Direct communication method based on global quantum security network
By introducing a shared key center into the global quantum security network, distributing pairing keys and achieving direct communication, the problems of waiting delay and high bandwidth usage during key relay are solved, and efficient and stable quantum security communication is achieved.
Patent Information
- Application Number
- CN202411306771.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-19
- Publication Date
- 2025-01-24
AI Technical Summary
The existing all-domain quantum secure networks have problems such as waiting delay, decryption failure, high bandwidth usage and inability to meet real-time requirements during key relay.
Distribute pairing keys to quantum security terminals through a pre-assigned shared key center to achieve direct communication, reduce dependence on traditional networks, and reduce bandwidth occupation and resource consumption.
It achieves efficient direct communication between quantum security terminals, reduces waiting time, improves system stability and communication efficiency, and meets real-time requirements.
Smart Images
Figure CN119363326A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of information security and quantum encryption technology, and in particular to a direct communication method based on a global quantum security network. Background Art
[0002] With the rapid development of information technology, communication security has become a core issue in protecting data privacy and integrity. Although traditional encryption methods provide security to a certain extent, their security is facing unprecedented challenges in the face of the potential threat of quantum computing technology. As a cutting-edge technology to meet this challenge, quantum secure communication uses the principles of quantum mechanics, such as the uncertainty principle and quantum entanglement, to achieve information encryption and transmission methods that are theoretically unbreakable, becoming an important development direction for future communication security.
[0003] The proposal of the global quantum secure communication solution aims to build a seamless, highly flexible communication network, so that any quantum secure terminal connected to the network can achieve secure and efficient quantum communication regardless of its geographical location. The core of this solution is to use the access base station as a communication hub to realize key relay between terminals connected to the quantum secure network, that is, the key of the encryption end is relayed through the encryption end access base station to the access base station of the decryption end through the quantum secure network, and then forwarded to the decryption end, so as to ensure that a symmetric quantum secure key is formed between the encryption end and the decryption end, and encryption and decryption communication can be achieved. Then, there may be the following problems with this method:
[0004] 1. On the decryption end, there is a process in which the ciphertext waits for the key or the key waits for the ciphertext. This process will first cause a waiting delay.
[0005] 2. If one party's data, whether it is the key or the ciphertext, is abnormal, decryption will fail. In addition, in the process of quantum secure encrypted communication, a certain bandwidth needs to be reserved for key relay, which not only occupies bandwidth but also occupies terminal processing resources.
[0006] 3. Waiting means timeouts, packet loss, hangs, etc., which require additional resource detection and recovery processing, and also increase the extra burden on the terminal.
[0007] 4. It cannot meet the business operations with particularly high real-time requirements, such as driving navigation, remote surgery, high-precision real-time monitoring, etc.
[0008] Therefore, how to optimize communication efficiency, reduce waiting time and improve system stability while ensuring quantum secure communication has become a technical problem that needs to be solved urgently. Summary of the invention
[0009] The present application provides a direct communication method based on a global quantum security network, which is used to optimize communication efficiency, reduce waiting time and improve system stability while ensuring quantum security communication.
[0010] The present application provides a direct communication method based on a global quantum security network, the method comprising:
[0011] A. Distribute pairing keys for two quantum security terminals that are directly connected in the global quantum security network through a pre-assigned shared key center, including:
[0012] The quantum security terminal sends an encryption key request to the shared key center through the access base station to which it accesses; wherein the encryption key request carries a distribution identifier, a network access identifier of the quantum security terminal, encryption key requirement information, and the central address information of the shared key center, and the distribution identifier is pre-allocated by the shared key center to the two quantum security terminals;
[0013] The shared key center allocates an encryption key to the quantum security terminal based on the received encryption key request, and stores the encryption key, the network access identifier, and the distribution identifier in correspondence; and sends the encryption key to the quantum security terminal through the access base station;
[0014] When the quantum security terminal obtains the encryption key, the key download request is encrypted based on the quantum key in the encryption key; wherein the key download request carries the pairing key requirement information and the distribution identifier; and the encrypted key download request is sent to the shared key center according to the center address information;
[0015] The shared key center decrypts the received encrypted key download request based on the quantum key in the encryption key; obtains the pairing key assigned to the quantum security terminal according to the key download request; and encrypts the pairing key and sends it to the quantum security terminal using the quantum key in the encryption key;
[0016] The quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key;
[0017] B. The two quantum security terminals communicate directly based on the pairing key, including:
[0018] The sending end obtains the target IP address of the receiving end; based on the quantum key in the pairing key and the communication protocol parameters of the sending end, the communication data is encrypted to obtain ciphertext data; and the ciphertext data is sent to the receiving end based on the target IP address through a traditional network;
[0019] The receiving end decrypts the received ciphertext data based on the quantum key in the pairing key and the stored communication protocol parameters to obtain the communication data.
