quantum device information from quantum device discovery message 2.

[0139] In step S22, application device 3 sends a capability negotiation response message corresponding to the capability negotiation request message to application device 2, and the capability negotiation response message indicates that application device 3 has the ability to parse quantum device information from quantum device discovery message 2.

[0140] The implementation of the above steps S21 to S22 may refer to the implementation of the above steps S11 to S12, and the embodiments of the present application will not be repeated here.

[0141] This application uses the following examples to illustrate the implementation process of the quantum device discovery method. For example, Figure 8 FIG. 8 is a schematic diagram of an implementation flow of a quantum device discovery method 800 provided in an embodiment of the present application. Figure 8 As shown, method 800 includes the following steps 801 to 807. Steps 801 to 803 show the process of application device 1 obtaining the IP address and port number of the quantum device. Steps 804 to 805 show the process of application device 1 negotiating capabilities with application device 2. Steps 806 to 807 show the process of application device 1 spreading quantum device information to application device 2.

[0142] Step 801: A quantum device generates a notification message, where the notification message includes address information of the quantum device.

[0143] Step 802: The quantum device sends the notification message to application device 1.

[0144] Step 803: Application device 1 obtains the IP address and port number of the quantum device according to the address information of the quantum device.

[0145] The specific implementation of the above steps 801 to 803 can refer to the relevant implementation of the above step 201, and the embodiment of the present application will not be repeated here.

[0146] Step 804: Application device 1 sends a capability negotiation request message to application device 2, where the capability negotiation request message is used to determine whether application device 2 has the capability to parse quantum device information from the quantum device discovery message.

[0147] The specific implementation method of this step 804 can refer to the implementation method of the above-mentioned step S11, and the embodiment of the present application will not be repeated here.

[0148] Step 805: Application device 2 sends a capability negotiation response message corresponding to the capability negotiation request message to application device 1, and the capability negotiation response message indicates that application device 2 has the ability to parse quantum device information from the quantum device discovery message.

[0149] The specific implementation method of this step 805 can refer to the implementation method of the above-mentioned step S12, and the embodiment of the present application will not be repeated here.

[0150] Step 806: Application device 1 sends a quantum device discovery message to application device 2, where the quantum device discovery message includes the IP address and port number of the quantum device.

[0151] The specific implementation method of this step 806 can refer to the implementation method of the above-mentioned step 202, and the embodiment of the present application will not be repeated here.

[0152] Step 807: Application device 2 parses the quantum device discovery message to obtain the IP address and port number included in the quantum device discovery message, and stores the obtained IP address and port number.

[0153] The specific implementation method of this step 807 can refer to the implementation method of the above-mentioned step 203, and the embodiment of the present application will not be repeated here.

[0154] Optionally, if there are other application devices in the security domain where application device 2 is located, such as the above-mentioned application device 3, application device 2 can continue to spread quantum device information to other application devices in the security domain, such as continuing to execute the above-mentioned steps S21 to S22 and the above-mentioned steps 204 to 205, which will not be repeated here one by one.

[0155] Optionally, after obtaining the IP address and port number of the quantum device, the application device stores the IP address and port number of the quantum device locally. When the application device needs to obtain a quantum key, the application device sends a key acquisition request to the quantum device based on the IP address and port number of the quantum device. For example, the application device establishes a TCP connection with the quantum device based on the IP address and port number of the quantum device, and then the application device sends a key acquisition request to the quantum device through the TCP connection. Then, the application device receives a key acquisition response corresponding to the key acquisition request sent by the quantum device, and the key acquisition response includes the quantum key assigned to the application device by the quantum device.

[0156] Optionally, in order to improve the transmission security and reliability of the quantum key, in the process of the application device requesting the quantum device to obtain the quantum key, the quantum device and the application device perform identity authentication on each other. In one implementation, the key acquisition request sent by the application device to the quantum device includes the device identification of the application device, the target public key and the first message authentication code value. If the quantum device verifies the first message authentication code value, the quantum device sends a key acquisition response to the application device, and the key acquisition response includes the ciphertext and the second message authentication code value. If the application device verifies the second message authentication code value, the application device uses the target private key to decrypt the ciphertext to obtain the quantum key information assigned to the application device by the quantum device. The quantum key information includes the quantum key.

[0157] Among them, the target public key and the target private key come from the public-private key pair obtained by the application device running the post-quantum key generation algorithm. The ciphertext is obtained by the quantum device using the target public key to encrypt the quantum key information assigned to the application device. Since the target public key used by the quantum device to encrypt the quantum key information is obtained by the application device running the post-quantum key generation algorithm, the quantum device will use the post-quantum encryption algorithm to encrypt the quantum key and transmit the quantum key to the application device in the form of ciphertext, ensuring the confidentiality of the transmission of the quantum key. In addition, since the transmitted ciphertext is encrypted using the post-quantum encryption algorithm, it can resist quantum attacks and prevent the ciphertext from being cracked by a quantum computer and causing the leakage of the quantum key.

