Wide-area quantum key distribution method and system based on graph theory, and electronic equipment

Abstract

The invention provides a wide-area quantum key distribution method and system based on a graph theory and electronic equipment, and the method comprises the steps: a subnet key distribution system of a current subnet receives a key request, and judges whether a target network element is a network element in the current subnet or not; and if not, sending the key request and the exclusive or key information of the boundary network element of the current sub-network and the boundary network elements of other sub-networks to a wide-area key distribution system. The wide-area key distribution system determines a data transmission subnet sequence according to the XOR key information, the node identifier of the source network element and the node identifier of the target network element, and sends each related subsequence in the data transmission subnet sequence to each target subnet, and each target subnet encrypts and transmits data to be encrypted according to the related subsequence in sequence. And sending the encrypted target data to the second user equipment. Based on the characteristics of the XOR key and multi-layer key management, the security of the whole system is improved, different key distribution requirements are met, and the expansibility is high.

Description

Technical Field

[0001] The present application relates to the field of key distribution technology, and in particular to a wide-area quantum key distribution method, system and electronic device based on graph theory. Background Art

[0002] With the continuous improvement of computing power and the rapid development of quantum computing technology, traditional public key infrastructure (PKI) faces new security challenges. In order to enhance the security of information transmission, quantum key distribution (QKD) technology has emerged. QKD technology uses the characteristics of quantum state transmission to generate highly secure session keys between the communicating parties for encrypting and transmitting data. However, in practical applications, QKD technology is limited in long-distance transmission due to the limited transmission distance of quantum states.

[0003] In the prior art, trusted relay stations can be used to expand the coverage of the QKD network. Specifically, data is encrypted and transmitted through multiple relay nodes.

[0004] However, existing technical solutions cannot meet the key distribution and key storage requirements in wide area network scenarios. Summary of the invention

[0005] The purpose of this application is to provide a wide-area quantum key distribution method, system and electronic device based on graph theory to address the deficiencies in the above-mentioned prior art, so as to solve the problem that the prior art cannot meet the key distribution and key storage requirements in wide area network scenarios.

[0006] To achieve the above objectives, the technical solutions adopted in this application are as follows:

[0007] In a first aspect, the present application provides a wide-area quantum key distribution method based on graph theory, the method comprising:

[0008] The subnet key distribution system of the current subnet receives a key request sent by the first user equipment through a source network element, where the source network element is a network element in the current subnet, and the key request includes data to be encrypted, a node identifier of the source network element, a node identifier of a destination network element, and service information;

[0009] The subnet key distribution system of the current subnet determines whether the destination network element is a network element in the current subnet;

[0010] If not, the subnet key distribution system of the current subnet sends the key request and the XOR key information of the border network element of the current subnet to the wide area key distribution system, and the subnet key distribution systems of other subnets send the XOR key information of the border network element of their subnet to the wide area key distribution system;

[0011] The wide area key distribution system determines a data transmission subnet sequence according to the XOR key information of the boundary network elements of each subnet, the node identifier of the source network element and the node identifier of the destination network element, wherein the data transmission subnet sequence includes a plurality of subnet information arranged in sequence, each subnet information corresponds to a target subnet, each subnet information includes a starting network element and an ending network element when data is transmitted in the target subnet corresponding to the subnet information, and the target subnet corresponding to the first subnet information in the data transmission subnet sequence is the current subnet, and the target subnet corresponding to the last subnet information in the data transmission subnet sequence is the subnet where the destination network element is located;

[0012] The wide area key distribution system sends each related subsequence in the data transmission subnet sequence to the target subnet corresponding to each related subsequence, and each target subnet encrypts and transmits the data to be encrypted in turn according to the corresponding related subsequence, and sends the encrypted target data to the second user device.

[0013] Optionally, the wide area key distribution system determines the data transmission subnet sequence according to the XOR key information of the boundary network element of each subnet, the node identifier of the source network element and the node identifier of the destination network element, including:

[0014] Determine the node connection information between each subnet according to the XOR key information of the boundary network element of each subnet;

[0015] The data transmission subnet sequence is determined according to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element.

[0016] Optionally, the determining the data transmission subnet sequence according to the node connection information between the subnets, the node identifier of the source network element, and the node identifier of the destination network element includes:

[0017] Determine multiple optional data transmission paths according to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element, each optional transmission path passes through multiple subnets;

[0018] Using the shortest path among the multiple optional data transmission paths as the target data transmission path;

[0019] The starting network element and the ending network element in the subnet passed by the target data transmission path are sequentially used as subnet information in the data transmission subnet sequence.

[0020] Optionally, the encrypting and transmitting the data to be encrypted in sequence by each target subnet according to a corresponding related subsequence includes:

[0021] The starting network element of the target subnet receives the first encrypted data sent by the previous last network element, wherein the relevant subsequence corresponding to the target subnet includes: previous subnet information, current subnet information and next subnet information, the current subnet information includes the starting network element of the target subnet and the last network element of the target subnet, wherein the previous last network element is the last network element in the subnet corresponding to the previous subnet information;

[0022] The starting network element of the target subnet sends the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to the subnet key distribution system of the target subnet;

[0023] The subnet key distribution system of the target subnet determines the transmission mode within the subnet according to the preset service application priority;

[0024] If the transmission mode within the subnet is a centralized transmission mode, the subnet key distribution system of the target subnet encrypts the first encrypted data according to the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to obtain second encrypted data, and sends the second encrypted data to the ending network element of the target subnet, and the ending network element of the target subnet sends the second encrypted data to the starting network element in the subnet corresponding to the latter subnet information;

[0025] If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet based on the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, and sends the shortest transmission path to each network element in the shortest transmission path within the subnet, and each network element in the shortest transmission path within the subnet performs data encryption and transmission in turn.

[0026] Optionally, the subnet key distribution system of the target subnet encrypts the first encrypted data according to the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to obtain the second encrypted data, including:

[0027] The subnet key distribution system of the target subnet determines the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet;

[0028] The subnet key distribution system of the target subnet obtains the XOR key information of each network element in the shortest transmission path in the subnet;

[0029] The subnet key distribution system of the target subnet encrypts the first encrypted data layer by layer according to the XOR key information of each network element in the shortest transmission path in the subnet and in the order of each network element in the shortest transmission path in the subnet to obtain the second encrypted data.

[0030] Optionally, the encrypting and transmitting data in sequence by each network element in the shortest transmission path in the subnet includes:

[0031] The current network element in the shortest transmission path determines the next network element of the current network element according to the shortest transmission path;

[0032] The current network element encrypts the received current encrypted data to obtain target encrypted data, and sends the target encrypted data to the next network element.

[0033] Optionally, after the subnet key distribution system of the current subnet determines whether the destination network element is a network element in the current subnet, the system further includes:

[0034] If the destination network element is a network element in the current subnet, the subnet key distribution system of the current subnet determines the intra-subnet transmission mode according to the preset service application priority;

[0035] If the intra-subnet transmission mode is a centralized transmission mode, the subnet key distribution system of the current subnet encrypts the data to be encrypted according to the data to be encrypted, the node identifier of the source network element of the current subnet, and the node identifier of the destination network element of the current subnet to obtain encrypted target data, and sends the encrypted target data to the destination network element of the current subnet, so that the destination network element sends the encrypted target data to the second user equipment;

[0036] If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the current subnet determines the shortest transmission path within the subnet based on the node identifier of the source network element of the current subnet and the node identifier of the destination network element of the current subnet, and sends the shortest transmission path within the subnet to each network element in the shortest transmission path within the subnet. Each network element in the shortest transmission path within the subnet encrypts and transmits data in turn, and the destination network element sends the encrypted target data to the second user device.

[0037] Optionally, the subnet key distribution system includes a key management module, a key calculation module and a key storage module;

[0038] The subnet key distribution system of the target subnet determines the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, including:

[0039] The interface unit in the key management module of the subnet key distribution system of the target subnet is used to send the received node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet to the key calculation module;

[0040] The key calculation module is used to determine the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet, the node identifier of the ending network element of the target subnet, and the network element topology information.