[0020] The beneficial effects of this application are as follows:
[0021] 1. For any quantum security terminal in direct communication, the quantum security terminal can obtain a secure encryption key from the shared key center through a trusted access base station, ensuring the security of the encryption key. Subsequently, the quantum security terminal can use the encryption key to achieve encrypted communication with the shared key center, ensuring the security of the pairing key obtained by the quantum security terminal from the shared key center.
[0022] 2. After obtaining the pairing key, the two quantum security terminals in direct communication can communicate directly based on the pairing key, realizing direct communication based on the global quantum security network, that is, direct quantum secure encrypted communication between two quantum security terminals connected to the global quantum security network, without the need for key relay via an access base station, providing feasibility for high-efficiency and low-latency quantum security communication, reducing bandwidth occupancy and saving communication resources.
[0023] 3. Although the key distribution and encryption process uses advanced quantum technology, this method still relies on traditional networks during the data transmission stage, which reduces the difficulty of direct quantum secure encrypted communication between two quantum secure terminals and enables easy integration into existing communication systems without the need for large-scale modifications to the existing network architecture. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0025] Figure 1 A schematic diagram of a direct communication process based on a global quantum security network provided in an embodiment of the present application;
[0026] Figure 2 A schematic diagram of a specific pairing key acquisition phase flow provided in an embodiment of the present application;
[0027] Figure 3 A schematic diagram of a specific direct communication process provided in an embodiment of the present application;
[0028] Figure 4 A schematic diagram of a specific key supplement process provided for an embodiment of the present application. DETAILED DESCRIPTION
[0029] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.
[0030] The global quantum security network can support secure and efficient quantum communication between any quantum security terminals connected to the network, regardless of their geographical location. A core of the global quantum security network is to use the access base station as a communication hub to connect the quantum security terminal to the global quantum security network, and to achieve key relay between terminals connected to the quantum security network.
[0031] During the access process, when a quantum security terminal accesses an access base station, the access base station will assign a network access identifier to the terminal, that is, a unique terminal identifier of the entire quantum security network, to identify the terminal. The network access identifier carries information about the country, operator, region, cell, access base station, and terminal. With this network access identifier, the terminal can be identified in the global quantum security network through this network access identifier within the time range that the terminal has this identifier. Subsequently, the quantum security terminal can apply for services and request resources from the global quantum security network through the access base station.
[0032] During the key relay process, the encryption end will relay the key through the encryption end access base station through the quantum security network to the access base station of the decryption end, and then the decryption end access base station will forward the key to the decryption end, so as to ensure that a symmetric quantum security key is formed between the encryption end and the decryption end, and encryption and decryption communication can be achieved. The global quantum security network also includes a key center, which mainly distributes keys, i.e. quantum keys, to quantum security terminals connected to the global quantum security network.
[0033] Through this global quantum security network, the key relay process can be separated from the ciphertext transmission process, thereby further improving the security of ciphertext transmission. However, this quantum encryption communication method has the following problems:
[0034] 1. On the decryption end, there is a process in which the ciphertext waits for the key or the key waits for the ciphertext. This process will first cause a waiting delay.
[0035] 2. If one party's data, whether it is the key or the ciphertext, is abnormal, decryption will fail. In addition, in the process of quantum secure encrypted communication, a certain bandwidth needs to be reserved for key relay, which not only occupies bandwidth but also occupies terminal processing resources.
[0036] 3. Waiting means timeouts, packet loss, hangs, etc., which require additional resource detection and recovery processing, and also increase the extra burden on the terminal.
[0037] 4. It cannot meet the business operations with particularly high real-time requirements, such as driving navigation, remote surgery, high-precision real-time monitoring, etc.
[0038] Based on this, the present application provides a direct communication method and system based on a global quantum security network, so that a quantum security terminal connected to the global quantum security network can directly communicate with the quantum security terminal of the other end in some business scenarios with particularly high real-time requirements, thereby ensuring quantum security communication while reducing the waiting time caused by the relay key of the global quantum security network, optimizing communication efficiency and improving system stability.
[0039] Embodiment 1:
[0040] Figure 1 A schematic diagram of a direct communication process based on a global quantum security network provided in an embodiment of the present application, the process includes:
[0041] A. Distribute pairing keys for two quantum security terminals that are directly connected in the global quantum security network through a pre-assigned shared key center, including:
[0042] Step A1: The quantum security terminal sends an encryption key request to the shared key center through the access base station to which it accesses; wherein the encryption key request carries a distribution identifier, the network access identifier of the quantum security terminal, encryption key requirement information and the central address information of the shared key center, and the distribution identifier is pre-allocated by the shared key center to the two quantum security terminals.
[0043] Step A2: The shared key center allocates an encryption key to the quantum security terminal based on the received encryption key request, and stores the encryption key, the network access identifier and the distribution identifier in correspondence; and sends the encryption key to the quantum security terminal through the access base station.