[0158] The first message authentication code value is calculated by the application device based on the shared key corresponding to the quantum device and the device identifier for the first authentication information, and the first authentication information includes the target public key. After the quantum device receives the key acquisition request from the application device, it obtains the first authentication information and the storage information corresponding to the device identifier in the key acquisition request based on the key acquisition request, and the storage information includes the shared key corresponding to the quantum device and the device identifier. Then the quantum device verifies the first message authentication code value based on the acquired shared key and the first authentication information. If the quantum device verifies the first message authentication code value, it means that the key acquisition request comes from the other party holding the shared key, and the content carried by the key acquisition request in the first authentication information (including the target public key) has not been tampered with during the transmission process. Therefore, the first message authentication code value can be used by the quantum device to authenticate the application device (i.e., verify the source reliability of the key acquisition request), and can also be used by the quantum device to verify the message integrity of the key acquisition request.

[0159] The second message authentication code value is calculated by the quantum device based on the shared key corresponding to the quantum device and the device identifier for the second authentication information, and the second authentication information includes the ciphertext. After the application device receives the key acquisition response from the quantum device, it obtains the second authentication information based on the key acquisition response. Then the application device verifies the second message authentication code value based on the shared key corresponding to the quantum device and the device identifier and the second authentication information. If the application device verifies the second message authentication code value, it means that the key acquisition response comes from the other party holding the shared key, and the content (including ciphertext) carried by the key acquisition response in the second authentication information has not been tampered with during the transmission process. Therefore, the second message authentication code value can be used by the application device to authenticate the quantum device (i.e., verify the source reliability of the key acquisition response), and can also be used by the application device to verify the message integrity of the key acquisition response.

[0160] Therefore, by transmitting quantum keys in the above implementation method, two-way identity authentication can be performed between the application device and the quantum device, and the message integrity of the messages received by each can be verified respectively, while also ensuring the confidentiality of quantum key transmission. This achieves the security and reliability of quantum key transmission.

[0161] Alternatively, the key acquisition request sent by the application device to the quantum device carries the public key of the public-private key pair generated by the application device. After the quantum device uses the public key to encrypt the quantum key assigned to the application device, it carries the encrypted quantum key in the key acquisition response and sends it to the application device. Afterwards, the application device uses the private key generated in the public-private key pair to decrypt the encrypted quantum key to obtain the quantum key. The embodiment of the present application does not limit the manner in which the quantum device provides the quantum key to the application device. Any solution that can ensure the secure transmission of the quantum key between the quantum device and the application device can be applied to the embodiment of the present application.

[0162] Optionally, after the application device obtains the quantum key, it applies the quantum key to data encryption transmission at any layer in the communication network, including the physical layer, data link layer, network layer, transport layer or application layer.

[0163] In the quantum device discovery method provided in the embodiment of the present application, after obtaining the IP address and port number of the quantum device, the application device sends the obtained IP address and port number of the quantum device to other application devices, so that other application devices can also discover quantum devices with quantum key distribution capabilities, and then other application devices can request the corresponding quantum device to obtain quantum keys according to the obtained IP address and port number of the quantum device. Compared with the related art, the present application automatically spreads quantum device information through application devices, and there is no need to manually configure quantum device information on each application device. Therefore, it can improve the overall efficiency and convenience of application devices in the communication network to obtain quantum keys, which is conducive to the wide application of quantum keys in classical networks.

[0164] The sequence of steps in the quantum device discovery method provided in the embodiments of the present application can be adjusted appropriately, and the steps can be increased or decreased accordingly. Any method that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application.

[0165] For example, Fig. 9 900 is a schematic diagram of an implementation flow of a quantum device discovery method 900 provided in an embodiment of the present application. The application scenario of the method 900 includes at least a first application device and a second application device. For example, the application scenario is Figure 1 In the application scenario shown, the first application device is, for example, application device 101A, and the second application device is, for example, application device 101B; or, the first application device is, for example, application device 101B, and the second application device is, for example, application device 101C. Alternatively, the application scenario is Figure 3 In the implementation scenario shown, the first application device is, for example, application device A, and the second application device is, for example, application device C; or, the first application device is, for example, application device C, and the second application device is, for example, application device D. The method 900 is specifically used to implement Figure 2 The method 200 shown in the corresponding embodiment. Fig. 9 As shown, the method 900 includes but is not limited to the following steps 901 to 902.