[0041] Optionally, the subnet key distribution system of the target subnet encrypts the first encrypted data layer by layer according to the XOR key information of each network element in the shortest transmission path in the subnet and in the order of each network element in the shortest transmission path in the subnet to obtain the second encrypted data, including:

[0042] The key calculation module in the subnet key distribution system of the target subnet sends a key data request to the key storage module according to the shortest transmission path in the subnet, the key data request includes the node identification of each network element in the shortest transmission path in the subnet, the key storage module includes a point data storage unit, an edge data storage unit and a metadata storage unit, and the key storage module is used to store the XOR key information of each network element in the point data storage unit, the edge data storage unit and the metadata storage unit based on the graph theory principle;

[0043] The key storage module sends the XOR key of each network element in the shortest transmission path in the subnet to the key calculation module according to the key data request;

[0044] The key calculation module encrypts the first encrypted data layer by layer according to the XOR key of each network element in the shortest transmission path in the subnet to obtain the second encrypted data.

[0045] Optionally, the method further comprises:

[0046] The subnet key distribution system of the target subnet acquires current load information in real time, where the current load information is used to indicate the current key demand of the subnet key distribution system of the target subnet;

[0047] The subnet key distribution system of the target subnet determines the target key storage capacity according to the current load information, the standard load information and the preset key storage space threshold;

[0048] The subnet key distribution system of the target subnet dynamically adjusts the storage space of the key storage module in the subnet key distribution system based on the target key storage capacity.

[0049] Optionally, the method further comprises:

[0050] Determine whether the current key storage space in the subnet key distribution system of the target subnet is less than a preset remaining storage space threshold;

[0051] If yes, a key request message is sent to each network element in the target subnet, so that each network element in the subnet generates XOR key information according to the basic key and the connection relationship with other network elements in the target subnet;

[0052] The XOR key information sent by each network element in the target subnet is received, and the XOR key information of the subnet is stored in the key storage space based on the graph theory principle.

[0053] Optionally, the method further comprises:

[0054] The subnet key distribution system of the target subnet determines whether the key needs to be destroyed according to the network element topology information updated in real time;

[0055] If so, the key lifecycle management unit in the subnet key distribution system in the target subnet generates key destruction information, and destroys the corresponding XOR key information in the key storage module according to the key destruction information.

[0056] In a second aspect, the present application provides a key distribution control system, the key distribution control system comprising a wide area key distribution system and a plurality of subnet key distribution systems, each of the subnet key distribution systems being respectively deployed in a corresponding subnet, each of the subnets comprising at least one network element, the subnet key distribution system comprising a key management module, a key calculation module and a key storage module;

[0057] The key distribution control system is used to distribute keys based on the steps of the graph theory-based wide-area quantum key distribution method described in the first aspect.

[0058] In a third aspect, the present application provides an electronic device comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the wide-area quantum key distribution method based on graph theory as described above.

[0059] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the above-mentioned graph theory-based wide-area quantum key distribution method are executed.

[0060] The beneficial effects of the present application are as follows: first, after the subnet key distribution system receives the key request, it determines whether to adopt the subnet solution or the wide area solution by judging whether the target network element is a network element in the current subnet, thereby improving the efficiency of key distribution. The wide area solution is that the current subnet key distribution system sends the key request and the XOR key information of the border network element to the wide area key distribution system, and the subnet key distribution system of other subnets sends the XOR key information of the border network element of the subnet to the wide area key distribution system for storage, wherein the XOR key information is stored in the subnet key distribution system and the wide area key distribution system, meeting the key storage requirements. After the wide area key distribution system determines the data transmission subnet sequence, it sends each related subsequence in each data transmission subnet sequence to the target subnet corresponding to each related subsequence, and the target subnet encrypts and transmits the encrypted data in turn according to the corresponding related subsequence, and sends the encrypted data to the second user device. The present application is based on the characteristics of the XOR key and multi-layer key management to improve the security of the entire key distribution process. In addition, the present application supports subnet solutions and wide area solutions, can adapt to different key distribution requirements, and has high scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0062] Figure 1 It is a structural diagram of a key distribution control system provided by an embodiment of the present application;

[0063] Figure 2 is a schematic diagram of the structure of another key distribution control system provided by this embodiment;

[0064] Figure 3 It is a flow chart of a wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application;

[0065] Figure 4 It is a structural diagram of a wide-area key distribution system storing XOR key information provided by an embodiment of the present application;

[0066] Figure 5It is a flowchart of a method for determining a data transmission subnet sequence provided by an embodiment of the present application;

[0067] Figure 6 It is a flowchart of a method for encrypting and transmitting encrypted data provided by an embodiment of the present application;

[0068] Figure 7 is a flow chart of a method for obtaining second encrypted data provided by an embodiment of the present application;

[0069] Figure 8 It is a flow chart of another wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application;

[0070] Fig. 9 It is a flowchart of another key distribution method provided in an embodiment of the present application;

[0071] Fig.10 It is a structural diagram of a subnet key distribution system provided in an embodiment of the present application;

[0072] Fig.11 is a flowchart of another method for obtaining second encrypted data provided by an embodiment of the present application;

[0073] Fig.12 It is a structural diagram of a key storage module provided in an embodiment of the present application;

[0074] Fig.13 This is a key relay timing diagram provided in an embodiment of the present application;

[0075] Fig.14 It is a flow chart of another wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application;

[0076] Fig.15 It is a flow chart of another wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application;

[0077] Fig.16 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0078] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0079] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0080] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0081] In the prior art, a trusted relay station can be used to expand the coverage of the QKD network. Specifically, data encryption transmission is performed through multiple relay nodes. However, the prior art solutions cannot meet the key distribution and key storage requirements in wide area network scenarios.

[0082] Based on this, the present application proposes a wide-area quantum key distribution method based on graph theory, which is applied to a key distribution control system. In the wide-area quantum key distribution method based on graph theory, the subnet key distribution system of the current subnet determines whether the destination network element in the key request sent by the first user device is in the current subnet. If so, the subnet key distribution system of the current subnet determines the transmission mode within the subnet and performs encryption and transmission. If not, the subnet key distribution system of the current subnet sends the key request and the XOR key information of the boundary network elements of each subnet to the wide-area key distribution system, and the wide-area key distribution system determines the data transmission subnet sequence, and sends each related subsequence in the data transmission subnet sequence to the target subnet corresponding to each related sequence, and each target subnet encrypts and transmits the encrypted data according to the corresponding related subsequence and sends it to the second user device. The present application realizes the encrypted transmission of data within the subnet and the key distribution and storage requirements in the wide area network scenario by judging whether the target network element is in the current subnet.

[0083] Before introducing the specific implementation steps of the wide-area quantum key distribution method based on graph theory, the key distribution control system is first introduced. Figure 1 Schematic diagram of a key distribution control system provided by an embodiment of the present application. The key distribution control system is a distributed deployment structure. Figure 1 As shown, the key distribution control system includes a wide-area key distribution system and multiple subnet key distribution systems. Each subnet key distribution system is respectively deployed in the quantum key distribution network controller (Quantum Key Distribution Network Controller, QKDNC) in the corresponding subnet, and the wide-area key distribution system is deployed in the wide-area QKDNC. QKDNC can control each network element in the subnet, receive information sent by each network element, and send information to each network element. Each subnet includes at least one network element. Specifically, the QKDNC where each subnet key distribution system is located communicates with each other through the wide-area QKDNC. Each network element is a key manager (Key Manager, KM) for key storage, relay and output in the quantum key distribution network (Quantum Key Distribution Network, QKDN). QKDN is a network composed of multiple network elements connected by a quantum key distribution (Quantum Key Distribution, QKD) link. Each network element includes a basic key library and an XOR key library, which are used to store basic keys and XOR keys respectively. Among them, the basic key can be generated by the QKD underlying device and sent to the network element, and the XOR key can represent the connection relationship between the current network element and other network elements.

[0084] As another optional implementation, Figure 2Schematic diagram of another key distribution control system provided by this embodiment. Figure 2 In the embodiment, the key distribution control system is a centralized deployment structure, and the key distribution control system includes a key distribution system, which is deployed in the wide area QKDNC, and the wide area QKDNC communicates with the QKDNC of each subnet.

[0085] Figure 3 is a flow chart of a wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application. Figure 3 As shown, this application is based on Figure 1 The distributed deployment structure in the paper is used as an example to introduce the wide-area quantum key distribution method based on graph theory.

[0086] S301. The subnet key distribution system of the current subnet receives a key request sent by a first user equipment through a source network element, where the source network element is a network element in the current subnet. The key request includes data to be encrypted, a node identifier of the source network element, a node identifier of a destination network element, and service information.

[0087] Specifically, each subnet key distribution system pre-stores a unique node identifier of each network element in the corresponding subnet. The service information is used to indicate the service requirements of the user. The service requirements may be call requirements and mailbox requirements.

[0088] S302: The subnet key distribution system of the current subnet determines whether the destination network element is a network element in the current subnet.

[0089] Specifically, the subnet key distribution system of the current subnet determines whether the target network element is a network element of the current subnet according to the node identifier of the target network element.

[0090] S303. If not, the subnet key distribution system of the current subnet sends the key request and the XOR key information of the border network element of the current subnet to the wide area key distribution system, and the subnet key distribution systems of other subnets send the XOR key information of the border network elements of their subnets to the wide area key distribution system.

[0091] Optionally, if the target network element is a network element in the current subnet, the subnet solution is adopted, that is, the shortest transmission path is found in the subnet, and the encrypted data is encrypted and transmitted in sequence according to the XOR encryption key of each network element in the shortest transmission path.

[0092] As an optional implementation, if the destination network element is not a network element in the current subnet, a wide-area solution is adopted, that is, the subnet key distribution system of the current subnet sends a key request to the wide-area key distribution system, and sends prompt information to the subnet key distribution systems of other subnets through the wide-area QKDNC, so that the subnet key distribution systems of other subnets send the XOR key information of the boundary network element of the subnet to the wide-area key distribution system.

[0093] As another optional implementation, the XOR key information of the boundary network elements in each subnet is sent to the wide area key distribution system for storage in advance. After determining that the target network element is not a network element in the current subnet, the subnet key distribution system of the current subnet sends a key request to the wide area key distribution system.

[0094] Optionally, the XOR key information is a key generated by each network element based on the basic key and the relationship between the current network element and other network elements in the subnet. It is worth noting that when storing the XOR key information of each network element, the subnet key distribution system and the wide area key distribution system can use point data storage units, edge data storage units and metadata storage units based on graph theory principles to store the XOR key information of each network element. Among them, the point data is used to store the attributes of each network element, the edge data is used to store the connection relationship between each network element, and the metadata is used to store the XOR key of each network element.

[0095] As an example, Figure 4 Schematic diagram of a structure of a wide area key distribution system storing XOR key information provided by an embodiment of the present application. Figure 4As shown, the wide area key distribution system can communicate with five subnet key distribution systems. Subnet A includes network element 11, network element 12 and network element 13, network element 11 is connected to network element 12, network element 12 is connected to network element 13, subnet B includes network element 14, network element 15 and network element 16, network element 14 is connected to network element 15, network element 15 is connected to network element 16, subnet C includes network element 17, network element 18, network element 19 and network element 20, network element 17 is connected to network element 18, network element 18 is connected to network element 19, and network element 20 is connected to network element 18. and NE 19, which is connected to NE 20. Subnet D includes NE 21, NE 22, NE 23, NE 24 and NE 25. NE 21 is connected to NE 24, NE 22 is connected to NE 23, NE 23 is connected to NE 25. Subnet E includes NE 26, NE 27 and NE 28. NE 26 is connected to NE 27, and NE 27 is connected to NE 28. The connection relationships between subnets are: NE 13 is connected to NE 14, NE 12 is connected to NE 20, NE 20 is connected to NE 21, NE 19 is connected to NE 22, NE 24 is connected to NE 15, NE 24 is also connected to NE 26, and NE 25 is connected to NE 26. Based on this, in the subnet key distribution system of subnet A, the XOR key information of the network elements in the subnet includes key1112*key1213, and the XOR key information of the boundary network elements includes key1112*key1220, key1213*key1220, and key1213*key1314. In the subnet key distribution system of subnet B, the XOR key information of the network elements in the subnet includes key1415*key1516, and the XOR key information of the boundary network elements includes key1314*key1415, key1415*key1524, and key1516*key1524. In the subnet key distribution system of subnet C, the XOR key information of the network elements in the subnet includes key1718*key1819 and key1819*key1920, and the XOR key information of the boundary network elements includes key1819*key1922, key1920*key2021, key1920*key2012, and key2012*key2021. In the subnet key distribution system of subnet D, the XOR key information of the network elements in the subnet includes key2223*key2325, and the XOR key information of the boundary network elements includes key2120*key2124, key2124*key2426, key2124*key2415, key2219*key2223, key2325*key2526, and key2415*key2426. In the subnet key distribution system of subnet E, the XOR key information of the network elements in the subnet includes key2627*key2728, and the XOR key information of the boundary network elements includes key2624*key2627 and key2625*key2627. Then the wide area key distribution system stores the XOR key information of each subnet boundary network element.

[0096] S304. The wide area key distribution system determines the data transmission subnet sequence according to the XOR key information of the boundary network elements of each subnet, the node identifier of the source network element and the node identifier of the destination network element. The data transmission subnet sequence includes a plurality of subnet information arranged in sequence. Each subnet information corresponds to a target subnet. Each subnet information includes a starting network element and an ending network element when data is transmitted in the target subnet corresponding to the subnet information. Moreover, the target subnet corresponding to the first subnet information in the data transmission subnet sequence is the current subnet, and the target subnet corresponding to the last subnet information in the data transmission subnet sequence is the subnet where the destination network element is located.

[0097] As an optional implementation, the wide area key distribution system determines the connection relationship between the border network elements in each subnet based on the XOR key information of the border network elements in each subnet, and then determines the data transmission subnet sequence based on the connection relationship between the border network elements in each subnet, the node identification of the source network element and the node information of the destination network element.

[0098] As another optional implementation, the wide area key distribution system determines the subnet to be selected based on the node identifier of the source network element and the node identifier of the destination network element, determines the connection relationship of the border network elements in the subnet to be selected based on the XOR key information of the border network elements, and determines the data transmission subnet sequence based on the connection relationship of the border network elements in the subnet to be selected, the node identifier of the source network element and the node information of the destination network element.

[0099] The data transmission subnet sequence includes a plurality of subnet information arranged in sequence, each subnet information corresponds to a target subnet, and each subnet information includes a starting network element and an ending network element when data is transmitted in the target subnet corresponding to the subnet information. Figure 4 As shown, user equipment A is connected to network element 11, user equipment B and user equipment D are connected to network element 16, and user equipment C is connected to network element 26. If user equipment B distributes a key to user equipment C, the source network element is network element 16, the destination network element is network element 28, subnet B is the current subnet, and subnet E is the destination subnet. The data transmission subnet sequence can be network element 16, network element 15, network element 24, network element 26, and network element 28.

[0100] S305. The wide area key distribution system sends each related subsequence in the data transmission subnet sequence to the target subnet corresponding to each related subsequence, and each target subnet encrypts and transmits the encrypted data in turn according to the corresponding related subsequence, and sends the encrypted target data to the second user device.

[0101] The relevant subsequence includes the last network element in the subnet information of the previous subnet of the target subnet in the data transmission subnet sequence, and the starting network element in the subnet information of the next subnet of the target subnet in the data transmission subnet sequence. Figure 4 In the example, if user equipment B distributes a key to user equipment C, and the data transmission subnet sequence is network element 16, network element 15, network element 24, network element 26, and network element 28, then the relevant subsequence of subnet D includes, in addition to the starting network element and the ending network element of subnet D, the ending network element of subnet B, i.e., network element 15, and the starting network element of subnet E, i.e., network element 26. It is worth noting that in the data transmission subnet sequence, the starting network element and the ending network element can be the same network element. For example, in the above example, the starting network element and the ending network element of subnet D are both network element 24.

[0102] As an optional implementation, the wide area key distribution system sends each relevant subsequence in the data transmission subnet sequence to the subnet key distribution system of the target subnet corresponding to each relevant subsequence, and the subnet key distribution system of each target subnet sequentially encrypts and transmits the encrypted data according to the corresponding relevant subsequence. Specifically, the shortest transmission path is determined based on the XOR key information of the network element in each subnet, the node identifier of the starting network element in each subnet, and the node identifier of the ending network element, and the encrypted data is sequentially decrypted based on the XOR key information of each network element in the shortest transmission path in the subnet to obtain the encrypted target data, and the encrypted target data is sent to the second user device to achieve key distribution.