[0166] Step 901: A first application device obtains an IP address and a port number of a quantum device, where the port number is used by the quantum device to provide a quantum key to an application device.

[0167] Step 902: The first application device sends a first quantum device discovery message to the second application device, where the first quantum device discovery message includes an IP address and a port number of the quantum device.

[0168] When the method is specifically used to implement the above method 200, the first application device is, for example, application device 1, the second application device is, for example, application device 2, the first quantum device discovery message is, for example, quantum device discovery message 1, and the specific implementation process of steps 901 to 902 can refer to steps 201 to 202 in method 200. Alternatively, the first application device is, for example, application device 2, the second application device is, for example, application device 3, the first quantum device discovery message is, for example, quantum device discovery message 2, and the specific implementation process of steps 901 to 902 can refer to steps 202 and 204 in method 200.

[0169] Optionally, the first quantum device discovery message is a BGP update message, and the IP address and port number of the quantum device are in a path attribute field of the BGP update message.

[0170] Optionally, before the first application device sends the first quantum device discovery message to the second application device, the first application device sends a capability negotiation request message to the second application device, and the capability negotiation request message is used to determine whether the second application device has the ability to parse quantum device information from the first quantum device discovery message. The quantum device information includes the IP address and port number of the quantum device. The first application device receives a capability negotiation response message corresponding to the capability negotiation request message sent by the second application device, and the capability negotiation response message indicates that the second application device has the ability to parse quantum device information from the first quantum device discovery message. When the method is specifically used to implement the above method 200, the first application device is, for example, application device 1, and the second application device is, for example, application device 2. The implementation process can refer to the above steps S11 to S12. Alternatively, the first application device is, for example, application device 2, and the second application device is, for example, application device 3. The implementation process can refer to the above steps S21 to S22.

[0171] Optionally, the capability negotiation request message is a BGP open message, and the BGP open message carries target address family information, and the target address family information is used by the second application device to determine whether it has the ability to parse quantum device information from the first quantum device discovery message.

[0172] Optionally, the capability negotiation response message is a BGP keep-alive message.

[0173] Optionally, the capability negotiation request message includes authentication credentials, and the authentication credentials are used by the second application device to perform security authentication on the first application device.

[0174] Optionally, the authentication credential is a preconfigured shared key. Alternatively, the authentication credential includes a random number generated by the first application device and a signature of the random number by the first application device using a private key of the first application device.

[0175] Optionally, an implementation manner in which the first application device obtains the IP address and port number of the quantum device includes: the first application device receives a notification message sent by the quantum device, the notification message includes address information of the quantum device, and the address information is used by the application device to request a quantum key from the quantum device. The first application device obtains the IP address and port number according to the address information. When the method is specifically used to implement the above method 200, the first application device is, for example, application device 1, and the second application device is, for example, application device 2. The implementation process can refer to the above step 201.

[0176] Optionally, another implementation manner in which the first application device obtains the IP address and port number of the quantum device includes: the first application device receives a second quantum device discovery message sent by the third application device, the second quantum device discovery message including the IP address and port number. When the method is specifically used to implement the above method 200, the first application device is, for example, application device 2, and the second application device is, for example, application device 3. The implementation process may refer to the above step 202.

[0177] For example, Fig.10 1 is a schematic diagram of an implementation flow of a quantum device discovery method 1000 provided in an embodiment of the present application. The application scenario of the method 1000 includes at least a first application device and a second application device. For example, the application scenario is Figure 1 In the application scenario shown, the second application device is, for example, application device 101B, and the first application device is, for example, application device 101A; or, the second application device is, for example, application device 101C, and the first application device is, for example, application device 101B. Alternatively, the application scenario is Figure 3 In the implementation scenario shown, the second application device is, for example, application device C, and the first application device is, for example, application device A; or, the second application device is, for example, application device D, and the first application device is, for example, application device A. The method 1000 is specifically used to implement Figure 2 The method 200 shown in the corresponding embodiment. Fig.10 As shown, the method 1000 includes but is not limited to the following steps 1001 to 1003.

[0178] Step 1001: The second application device receives a quantum device discovery message sent by the first application device. The quantum device discovery message includes an IP address and a port number of the quantum device. The port number is used by the quantum device to provide a quantum key to the application device.

[0179] Step 1002: The second application device parses the quantum device discovery message to obtain the IP address and port number included in the quantum device discovery message.

[0180] Step 1003: The second application device stores the obtained IP address and port number.