[0103] In this embodiment, after the subnet key distribution system receives the key request, it determines whether to adopt the subnet solution or the wide area solution by judging whether the target network element is a network element in the current subnet, thereby improving the efficiency of key distribution. The wide area solution is that the current subnet key distribution system sends the key request and the XOR key information of the border network element to the wide area key distribution system, and the subnet key distribution system of other subnets sends the XOR key information of the border network element of the subnet to the wide area key distribution system for storage, wherein the XOR key information is stored in the subnet key distribution system and the wide area key distribution system, meeting the key storage requirements. After the wide area key distribution system determines the data transmission subnet sequence, it sends each related subsequence in each data transmission subnet sequence to the target subnet corresponding to each related subsequence, and the target subnet encrypts and transmits the encrypted data in turn according to the corresponding related subsequence, and sends the encrypted data to the second user device. This application is based on the characteristics of the XOR key and multi-layer key management to improve the security of the entire key distribution process. In addition, this application supports subnet solutions and wide area solutions, can adapt to different key distribution requirements, and has high scalability.

[0104] Furthermore, in the above step S304, the wide area key distribution system determines the data transmission subnet sequence according to the XOR key information of the boundary network element of each subnet, the node identifier of the source network element and the node identifier of the destination network element. The specific steps are as follows:

[0105] Optionally, the node connection information between the subnets is determined according to the XOR key information of the boundary network elements of each subnet.

[0106] Optionally, since the XOR key information of each network element is stored in the wide area key distribution system based on graph theory principles, the node connection information between the boundary network elements in each subnet can be determined according to the graph theory information.

[0107] The node connection information includes the connection status of each boundary network element. It is worth mentioning that if a network element sends an abnormality or fails, the network element is not connected to any network element.

[0108] Optionally, the data transmission subnet sequence is determined according to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element.

[0109] Optionally, the target data transmission path is determined based on the node connection information between each subnet, the node identifier of the source network element and the node identifier of the destination network element, and the starting network element and the ending network element in the subnet in the target data transmission path are sequentially used as a subnet information in the data transmission subnet sequence.

[0110] In this embodiment, the node connection information between each subnet is determined based on the XOR key information of the boundary network element, and then the data transmission subnet sequence is determined based on the node connection information between the subnets, the node identification of the source network element and the node identification of the target network element, thereby calculating the shortest path for data transmission and encryption and improving the key distribution efficiency.

[0111] Further, the step of determining the data transmission subnet sequence according to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element is as follows: Figure 5 As shown, the details are as follows. Among them, Figure 5 It is a flowchart of a method for determining a data transmission subnet sequence provided in an embodiment of the present application.

[0112] S501. Determine multiple optional data transmission paths according to node connection information between subnets, node identifiers of source network elements, and node identifiers of destination network elements, each optional transmission path passing through multiple subnets.

[0113] According to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element, all paths that can be used for data transmission are determined, and the given path is used as an optional data transmission path.

[0114] It is worth mentioning that at least one network element in each optional data transmission path is different.

[0115] S502: Use the shortest path among multiple optional data transmission paths as the target data transmission path.

[0116] Optionally, the shortest path may be a path passing through the least number of network elements.

[0117] It is worth noting that if there are two optional data transmission paths with the same number of network elements, the path with the smallest sum of the loads in the subnet key distribution systems of the subnets in the path is used as the target data transmission path.

[0118] S503: Use the starting network element and the ending network element in the subnet that the target data transmission path passes through as subnet information in the data transmission subnet sequence in sequence.

[0119] Optionally, if the target data transmission path includes only two subnets, the starting network element in the subnet information of the previous subnet is the source network element, and the ending network element in the subnet information of the next subnet is the destination network element.

[0120] In this embodiment, multiple optional data transmission paths are determined, and then the shortest path is used as the target data transmission path, thereby determining the subnet information in the data transmission subnet sequence, thereby improving the key distribution efficiency.

[0121] As an optional implementation, if the target subnet is not the current subnet and is not the destination subnet, the specific steps of encrypting and transmitting the data to be encrypted are as follows. Figure 6 1 is a flow chart of a method for encrypting and transmitting encrypted data provided by an embodiment of the present application. Figure 6 The specific steps for encrypting and transmitting the encrypted data are described.

[0122] S601, the starting network element of the target subnet receives the first encrypted data sent by the previous ending network element, wherein the relevant subsequence corresponding to the target subnet includes: previous subnet information, current subnet information and next subnet information, the current subnet information includes the starting network element of the target subnet and the last network element of the target subnet, wherein the previous last network element is the last network element in the subnet corresponding to the previous subnet information.

[0123] The subnet key distribution system of the target subnet sends acceptance prompt information to the starting network element of the target subnet, so that the starting network element of the target subnet accepts the first encrypted data.

[0124] Optionally, the subsequent starting network element includes a starting network element in a subnet corresponding to the subsequent subnet information.

[0125] S602: The starting network element of the target subnet sends the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to the subnet key distribution system of the target subnet.

[0126] It is worth noting that the first decrypted data also includes the service information in the key request. The subnet key distribution system of the target subnet pre-stores the XOR key information of each network element in the target subnet.

[0127] S603: The subnet key distribution system of the target subnet determines the transmission mode within the subnet according to the preset service application priority.

[0128] As an optional implementation, the subnet key distribution system of the target subnet determines the transmission mode within the subnet according to the business information and the preset business application priority. If the business application priority corresponding to the business information is high, the centralized transmission mode is sampled, otherwise the hop-by-hop transmission mode is adopted. Among them, the business application priority includes the levels corresponding to various business information.

[0129] As another optional implementation, the subnet key distribution system of the target subnet determines the intra-subnet transmission mode according to the node identifier of the starting network element of the target subnet, the node identifier of the ending network element of the target subnet, the service information and the preset service application priority. If the distance between the starting network element and the ending network element is greater than the preset distance, the centralized transmission mode is used preferentially. Otherwise, the intra-subnet transmission mode is determined in combination with the service information and the preset service application priority.

[0130] S604. If the transmission mode within the subnet is a centralized transmission mode, the subnet key distribution system of the target subnet encrypts the first encrypted data according to the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to obtain the second encrypted data, and sends the second encrypted data to the ending network element of the target subnet. The ending network element of the target subnet sends the second encrypted data to the starting network element in the subnet corresponding to the subsequent subnet information.

[0131] Specifically, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet based on the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, and then encrypts the first encrypted data in sequence according to the XOR key information of each network element in the shortest transmission path.

[0132] S605. If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet based on the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, and sends the shortest transmission path to each network element in the shortest transmission path within the subnet, and each network element in the shortest transmission path within the subnet performs data encryption and transmission in turn.

[0133] Specifically, after the shortest transmission path in the subnet is determined and sent to each subnet, the starting network element starts to encrypt and transmit the first encrypted data in sequence to obtain the second encrypted data.

[0134] In this embodiment, the first encrypted data is encrypted and transmitted in sequence by determining the transmission mode within the subnet, thereby being applicable to different business scenarios and improving flexibility and scalability.

[0135] As another optional implementation, if the target subnet is the current subnet, the specific steps of encrypting and transmitting the data to be encrypted are as follows.

[0136] Optionally, the starting network element of the target subnet sends the node identifier of the last network element of the target subnet to the subnet key distribution system of the target subnet. The subnet key distribution system of the target subnet determines the intra-subnet transmission mode according to the preset service application priority. If the intra-subnet transmission mode is a centralized transmission mode, the subnet key distribution system of the target subnet encrypts the encrypted data according to the data to be encrypted, the node identifier of the starting network element of the target subnet, and the node identifier of the last network element of the target subnet to obtain the second encrypted data, and sends the second encrypted data to the last network element of the target subnet, and the last network element of the target subnet sends the second encrypted data to the starting network element in the subnet corresponding to the next subnet information. If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet based on the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, and sends the shortest transmission path to each network element in the shortest transmission path within the subnet, and each network element in the shortest transmission path within the subnet performs data encryption and transmission in turn.