[0181] When the method is specifically used to implement the above method 200, the second application device is, for example, application device 2, the first application device is, for example, application device 1, and the quantum device discovery message is, for example, quantum device discovery message 1. The specific implementation process of steps 1001 to 1003 can refer to steps 202 to 203 in method 200. Alternatively, the second application device is, for example, application device 3, the first application device is, for example, application device 2, and the quantum device discovery message is, for example, quantum device discovery message 2. The specific implementation process of steps 1001 to 1003 can refer to steps 204 to 205 in method 200.

[0182] Optionally, the quantum device discovery message is a BGP update message, and the IP address and port number of the quantum device are in a path attribute field of the BGP update message.

[0183] Optionally, before the second application device receives the quantum device discovery message sent by the first application device, the second application device receives a capability negotiation request message sent by the first application device, and the capability negotiation request message is used to determine whether the second application device has the ability to parse quantum device information from the quantum device discovery message. The quantum device information includes the IP address and port number of the quantum device. The second application device sends a capability negotiation response message corresponding to the capability negotiation request message to the first application device, and the capability negotiation response message indicates that the second application device has the ability to parse quantum device information from the quantum device discovery message. When the method is specifically used to implement the above method 200, the second application device is, for example, application device 2, and the first application device is, for example, application device 1. The implementation process can refer to the above steps S11 to S12. Alternatively, the second application device is, for example, application device 3, and the first application device is, for example, application device 2. The implementation process can refer to the above steps S21 to S22.

[0184] Optionally, the capability negotiation request message is a BGP open message, and the BGP open message carries target address family information. The second application device determines, based on the target address family information, that the second application device has the capability to parse quantum device information from the quantum device discovery message.

[0185] Optionally, the capability negotiation response message is a BGP keep-alive message.

[0186] Optionally, the capability negotiation request message includes authentication credentials, and the second application device performs security authentication on the first application device according to the authentication credentials.

[0187] Optionally, the authentication credential is a preconfigured shared key, and the second application device performs security authentication on the first application device according to the authentication credential, including: the second application device determines whether the shared key is configured in the second application device. If the shared key is configured in the second application device, the second application device determines that the first application device passes the security authentication.

[0188] Optionally, the authentication credentials include a random number generated by the first application device and a signature of the random number by the first application device using the private key of the first application device. The implementation method of the second application device performing security authentication on the first application device according to the authentication credentials includes: the second application device verifies the signature using the public key of the first application device. If the second application device verifies the signature successfully, the second application device determines that the first application device has passed the security authentication.

[0189] The following is an example of the system in the embodiment of the present application.

[0190] The embodiment of the present application provides a quantum device discovery system, including: a first application device and a second application device. The first application device is used to send a quantum device discovery message to the second application device after obtaining the IP address and port number of the quantum device, and the quantum device discovery message includes the IP address and port number of the quantum device, and the port number is used for the quantum device to provide a quantum key to the application device. The second application device is used to receive the quantum device discovery message, parse the quantum device discovery message to obtain the IP address and port number included in the quantum device discovery message, and store the obtained IP address and port number. Please refer to the implementation process of the previous method 200 for the detailed working process of the first application device and the second application device. For example, the first application device is application device 1 in method 200, and the second application device is application device 2 in method 200. The first application device is used to execute steps 201 to 202 in the above method 200, and the second application device is used to execute step 203 in the above method 200. Alternatively, the first application device is application device 2 in method 200, the second application device is application device 3 in method 200, the first application device is used to execute step 204 in the above method 200, and the second application device is used to execute step 205 in the above method 200.

[0191] Optionally, the system further includes a quantum device. The quantum device is used to send a notification message to the first application device, the notification message including address information of the quantum device, the address information is used by the application device to request a quantum key from the quantum device. The first application device is used to obtain an IP address and a port number of the quantum device according to the address information.

[0192] Optionally, the first application device and the quantum device are located in the same broadcast domain. Alternatively, a tunnel is established between the first application device and the quantum device.

[0193] Optionally, the second application device is used to send a key acquisition request to the quantum device according to the IP address and port number of the quantum device. The quantum device is used to send a key acquisition response corresponding to the key acquisition request to the second application device, and the key acquisition response includes the quantum key assigned by the quantum device to the second application device.

[0194] Optionally, the first application device is used to send a key acquisition request to the quantum device according to the IP address and port number of the quantum device. The quantum device is used to send a key acquisition response corresponding to the key acquisition request to the first application device, and the key acquisition response includes the quantum key assigned by the quantum device to the first application device.