[0137] As another optional implementation, if the target subnet is the target subnet, the specific steps of encrypting and transmitting the data to be encrypted are as follows.

[0138] Optionally, the starting network element of the target subnet receives the first encrypted data sent by the previous end network element, wherein the relevant subsequence corresponding to the target subnet includes: the previous subnet information and the current subnet information, the current subnet information includes the starting network element of the target subnet and the end network element of the target subnet, the end network element is the target network element, wherein the previous end network element is the end network element in the subnet corresponding to the previous subnet information. The starting network element of the target subnet sends the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the end network element of the target subnet to the subnet key distribution system of the target subnet. The subnet key distribution system of the target subnet determines the transmission mode within the subnet according to the preset service application priority. If the transmission mode within the subnet is a centralized transmission mode, the subnet key distribution system of the target subnet encrypts the first encrypted data according to the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the end network element of the target subnet to obtain the encrypted target data, and sends the encrypted target data. If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet based on the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, and sends the shortest transmission path to each network element in the shortest transmission path within the subnet, and each network element in the shortest transmission path within the subnet performs data encryption and transmission in turn.

[0139] Next, refer to Figure 7 The specific steps of the subnet key distribution system of the target subnet in step S604 encrypting the first encrypted data according to the first encrypted data, the identifier of the starting network element of the target subnet and the identifier of the ending network element of the target subnet to obtain the second encrypted data are introduced. Figure 7 It is a flowchart of a method for obtaining second encrypted data provided in an embodiment of the present application.

[0140] S701. The subnet key distribution system of the target subnet determines the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet.

[0141] As an optional implementation, since the XOR key information of each network element in the target subnet is pre-stored in the subnet key distribution system based on graph theory principles, the shortest transmission path in the subnet can be calculated according to the Bellman-Ford algorithm or the Dijkstra algorithm.

[0142] S702: The subnet key distribution system of the target subnet obtains the XOR key information of each network element in the shortest transmission path in the subnet.

[0143] Specifically, the subnet key distribution system of the target subnet obtains the XOR key of the XOR key information of each network element in the shortest transmission path in the subnet.

[0144] S703. The subnet key distribution system of the target subnet encrypts the first encrypted data layer by layer according to the XOR key information of each network element in the shortest transmission path in the subnet and in the order of each network element in the shortest transmission path in the subnet to obtain second encrypted data.

[0145] Optionally, the second encrypted data may be calculated according to the following formula (1):

[0146]

[0147] Where i represents the starting network element of the target subnet, and j represents the ending network element of the target subnet. ij represents the shortest transmission path within the subnet, f(i,j,p ij ) represents the second encrypted data obtained by encrypting the first encrypted data from the starting network element i to the ending network element j, v l and v l+1 They respectively represent two adjacent network elements in the shortest transmission path in the subnet, k represents the XOR key of each network element in the shortest transmission path in the subnet, and XOR represents an XOR operation, which is used to encrypt the data of each network element in the shortest transmission path in the subnet.

[0148] It is worth noting that in the centralized transmission mode, after the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet, the subnet key distribution system still directly encrypts the first encrypted data in sequence according to the XOR key information of each network element, and after obtaining the second encrypted data, it directly sends the data to the last network element of the target subnet.

[0149] In this embodiment, after determining the shortest transmission path within the subnet, the first encrypted data is encrypted layer by layer according to the XOR key information of each network element in the shortest transmission path within the subnet and in the order of each network element in the shortest transmission path within the subnet to obtain the second encrypted data, thereby improving encryption and transmission efficiency.

[0150] Next, the steps of sequentially encrypting and transmitting data by each network element in the shortest transmission path in the subnet in the hop-by-hop transmission mode in the above step S605 are introduced.

[0151] Optionally, the current network element in the shortest transmission path determines the next network element of the current network element according to the shortest transmission path.

[0152] Specifically, taking the case where the current network element is neither the starting network element nor the ending network element as an example, the current network element may determine the previous network element and the next network element according to the shortest transmission path.

[0153] Optionally, the current network element encrypts the received current encrypted data to obtain target encrypted data, and sends the target encrypted data to the next network element.

[0154] Specifically, the current network element receives the current encrypted data sent from the previous network element, encrypts the current encrypted data based on the XOR key of the current network element, and obtains the target encrypted data.

[0155] It is worth noting that in the hop-by-hop transmission mode, after the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet, it sends the shortest transmission path within the subnet to each network element in the path, and the network elements in the path encrypt the data based on the XOR key in turn.

[0156] In this embodiment, the next network element of the current network element is determined by the current network element, and after the received current encrypted data is encrypted, the obtained target encrypted data is sent to the next network element, thereby ensuring the security of the data.

[0157] As an optional implementation, refer to Figure 8 The following describes the situation in which the subnet key distribution system of the current subnet in step S302 determines that the destination network element is a network element in the current subnet. Figure 8 It is a flow chart of another wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application.

[0158] S801. If the destination network element is a network element in the current subnet, the subnet key distribution system of the current subnet determines the intra-subnet transmission mode according to a preset service application priority.

[0159] If the destination network element is a network element in the current subnet, the wide area key distribution system does not need to perform determination and judgment, so that the efficiency of the entire key distribution process is accelerated.

[0160] As an optional implementation, the subnet key distribution system of the current subnet can determine the transmission mode within the subnet according to the node identifier of the source network element of the current subnet, the node identifier of the destination network element of the current subnet, the service information and the preset service application priority. The specific determination method is the same as step S603 and will not be repeated here.

[0161] S802. If the transmission mode within the subnet is a centralized transmission mode, the subnet key distribution system of the current subnet encrypts the data to be encrypted according to the data to be encrypted, the node identifier of the source network element of the current subnet, and the node identifier of the destination network element of the current subnet, obtains the encrypted target data, and sends the encrypted target data to the destination network element of the current subnet, so that the destination network element sends the encrypted target data to the second user device.

[0162] As an optional implementation, the subnet key distribution system of the current subnet determines the shortest transmission path according to the node identifier of the source network element of the current subnet and the node identifier of the destination network element of the current subnet. The subnet key distribution system obtains the XOR key information of each network element in the shortest transmission path, and encrypts the data to be encrypted layer by layer according to the order of each network element in the shortest transmission path according to the XOR key information of each network element in the shortest transmission path, and sends the encrypted target data to the second user device.

[0163] The difference between this step and the above step S604 is that this step directly uses the key request sent by the first user equipment to encrypt the data to be encrypted, and directly outputs the encrypted data to the second user equipment. In step S604, it is necessary to obtain the data sent by the last network element in the previous subnet information, and send the encrypted data to the next subnet information.

[0164] S803. If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the current subnet determines the shortest transmission path within the subnet according to the node identifier of the source network element of the current subnet and the node identifier of the destination network element of the current subnet, and sends the shortest transmission path to each network element in the shortest transmission path within the subnet. Each network element in the shortest transmission path within the subnet encrypts and transmits the data in turn, and the destination network element sends the encrypted target data to the second user device.

[0165] The difference between this step and the above step S605 is that this step directly uses the key request sent by the first user equipment to encrypt the data to be encrypted, and directly outputs the encrypted data to the second user equipment. In step S605, it is necessary to obtain the data sent by the last network element in the previous subnet information, and send the encrypted data to the next subnet information.

[0166] In this embodiment, when the destination network element is a network element in the current subnet, the subnet key distribution system of the current subnet determines the transmission mode within the subnet according to the preset service application priority, thereby encrypting the encrypted data based on the centralized transmission mode and the hop-by-hop transmission mode. By judging whether the target network element is the current subnet, if the current subnet only uses the subnet key distribution system, and does not use the wide area key distribution system, thereby saving computing resources and improving key distribution efficiency.

[0167] Fig. 9 FIG. 1 is a flow chart of another key distribution method provided in an embodiment of the present application. Fig. 9 As shown, the user sends a key request to the source key through the first user device, and the source key then sends the key request to the subnet key distribution system of the current subnet. The subnet key distribution system of the current subnet determines whether the destination network element is a network element in the current subnet.