[0195] For example, Fig.11 Schematic diagram of a communication system provided by an embodiment of the present application. Fig.11 As shown, the system includes quantum devices A1 and A2 located in a quantum key distribution network, and application devices B1, B2 and B3 located in a classical network. Application device B1 is located in the broadcast domain of quantum device A1 or has a tunnel established with quantum device A1. Application device B2 is located in the broadcast domain of quantum device A2 or has a tunnel established with quantum device A2. Application device B3 and application device B1 are located in the same security domain. The way in which application device B1 discovers quantum device A1 and the way in which application device B2 discovers quantum device A2 can refer to step 201 in the above method 200, and the way in which application device B1 diffuses the address information of quantum device A1 to application device B3 (sends a quantum device discovery message) can refer to step 202 or step 204 in the above method 200. Quantum device A1 communicates with quantum device A2 through a quantum network. Application device B2 communicates with application device B3 through a classical network. Optionally, application device B1 communicates with quantum device A1 through a classical network. Application device B2 communicates with quantum device A2 via a classical network.

[0196] Optionally, the application device B3 is the communication initiator, and the application device B2 is the communication receiver. If the application device B3 and the application device B2 need to use quantum keys for data encryption transmission, the same quantum keys can be obtained through the following implementation method.

[0197] Application device B3 sends a first key acquisition request to quantum device A1. Quantum device A1 sends a first key acquisition response corresponding to the first key acquisition request to application device B3, and the first key acquisition response includes the quantum key assigned to application device B3 by quantum device A1 and the key identifier of the quantum key. Quantum device A1 sends the assigned quantum key and the key identifier of the quantum key to quantum device A2. Application device B3 sends the key identifier of the quantum key assigned to application device B3 by quantum device A1 to application device B2. Application device B2 sends a second key acquisition request to quantum device A2, and the second key acquisition request includes the key identifier provided by application device B3. Quantum device A2 sends a second key acquisition response corresponding to the second key acquisition request to application device B2, and the second key acquisition response includes the quantum key corresponding to the key identifier carried in the second key acquisition request, that is, the quantum key assigned to application device B3 by quantum device A1. At this point, application device B3 and application device B2 obtain the same quantum key. Afterwards, application device B3 and application device B2 can communicate securely based on the quantum key.

[0198] Fig.11 The communication system shown is described by taking the quantum device (quantum device A1) that provides quantum services to application device B3 as an example and the quantum device (quantum device A2) that provides quantum services to application device B2 as an example. If application device B3 and application device B2 are provided with quantum services by the same quantum device, then when implementing the technical solution, the step of synchronizing quantum key information between the two quantum devices is omitted.

[0199] The following is an example of the basic hardware structure of the application equipment.

[0200] For example, Fig.12 Schematic diagram of the hardware structure of an application device provided in an embodiment of the present application. Fig.12 As shown, the application device 1200 includes a processor 1201 and a memory 1202 , and the memory 1201 and the memory 1202 are connected via a bus 1203 . Fig.12 The processor 1201 and the memory 1202 are described as being independent of each other. Optionally, the processor 1201 and the memory 1202 are integrated together. Optionally, Fig.12 The application device 1200 is Figure 1 , Figure 3 or Fig.11 Any application device shown.

[0201] The memory 1202 is used to store computer programs, including operating systems and program codes. The memory 1202 is various types of storage media, such as read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), flash memory, optical storage, register, optical disk storage, optical disk storage, magnetic disk or other magnetic storage devices.

[0202] The processor 1201 is a general-purpose processor or a special-purpose processor. The processor 1201 may be a single-core processor or a multi-core processor. The processor 1201 includes at least one circuit to execute the actions performed by the application device 1 and / or the application device 2 in the above method 200 provided in the embodiment of the present application.

[0203] Optionally, the application device 1200 further includes a network interface 1204, which is connected to the processor 1201 and the memory 1202 via the bus 1203. The network interface 1204 enables the application device 1200 to communicate with other application devices or other application devices. For example, the processor 1201 can interact with other application devices via the network interface 1204 to spread quantum device information to other application devices.

[0204] Optionally, the application device 1200 further includes an input / output (I / O) interface 1205, which is connected to the processor 1201 and the memory 1202 via the bus 1203. The processor 1201 can receive input commands or data, etc. through the I / O interface 1205. The I / O interface 1205 is used for the application device 1200 to connect input devices, such as keyboards, mice, etc. Optionally, in some possible scenarios, the above-mentioned network interface 1204 and I / O interface 1205 are collectively referred to as communication interfaces.

[0205] Optionally, the application device 1200 further includes a display 1206, which is connected to the processor 1201 and the memory 1202 via the bus 1203. The display 1206 can be used to display the intermediate results and / or final results generated by the processor 1201 executing the above method. In a possible implementation, the display 1206 is a touch display screen to provide a human-computer interaction interface.

[0206] The bus 1203 is any type of communication bus for interconnecting the internal devices of the application device 1200. For example, a system bus. The embodiment of the present application takes the above-mentioned devices inside the application device 1200 being interconnected through the bus 1203 as an example. Optionally, the above-mentioned devices inside the application device 1200 are connected to each other in a communication manner other than the bus 1203, for example, the above-mentioned devices inside the application device 1200 are interconnected through a logical interface inside the application device 1200.

[0207] The above devices may be arranged on independent chips, or at least partially or completely on the same chip. Whether to arrange each device independently on different chips or to integrate them on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation form of the above devices.

[0208] Fig.12 The application device 1200 shown is merely exemplary. During implementation, the application device 1200 includes other components, which are not listed one by one in this article. Fig.12 The application device 1200 shown can realize automatic discovery of quantum devices by executing all or part of the steps of the method provided in the above embodiment.

[0209] The following is an example of a virtual device in an embodiment of the present application.

[0210] The present application embodiment provides a quantum device discovery device. The device is applied to a first application device. For example, Fig.13 Schematic diagram of the structure of an application device provided in an embodiment of the present application. Fig.13 The application device of the structure shown implements the functions of the application device in the solution described in the above embodiment. Fig.13 The application equipment shown is Figure 1 , Figure 3 or Fig.11 Any application device in the application scenario shown, or Fig.12 The application equipment shown is used to perform Figure 2 or Figure 8 The functions or execution of the application devices described in the illustrated embodiments Fig. 9 The method 900 is shown. Fig.13 As shown, the application device 1300 (first application device) includes an acquisition module 1301 and a transceiver module 1302 .

[0211] The acquisition module 1301 is used to obtain the IP address and port number of the quantum device, where the port number is used by the quantum device to provide the quantum key to the application device.

[0212] The transceiver module 1302 is used to send a first quantum device discovery message to the second application device, where the first quantum device discovery message includes an IP address and a port number.

[0213] Here, please refer to the description in the previous method embodiment for the detailed working process of the acquisition module 1301 and the transceiver module 1302. For example, the acquisition module 1301 adopts step 201 in method 200 to obtain the IP address and port number of the quantum device. The transceiver module 1302 adopts step 202 in method 200 to send the first quantum device discovery message. Alternatively, the acquisition module 1301 adopts step 202 in method 200 to obtain the IP address and port number of the quantum device. The transceiver module 1302 adopts step 204 in method 200 to send the first quantum device discovery message. The embodiments of this application are not repeated here.

[0214] Optionally, the first quantum device discovery message is a BGP update message, and the IP address and port number of the quantum device are in a path attribute field of the BGP update message.

[0215] Optionally, the transceiver module 1302 is further used to: before sending the first quantum device discovery message to the second application device, send a capability negotiation request message to the second application device, the capability negotiation request message is used to determine whether the second application device has the ability to parse quantum device information from the first quantum device discovery message, and the quantum device information includes the IP address and port number of the quantum device; receive a capability negotiation response message corresponding to the capability negotiation request message sent by the second application device, and the capability negotiation response message indicates that the second application device has the ability to parse quantum device information from the first quantum device discovery message. The detailed working process of the transceiver module 1302 here can refer to steps S11 to S12.

[0216] Optionally, the capability negotiation request message is a BGP open message, and the BGP open message carries target address family information, and the target address family information is used by the second application device to determine whether it has the ability to parse quantum device information from the first quantum device discovery message.

[0217] Optionally, the capability negotiation response message is a BGP keep-alive message.

[0218] Optionally, the capability negotiation request message includes authentication credentials, and the authentication credentials are used by the second application device to perform security authentication on the first application device.

[0219] Optionally, the authentication credential is a preconfigured shared key, or the authentication credential includes a random number generated by the first application device and a signature of the random number by the first application device using a private key of the first application device.

[0220] Optionally, the acquisition module 1301 is specifically used to: receive a notification message sent by a quantum device, the notification message includes address information of the quantum device, and the address information is used by the application device to request a quantum key from the quantum device; and obtain an IP address and a port number according to the address information. The detailed working process of the acquisition module 1301 here can refer to step 201 in method 200.

[0221] Optionally, the acquisition module 1301 is specifically used to: receive a second quantum device discovery message sent by a third application device, the second quantum device discovery message including an IP address and a port number. The detailed working process of the acquisition module 1301 here can refer to step 204 in method 200.

[0222] The present application embodiment provides another quantum device discovery device. The device is applied to a second application device. For example, Fig.14 Schematic diagram of another application device provided in the embodiment of the present application. Fig.14 The application device of the structure shown implements the functions of the application device in the solution described in the above embodiment. Fig.14 The application equipment shown is Figure 1 , Figure 3 or Fig.11 Any application device in the application scenario shown, or Fig.12 The application equipment shown is used to perform Figure 2 or Figure 8 The functions or execution of the application devices described in the illustrated embodiments Fig.10 The method 1000 is shown. Fig.14 As shown, the application device 1400 (second application device) includes a transceiver module 1401 and a processing module 1402 .