[0168] If so, the transmission mode within the subnet is determined according to the preset service application priority. If the transmission mode within the subnet is a centralized transmission mode, the subnet key distribution system of the current subnet encrypts the data to be encrypted according to the data to be encrypted, the node identifier of the source network element and the node identifier of the destination network element, obtains the encrypted target data, and sends the encrypted target data to the destination network element of the current subnet, so that the destination network element sends the encrypted target data to the second user device. If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the current subnet determines the shortest transmission path within the subnet according to the node identifier of the source network element of the current subnet and the node identifier of the destination network element of the current subnet, and sends the shortest transmission path within the subnet to each network element in the shortest transmission path within the subnet, and each network element in the shortest transmission path within the subnet encrypts and transmits the data to be encrypted in turn, and the destination network element sends the encrypted target data to the second user device.

[0169] If the destination network element is not a network element in the current subnet, the subnet key distribution system of the current subnet sends the key request and the XOR key information of the border network element of the current subnet to the wide area key distribution system, and the subnet key distribution systems of other subnets send the XOR key information of the border network elements of their subnets to the wide area key distribution system. The wide area key distribution system determines the data transmission sequence according to the XOR key information of the boundary network elements of each subnet, the node identifier of the source network element and the node identifier of the destination network element, and sends each relevant subsequence in the data transmission subnet sequence to the target subnet corresponding to each relevant subsequence. The subnet key distribution system of each target subnet determines the transmission mode within the subnet according to the preset service application priority. If the transmission mode within the subnet is a centralized transmission mode, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet according to the node identifier of the starting network element and the node identifier of the ending network element of the target subnet, and encrypts the data sent by the ending network element of the previous subnet layer by layer according to the XOR key information of each network element in the shortest transmission path within the subnet, and sends the encrypted data to the ending network element of the target subnet, and the ending network element sends the encrypted data to the starting network element of the next subnet. The subnet key distribution system of the next subnet continues to encrypt and transmit the encrypted data according to the above method until the data is transmitted to the destination network element, and the destination network element sends the data to the second user equipment. If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet based on the node identifier of the starting network element and the node identifier of the ending network element, and sends the shortest transmission path to the network element in the shortest transmission path within the subnet. Each network element encrypts and transmits the data in turn until the data is transmitted to the destination network element, and the destination network element sends the data to the second user device.

[0170] As an optional implementation, Fig.10 Schematic diagram of a subnet key distribution system provided by an embodiment of the present application. Fig.10 As shown, the subnet key distribution system includes a key management module, a key calculation module and a key storage module.

[0171] Optionally, the key management module includes an interface unit, a network element topology unit, a key lifecycle management unit and a dynamic storage space management unit. The key management module is used to receive or send data and key information, store network element topology information, manage the lifecycle of the key, and dynamically adjust the key storage space of the key storage module.

[0172] The key calculation module includes a key routing calculation unit and a key relay calculation unit, which are respectively used to calculate the shortest transmission path and perform relay calculation on data based on the XOR key.

[0173] The key storage module includes a point data storage unit, an edge data storage unit and a metadata storage unit, which is used to store the XOR key information of each network element in the point data storage unit, the edge data storage unit and the metadata storage unit based on graph theory principles.

[0174] It is worth noting that the structure of the subnet key distribution system is also applicable to the structure of the wide-area key distribution system, that is, the wide-area key distribution system also includes a key management module, a key calculation module and a key storage module.

[0175] Optionally, based on the structure of the subnet key distribution system, the execution process of the subnet key distribution system of the target subnet in the above step S701 determines the shortest transmission path within the subnet according to the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet is as follows.

[0176] Optionally, the interface unit in the key management module in the subnet key distribution system of the target subnet is used to send the received node identifier of the start network element of the target subnet and the node identifier of the end network element of the target subnet to the key calculation module.

[0177] The interface unit in the key management module is used to receive the node identifier of the starting network element and the node identifier of the ending network element of the target subnet, and is also used to receive the first encrypted data.

[0178] Optionally, the key calculation module is used to determine the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet, the node identifier of the ending network element of the target subnet, and the network element topology information.

[0179] Among them, the network element topology unit in the key calculation module is used to store network element topology information, and the network element topology information is used to represent the connection relationship between each network element. It is worth mentioning that the network element topology unit in the key calculation module can calculate the network element topology information based on the point data stored in the point data storage unit in the key storage module and the edge data stored in the edge data storage unit in the key storage module.

[0180] In this embodiment, the node identifier of the starting network element and the node identifier of the ending network element are sent to the key calculation module through the interface unit, and the key calculation module determines the shortest transmission path within the subnet based on the above-mentioned node identifiers and network element topology information, thereby encrypting and transmitting data based on the shortest transmission path within the subnet, thereby improving the key distribution efficiency.

[0181] It is worth noting that if the destination network element is in the current subnet, the method for calculating the shortest path in the subnet is the same as the above method for determining the shortest transmission path in the subnet.

[0182] Based on the structure of the above subnet key distribution system, refer to Fig.11 The subnet key distribution system of the target subnet in the above step S703 encrypts the first encrypted data layer by layer according to the XOR key information of each network element in the shortest transmission path in the subnet and in the order of each network element in the shortest transmission path in the subnet to obtain the specific steps of the second encrypted data are introduced. Fig.11 It is a flowchart diagram of another method for obtaining second encrypted data provided in an embodiment of the present application.

[0183] S1101. The key calculation module in the subnet key distribution system of the target subnet sends a key data request to the key storage module according to the shortest transmission path in the subnet. The key data request includes the node identifier of each network element in the shortest transmission path in the subnet. The key storage module includes a point data storage unit, an edge data storage unit and a metadata storage unit. The key storage module is used to store the XOR key information of each network element in the point data storage unit, the edge data storage unit and the metadata storage unit based on graph theory principles.

[0184] in, Fig.12 Schematic diagram of a key storage module provided in an embodiment of the present application. Fig.12As shown, the key storage module includes a point data storage unit, an edge data storage unit and a metadata storage unit. Among them, the point data storage unit can store the node identifier of the network element, the key management identifier, the current state of the network element, the node type of the network element and the Internet Protocol (IP) address of the network element. The edge data storage unit can store the node identifier of the connection start network element of an edge and the node identifier of the connection end network element, that is, the connection relationship between the connection start network element and the connection end network element, and store the connection state of this edge. Exemplarily, the edge data storage unit stores network element A, network element B and connected, which means that network element A and network element B are in a connected state. Another example is that the edge data storage unit stores network element C, network element F and unconnected, which means that network element C and network element F are in an unconnected state. The metadata storage unit can store the starting key identifier, the intermediate key identifier, the end key identifier, the XOR key length, the XOR key storage offset and the XOR key. The network element indicated by the start key identifier and the network element indicated by the end key identifier are two network elements connected to the intermediate network element, the network element indicated by the intermediate key identifier is the intermediate network element, and the XOR key in the current metadata is the XOR key of the intermediate network element. As an optional implementation, the XOR key of the intermediate network element can be generated by the basic key of the network element indicated by the start key identifier, the basic key of the intermediate network element, and the basic key of the network element indicated by the end key identifier.

[0185] It is worth noting that the data stored in the point data storage unit and the data stored in the edge data storage unit respectively represent V and E in the graph G = (V, E) in the graph theory principle, so that the connection relationship diagram of each network element in the subnet is established through the graph G.

[0186] S1102. The key storage module sends the XOR key of each network element in the shortest transmission path in the subnet to the key calculation module according to the key data request.

[0187] Optionally, the key storage module can determine the XOR key of each network element according to the node identifier of each network element in the shortest transmission path in the subnet in the key data request. Specifically, the XOR key of the network element is obtained from the metadata storage unit according to the node identifier of the network element in the point data storage unit.

[0188] S1103. The key calculation module encrypts the first encrypted data layer by layer according to the XOR key of each network element in the shortest transmission path in the subnet to obtain the second encrypted data.

[0189] Optionally, based on formula (1), the first encrypted data may be encrypted layer by layer according to the XOR key of each network element in the shortest transmission path in the subnet to obtain the second encrypted data.

[0190] In this embodiment, the key calculation module in the subnet key distribution system of the target subnet sends a key data request to the key storage module according to the shortest transmission path in the subnet, wherein the key storage module stores the XOR key information of each network element in the point data storage unit, the edge data storage unit and the metadata storage unit based on the graph theory principle, so that the network element can be quickly located and the XOR key of the network element can be retrieved. Then the key calculation module encrypts the first encrypted data layer by layer according to the XOR key sent by the key storage module, thereby improving the efficiency of key distribution and ensuring the security of key distribution.

[0191] As an optional implementation, Fig.13 Schematic diagram of a key relay timing provided by an embodiment of the present application. Fig.13 As shown, the interface unit in the key management module of the subnet key distribution system of the target subnet sends the node identifier of the starting network element and the node identifier of the ending network element to the key calculation module, the key calculation module determines the shortest transmission path in the subnet according to the node identifier of the starting network element, the node identifier of the ending network element and the network element topology information, and sends a key data request to the key storage module according to the shortest transmission path in the subnet, the key storage module sends the XOR key of each network element in the shortest transmission path in the subnet to the key calculation module according to the key data request, the key calculation module encrypts the first encrypted data layer by layer according to the XOR key of each network element in the shortest transmission path in the subnet, and after sending the first encrypted data to the key management module, the interface unit of the key management module sends the first encrypted data to the ending network element.

[0192] As an optional implementation, Fig.14 is a flow chart of another wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application. Fig.14 As shown, the wide-area quantum key distribution method based on graph theory also includes the following steps.

[0193] S1401. The subnet key distribution system of the target subnet obtains current load information in real time. The current load information is used to indicate the current key demand of the subnet key distribution system of the target subnet.

[0194] The current load information indicates the task intensity of the key distribution task performed by the subnet key distribution system of the current subnet, and can be represented by a number between 0 and 1. The greater the number of key distribution tasks, the greater the current load information.

[0195] It is worth noting that each subnet key distribution system can handle multiple key distribution tasks at the same time.

[0196] S1402: The subnet key distribution system of the target subnet determines a target key storage capacity according to current load information, standard load information and a preset key storage space threshold.

[0197] Optionally, the preset key storage space threshold includes a maximum key storage capacity and a minimum key storage capacity. The maximum key storage capacity is the maximum target key storage capacity that can be set for the current device, and the minimum key storage capacity is the minimum target key storage capacity that can be set for the current device. The standard load information is used as an indicator of the preset reasonable load. When the current load information is greater than the standard load information, the target key storage capacity needs to be reduced. When the current load information is less than the standard load information, the target key storage capacity needs to be increased.

[0198] As an optional implementation, the target key storage capacity may be calculated using formula (2).

[0199]

[0200] Among them, C is the target key storage capacity, Cmin is the minimum key storage space, Cmax is the maximum key storage space, L is the current load information, and θ is the standard load information.

[0201] S1403: The subnet key distribution system of the target subnet dynamically adjusts the storage space of the key storage module in the subnet key distribution system based on the target key storage capacity.

[0202] Specifically, the point data storage unit space, the edge data storage unit space and the metadata storage unit space in the key storage module are dynamically adjusted.

[0203] In this embodiment, by acquiring the current load information in real time, and then determining the target key storage capacity according to the current load information, the standard load information and the preset key storage space threshold, the storage space of the key storage module is dynamically adjusted based on the target key storage capacity, thereby ensuring that each subnet key distribution system can maintain high performance under various load conditions.

[0204] As an optional implementation, Fig.15 This is a flow chart of another wide-area quantum key distribution method based on graph theory provided in an embodiment of the present application. Fig.15 The wide-area quantum key distribution method based on graph theory is introduced.

[0205] S1501. Determine whether the current key storage space in the subnet key distribution system of the target subnet is less than a preset remaining storage space threshold.

[0206] It should be understood that the XOR key information sent by each network element can only be used once. Therefore, when a key distribution task is completed, the XOR key information used is used, so the XOR key stored in the key storage space will become less. When the current key storage space is less than the preset remaining storage space threshold, it is necessary to re-request each network element to send new XOR key information for storage.

[0207] S1502: If yes, a key request message is sent to each network element in the target subnet, so that each network element in the subnet generates XOR key information according to the basic key and the connection relationship with other network elements in the target subnet.

[0208] Optionally, each network element may generate XOR key information based on the basic key and the basic key of the network element connected thereto. In each key distribution task, the basic key of each network element is different in different key distribution processes, so the XOR key information generated based on the basic key is also different.

[0209] S1503: Receive XOR key information sent by each network element in the target subnet, and store the XOR key information of the subnet in the key storage space based on graph theory principles.

[0210] Optionally, the interface unit in the key management module in the subnet key distribution system receives the XOR key information sent by each network element, and stores the XOR key information in the key storage space.

[0211] In this embodiment, it is determined whether the current key storage space in the subnet key distribution system of the target subnet is less than the preset remaining storage space threshold. If so, the new XOR key information sent by each network element in the subnet is received and stored in the key storage space, thereby ensuring that the system can continue to perform key distribution work.

[0212] As an optional implementation, the wide-area quantum key distribution method based on graph theory also includes the following steps, which are introduced below.

[0213] Optionally, the subnet key distribution system of the target subnet determines whether the key needs to be destroyed according to the network element topology information updated in real time.

[0214] Optionally, when a network element fails or experiences an abnormality, the network element sends updated XOR key information to the subnet key distribution system, and the updated XOR key information indicates that the network element is disconnected from all network elements. The subnet key distribution system of the target subnet updates the network element topology information according to the updated XOR key information. If there is a network element in the updated network element topology information that is not connected to any network element, the XOR key information of the network element needs to be destroyed.

[0215] Optionally, if so, the key lifecycle management unit in the subnet key distribution system in the target subnet generates key destruction information, and destroys the corresponding XOR key information in the key storage module according to the key destruction information.

[0216] Specifically, the key lifecycle management unit destroys the point data, edge data and metadata related to the corresponding network element in the key storage module according to the key destruction information.

[0217] In this embodiment, whether the key needs to be destroyed is determined by judging the updated network element topology information. If so, the corresponding XOR key information in the key storage module is destroyed, thereby ensuring that all data stored in the key storage module are valid data, avoiding the use of the network element for data encryption and transmission when an abnormality or failure occurs in the network element, and ensuring the continuity and stability of key distribution.

[0218] The embodiment of the present application also provides a key distribution control system, which includes a wide area key distribution system and multiple subnet key distribution systems, each subnet key distribution system is deployed in a corresponding subnet, each subnet includes at least one network element, and the subnet key distribution system includes a key management module, a key calculation module and a key storage module;

[0219] The key distribution control system is used to distribute keys based on the above-mentioned graph theory-based wide-area quantum key distribution method steps.

[0220] The present application also provides an electronic device, such as Fig.16 As shown, it is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, including: a processor 1601, a memory 1602 and a bus. The memory 1602 stores machine-readable instructions executable by the processor 1601. When the computer device is running, the processor 1601 communicates with the memory 1602 through the bus. When the machine-readable instructions are executed by the processor 1601, the processing of the wide-area quantum key distribution method based on graph theory is performed.

[0221] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned graph-theory-based wide-area quantum key distribution method are executed.

[0222] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0223] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or part of the technical solution that contributes to the prior art or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), disk or optical disk and other media that can store program code.

[0224] The above are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A wide-area quantum key distribution method based on graph theory, characterized in that: The method comprises: The subnet key distribution system of the current subnet receives a key request sent by the first user equipment through a source network element, where the source network element is a network element in the current subnet, and the key request includes data to be encrypted, a node identifier of the source network element, a node identifier of a destination network element, and service information; The subnet key distribution system of the current subnet determines whether the destination network element is a network element in the current subnet; If not, the subnet key distribution system of the current subnet sends the key request and the XOR key information of the border network element of the current subnet to the wide area key distribution system, and the subnet key distribution systems of other subnets send the XOR key information of the border network element of their subnet to the wide area key distribution system; The wide area key distribution system determines a data transmission subnet sequence according to the XOR key information of the boundary network elements of each subnet, the node identifier of the source network element and the node identifier of the destination network element, wherein the data transmission subnet sequence includes a plurality of subnet information arranged in sequence, each subnet information corresponds to a target subnet, each subnet information includes a starting network element and an ending network element when data is transmitted in the target subnet corresponding to the subnet information, and the target subnet corresponding to the first subnet information in the data transmission subnet sequence is the current subnet, and the target subnet corresponding to the last subnet information in the data transmission subnet sequence is the subnet where the destination network element is located; The wide area key distribution system sends each related subsequence in the data transmission subnet sequence to the target subnet corresponding to each related subsequence, and each target subnet encrypts and transmits the data to be encrypted in turn according to the corresponding related subsequence, and sends the encrypted target data to the second user device.