[0223] The transceiver module 1401 is used to receive a quantum device discovery message sent by the first application device. The quantum device discovery message includes the IP address and port number of the quantum device. The port number is used by the quantum device to provide a quantum key to the application device.

[0224] The processing module 1402 is used to parse the quantum device discovery message to obtain the IP address and port number included in the quantum device discovery message, and store the obtained IP address and port number.

[0225] Optionally, the quantum device discovery message is a BGP update message, and the IP address and port number of the quantum device are in a path attribute field of the BGP update message.

[0226] Optionally, the transceiver module 1401 is further used to: before receiving the quantum device discovery message sent by the first application device, receive a capability negotiation request message sent by the first application device, the capability negotiation request message is used to determine whether the second application device has the ability to parse quantum device information from the quantum device discovery message, and the quantum device information includes the IP address and port number of the quantum device; send a capability negotiation response message corresponding to the capability negotiation request message to the first application device, and the capability negotiation response message indicates that the second application device has the ability to parse quantum device information from the quantum device discovery message. The detailed working process of the transceiver module 1401 here can refer to steps S11 to S12.

[0227] Optionally, the capability negotiation request message is a BGP open message, and the BGP open message carries target address family information. The processing module 1402 is further configured to determine, based on the target address family information, whether the second application device has the capability to parse quantum device information from the quantum device discovery message.

[0228] Optionally, the capability negotiation response message is a BGP keep-alive message.

[0229] Optionally, the capability negotiation request message includes authentication credentials, and the processing module 1402 is further configured to perform security authentication on the first application device according to the authentication credentials.

[0230] Optionally, the authentication credential is a preconfigured shared key, and the processing module 1402 is further used to: determine whether the second application device is configured with a shared key; if the second application device is configured with a shared key, determine that the first application device passes the security authentication.

[0231] Optionally, the authentication credentials include a random number generated by the first application device and a signature of the random number by the first application device using the private key of the first application device. The processing module 1402 is further used to: verify the signature using the public key of the first application device; if the second application device passes the signature verification, it is determined that the first application device has passed the security authentication.

[0232] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0233] An embodiment of the present application also provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed by a processor of an application device, the steps performed by any application device in the above-mentioned method 200, the above-mentioned method 800, the above-mentioned method 900 or the above-mentioned method 1000 are implemented.

[0234] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor of an application device, implements the steps performed by any application device in the above-mentioned method 200, the above-mentioned method 800, the above-mentioned method 900 or the above-mentioned method 1000.

[0235] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0236] In the embodiments of the present application, the terms “first”, “second” and “third” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0237] The term "and / or" in this application is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0238] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0239] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for discovering a quantum device, characterized in that: The method comprises: The first application device obtains an Internet Protocol IP address and a port number of a quantum device, where the port number is used by the quantum device to provide a quantum key to the application device; The first application device sends a first quantum device discovery message to the second application device, where the first quantum device discovery message includes the IP address and the port number.

2. The method according to claim 1, characterized in that The first quantum device discovery message is a Border Gateway Protocol BGP update message, and the IP address and the port number are in a path attribute field of the BGP update message.

3. The method according to claim 1 or 2, characterized in that: Before the first application device sends a first quantum device discovery message to the second application device, the method further includes: The first application device sends a capability negotiation request message to the second application device, where the capability negotiation request message is used to determine whether the second application device has the ability to parse quantum device information from the first quantum device discovery message, where the quantum device information includes the IP address and the port number; The first application device receives a capability negotiation response message corresponding to the capability negotiation request message sent by the second application device, wherein the capability negotiation response message indicates that the second application device has the capability to parse the quantum device information from the first quantum device discovery message.

4. The method according to claim 3, characterized in that The capability negotiation request message is a BGP open message, and the BGP open message carries target address family information, and the target address family information is used by the second application device to determine whether it has the ability to parse the quantum device information from the first quantum device discovery message.

5. The method according to claim 3 or 4, characterized in that: The capability negotiation response message is a BGP keep-alive message.

6. The method according to any one of claims 3 to 5, characterized in that: The capability negotiation request message includes authentication credentials, and the authentication credentials are used by the second application device to perform security authentication on the first application device.

7. The method according to claim 6, characterized in that The authentication credential is a preconfigured shared key, or the authentication credential includes a random number generated by the first application device and a signature of the random number by the first application device using a private key of the first application device.