2. The wide-area quantum key distribution method based on graph theory according to claim 1, characterized in that: The wide area key distribution system determines the data transmission subnet sequence according to the XOR key information of the boundary network element of each subnet, the node identifier of the source network element and the node identifier of the destination network element, including: Determine the node connection information between each subnet according to the XOR key information of the boundary network element of each subnet; The data transmission subnet sequence is determined according to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element.

3. The wide-area quantum key distribution method based on graph theory according to claim 2, characterized in that: The determining the data transmission subnet sequence according to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element includes: Determine multiple optional data transmission paths according to the node connection information between the subnets, the node identifier of the source network element and the node identifier of the destination network element, each optional transmission path passes through multiple subnets; Using the shortest path among the multiple optional data transmission paths as the target data transmission path; The starting network element and the ending network element in the subnet passed by the target data transmission path are sequentially used as subnet information in the data transmission subnet sequence.

4. The wide-area quantum key distribution method based on graph theory according to claim 1, characterized in that: The target subnets sequentially encrypt and transmit the data to be encrypted according to the corresponding related subsequences, including: The starting network element of the target subnet receives the first encrypted data sent by the previous last network element, wherein the relevant subsequence corresponding to the target subnet includes: previous subnet information, current subnet information and next subnet information, the current subnet information includes the starting network element of the target subnet and the last network element of the target subnet, wherein the previous last network element is the last network element in the subnet corresponding to the previous subnet information; The starting network element of the target subnet sends the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to the subnet key distribution system of the target subnet; The subnet key distribution system of the target subnet determines the transmission mode within the subnet according to the preset service application priority; If the transmission mode within the subnet is a centralized transmission mode, the subnet key distribution system of the target subnet encrypts the first encrypted data according to the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to obtain second encrypted data, and sends the second encrypted data to the ending network element of the target subnet, and the ending network element of the target subnet sends the second encrypted data to the starting network element in the subnet corresponding to the latter subnet information; If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the target subnet determines the shortest transmission path within the subnet based on the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, and sends the shortest transmission path to each network element in the shortest transmission path within the subnet, and each network element in the shortest transmission path within the subnet performs data encryption and transmission in turn.

5. The wide-area quantum key distribution method based on graph theory according to claim 4 is characterized in that: The subnet key distribution system of the target subnet encrypts the first encrypted data according to the first encrypted data, the node identifier of the starting network element of the target subnet, and the node identifier of the ending network element of the target subnet to obtain second encrypted data, including: The subnet key distribution system of the target subnet determines the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet; The subnet key distribution system of the target subnet obtains the XOR key information of each network element in the shortest transmission path in the subnet; The subnet key distribution system of the target subnet encrypts the first encrypted data layer by layer according to the XOR key information of each network element in the shortest transmission path in the subnet and in the order of each network element in the shortest transmission path in the subnet to obtain the second encrypted data.

6. The graph-theory-based wide-area quantum key distribution method according to claim 4, characterized in that: The data encryption and transmission are performed in sequence by each network element in the shortest transmission path in the subnet, including: The current network element in the shortest transmission path determines the next network element of the current network element according to the shortest transmission path; The current network element encrypts the received current encrypted data to obtain target encrypted data, and sends the target encrypted data to the next network element.

7. The wide-area quantum key distribution method based on graph theory according to claim 1, characterized in that: After the subnet key distribution system of the current subnet determines whether the destination network element is a network element in the current subnet, the method further includes: If the destination network element is a network element in the current subnet, the subnet key distribution system of the current subnet determines the intra-subnet transmission mode according to the preset service application priority; If the intra-subnet transmission mode is a centralized transmission mode, the subnet key distribution system of the current subnet encrypts the data to be encrypted according to the data to be encrypted, the node identifier of the source network element of the current subnet, and the node identifier of the destination network element of the current subnet to obtain encrypted target data, and sends the encrypted target data to the destination network element of the current subnet, so that the destination network element sends the encrypted target data to the second user equipment; If the transmission mode within the subnet is a hop-by-hop transmission mode, the subnet key distribution system of the current subnet determines the shortest transmission path within the subnet based on the node identifier of the source network element of the current subnet and the node identifier of the destination network element of the current subnet, and sends the shortest transmission path within the subnet to each network element in the shortest transmission path within the subnet. Each network element in the shortest transmission path within the subnet encrypts and transmits data in turn, and the destination network element sends the encrypted target data to the second user device.

8. The graph-theory-based wide-area quantum key distribution method according to claim 5, characterized in that: The subnet key distribution system includes a key management module, a key calculation module and a key storage module; The subnet key distribution system of the target subnet determines the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet, including: The interface unit in the key management module of the subnet key distribution system of the target subnet is used to send the received node identifier of the starting network element of the target subnet and the node identifier of the ending network element of the target subnet to the key calculation module; The key calculation module is used to determine the shortest transmission path in the subnet according to the node identifier of the starting network element of the target subnet, the node identifier of the ending network element of the target subnet, and the network element topology information.

9. The graph-theory-based wide-area quantum key distribution method according to claim 8, characterized in that: The subnet key distribution system of the target subnet encrypts the first encrypted data layer by layer according to the XOR key information of each network element in the shortest transmission path in the subnet and in the order of each network element in the shortest transmission path in the subnet to obtain the second encrypted data, including: The key calculation module in the subnet key distribution system of the target subnet sends a key data request to the key storage module according to the shortest transmission path in the subnet, the key data request includes the node identification of each network element in the shortest transmission path in the subnet, the key storage module includes a point data storage unit, an edge data storage unit and a metadata storage unit, and the key storage module is used to store the XOR key information of each network element in the point data storage unit, the edge data storage unit and the metadata storage unit based on the graph theory principle; The key storage module sends the XOR key of each network element in the shortest transmission path in the subnet to the key calculation module according to the key data request; The key calculation module encrypts the first encrypted data layer by layer according to the XOR key of each network element in the shortest transmission path in the subnet to obtain the second encrypted data.

10. The graph-theory-based wide-area quantum key distribution method according to claim 8, characterized in that: The method further comprises: The subnet key distribution system of the target subnet acquires current load information in real time, where the current load information is used to indicate the current key demand of the subnet key distribution system of the target subnet; The subnet key distribution system of the target subnet determines the target key storage capacity according to the current load information, the standard load information and the preset key storage space threshold; The subnet key distribution system of the target subnet dynamically adjusts the storage space of the key storage module in the subnet key distribution system based on the target key storage capacity.

11. The graph-theory-based wide-area quantum key distribution method according to claim 8, characterized in that: The method further comprises: Determine whether the current key storage space in the subnet key distribution system of the target subnet is less than a preset remaining storage space threshold; If yes, a key request message is sent to each network element in the target subnet, so that each network element in the subnet generates XOR key information according to the basic key and the connection relationship with other network elements in the target subnet; The XOR key information sent by each network element in the target subnet is received, and the XOR key information of the subnet is stored in the key storage space based on the graph theory principle.

12. The graph-theory-based wide-area quantum key distribution method according to claim 8, characterized in that: The method further comprises: The subnet key distribution system of the target subnet determines whether the key needs to be destroyed according to the network element topology information updated in real time; If so, the key lifecycle management unit in the subnet key distribution system in the target subnet generates key destruction information, and destroys the corresponding XOR key information in the key storage module according to the key destruction information.

13. A key distribution control system, characterized in that: The key distribution control system includes a wide area key distribution system and multiple subnet key distribution systems, each of the subnet key distribution systems is deployed in a corresponding subnet, each of the subnets includes at least one network element, and the subnet key distribution system includes a key management module, a key calculation module and a key storage module; The key distribution control system is used to distribute keys based on the steps of the graph theory-based wide-area quantum key distribution method as described in any one of claims 1-12.

14. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor executes the machine-readable instructions to perform the steps of the graph-theory-based wide-area quantum key distribution method as described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, executes the steps of the graph-theory-based wide-area quantum key distribution method as described in any one of claims 1 to 12.

Images