8. The method according to any one of claims 1 to 7, characterized in that: The first application device obtains the IP address and port number of the quantum device, including: The first application device receives a notification message sent by the quantum device, where the notification message includes address information of the quantum device, and the address information is used by the application device to request a quantum key from the quantum device; The first application device obtains the IP address and the port number according to the address information.

9. The method according to any one of claims 1 to 7, characterized in that: The first application device obtains the IP address and port number of the quantum device, including: The first application device receives a second quantum device discovery message sent by a third application device, where the second quantum device discovery message includes the IP address and the port number.

10. A method for discovering a quantum device, characterized in that: The method comprises: The second application device receives a quantum device discovery message sent by the first application device, wherein the quantum device discovery message includes an Internet Protocol IP address and a port number of the quantum device, and the port number is used by the quantum device to provide a quantum key to the application device; The second application device parses the quantum device discovery message to obtain the IP address and the port number included in the quantum device discovery message; The second application device stores the IP address and the port number.

11. The method according to claim 10, characterized in that The quantum device discovery message is a Border Gateway Protocol BGP update message, and the IP address and the port number are in a path attribute field of the BGP update message.

12. The method according to claim 10 or 11, characterized in that: Before the second application device receives the quantum device discovery message sent by the first application device, the method further includes: The second application device receives a capability negotiation request message sent by the first application device, where the capability negotiation request message is used to determine whether the second application device has the capability to parse quantum device information from the quantum device discovery message, where the quantum device information includes the IP address and the port number; The second application device sends a capability negotiation response message corresponding to the capability negotiation request message to the first application device, and the capability negotiation response message indicates that the second application device has the ability to parse the quantum device information from the quantum device discovery message.

13. The method according to claim 12, characterized in that The capability negotiation request message is a BGP open message, and the BGP open message carries target address family information. The method further includes: The second application device determines, according to the target address family information, that the second application device has the ability to parse the quantum device information from the quantum device discovery message.

14. The method according to claim 12 or 13, characterized in that The capability negotiation response message is a BGP keep-alive message.

15. The method according to any one of claims 12 to 14, characterized in that: The capability negotiation request message includes authentication credentials, and the method further includes: The second application device performs security authentication on the first application device according to the authentication credentials.

16. The method according to claim 15, characterized in that The authentication credential is a preconfigured shared key, and the second application device performs security authentication on the first application device according to the authentication credential, including: The second application device determines whether the shared key is configured in the second application device; If the shared key is configured in the second application device, the second application device determines that the first application device passes the security authentication.

17. The method according to claim 15, characterized in that The authentication credential includes a random number generated by the first application device and a signature of the random number by the first application device using a private key of the first application device, and the second application device performs security authentication on the first application device according to the authentication credential, including: The second application device verifies the signature using the public key of the first application device; If the second application device passes the signature verification, the second application device determines that the first application device passes the security authentication.

18. A quantum device discovery device, characterized in that: The device is applied to a first application device, and comprises: a memory, a network interface and at least one processor. The memory is used to store program instructions. After the at least one processor reads the program instructions stored in the memory, the at least one processor causes the first application device to execute the method according to any one of claims 1 to 9.

19. A quantum device discovery device, characterized in that: The device is applied to a second application device, and includes: a memory, a network interface, and at least one processor. The memory is used to store program instructions. After the at least one processor reads the program instructions stored in the memory, the second application device executes the method according to any one of claims 10 to 17.

20. A quantum device discovery system, characterized in that: include: a first application device and a second application device; The first application device is used to send a quantum device discovery message to the second application device after obtaining the Internet Protocol IP address and port number of the quantum device, wherein the quantum device discovery message includes the IP address and the port number, and the port number is used by the quantum device to provide a quantum key to the application device; The second application device is used to receive the quantum device discovery message, parse the quantum device discovery message to obtain the IP address and the port number included in the quantum device discovery message, and store the IP address and the port number.

21. The system according to claim 20, characterized in that The second application device is used to send a key acquisition request to the quantum device according to the IP address and the port number; The quantum device is used to send a key acquisition response corresponding to the key acquisition request to the second application device, and the key acquisition response includes the quantum key allocated by the quantum device to the second application device.

22. The system according to claim 20 or 21, characterized in that The system also includes a quantum device; The quantum device is used to send a notification message to the first application device, where the notification message includes address information of the quantum device, and the address information is used by the application device to request a quantum key from the quantum device; The first application device is used to obtain the IP address and the port number according to the address information.

23. The system according to claim 22, characterized in that The first application device and the quantum device are located in the same broadcast domain, or a tunnel is established between the first application device and the quantum device.

24. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed by the processor, the method according to any one of claims 1 to 17 is implemented.

Images