[0044] Step A3: When the quantum security terminal obtains the encryption key, the key download request is encrypted based on the quantum key in the encryption key; wherein the key download request carries the pairing key requirement information and the distribution identifier; and the encrypted key download request is sent to the shared key center according to the center address information.
[0045] Step A4: The shared key center decrypts the received encrypted key download request based on the quantum key in the encryption key; obtains the pairing key allocated to the quantum security terminal according to the key download request; and encrypts the pairing key and sends it to the quantum security terminal through the quantum key in the encryption key.
[0046] Step A5: The quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key.
[0047] In order to ensure that quantum security terminals connected to the global quantum security network can communicate quantum securely through direct connection, in this application, it is necessary to assign pairing keys to the two quantum security terminals so that the two quantum security terminals can communicate quantum securely based on the pairing keys. In the global quantum security network, the key center can distribute keys to quantum security terminals connected to the global quantum security network. Based on this, a key center (referred to as a shared key center) can be assigned to the two quantum security terminals from the global quantum security network, so that pairing keys can be assigned to the two quantum security terminals through the shared key center.
[0048] In a possible implementation, the shared key center may be determined by manual allocation, for example, a network administrator or security expert manually selects and allocates the shared key center according to security policies and requirements.
[0049] In another possible implementation, the shared key center may also be determined by negotiation between the access base stations to which the two quantum security terminals are respectively connected. Exemplarily, a decision may be made based on one or more factors such as the number of routing hops, network load, and key center performance. For example, a key center that simultaneously supports the distribution of keys for the two quantum security terminals is determined as a shared key center. For another example, the two access base stations list a set of key centers to which both parties have established connections, calculate the number of routing hops to each key center in the key center set according to the routing table, and determine the shared key center according to the number of routing hops.
[0050] The shared key center determined based on the above embodiment can generate a distribution identifier for the two quantum security terminals to characterize the direct communication between the two quantum security terminals through the distribution identifier, which serves as a "token" for the subsequent pairing key requests of the two quantum security terminals. The shared key center can then save the distribution identifier and associate the distribution identifier with the network access identifiers of the two quantum security terminals. In this way, when there is a subsequent key distribution request, the corresponding two quantum security terminals can be quickly found through the distribution identifier.
[0051] The distribution identifier may be a complex, unpredictable string or digital sequence, which is intended to ensure uniqueness and security and is not specifically limited here.
[0052] The determined central address information and distribution identifier of the shared key center are saved to the two quantum security terminals, so that the two quantum security terminals can access the shared key center according to the saved distribution identifier and central address information and obtain the pairing key from the shared key center.
[0053] The following is an explanation of the process of any quantum security terminal obtaining a pairing key from the shared key center:
[0054] First, the quantum security terminal needs to request an encryption key from the shared key center to encrypt the distributed pairing key with the encryption key, thereby avoiding the pairing key from being transmitted in plain text in the network. Exemplarily, the quantum security terminal can obtain the encryption key from the shared key center through the access base station it accesses, thereby avoiding the third-party device from eavesdropping on the communication between the quantum security terminal and the shared key center to obtain the encryption key, thereby affecting the security of the subsequent encryption of the pairing key based on the encryption key. Specifically, the quantum security terminal generates an encryption key request, and then sends the encryption key request to the access base station to which the quantum security terminal accesses. Among them, the encryption key request carries a distribution identifier, encryption key requirement information, the network access identifier of the quantum security terminal, and the center address information of the shared key center. The encryption key requirement information is used to guide the shared key center to distribute encryption keys, which includes requirements such as the type, length, and size of the encryption key. After receiving the encryption key request, the access base station can forward the encryption key request to the shared key center according to the center address information. The shared key center receives the encryption key request forwarded by the access base station, and based on the encryption key request, allocates an encryption key to the quantum security terminal, and saves the encryption key, network access identifier and distribution identifier in correspondence.
[0055] In a possible implementation, when the shared key center determines that the distribution identifier is stored and the distribution identifier is associated with the network access identifier, an encryption key is allocated to the quantum security terminal based on the encryption key requirement information.
[0056] After the shared key center obtains the encryption key assigned to the quantum security terminal, it can transmit the encryption key to the access base station so that the encryption key can be sent to the quantum security terminal through the access base station.
[0057] In a possible implementation, since a symmetric key is stored between the quantum security terminal connected to the global quantum security network and the access base station to which it is connected, encrypted communication between the access base station and the quantum security terminal can be achieved through the symmetric key. Based on this, in the present application, after the access base station receives the encryption key sent by the shared key center, it can obtain a key (recorded as a second key) from the symmetric key paired with the quantum security terminal, and encrypt the encryption key based on the second key, thereby avoiding the encryption key from being directly transmitted to the quantum security terminal in plain text, thereby ensuring the security of the encryption key transmission. The quantum security terminal receives the encrypted encryption key and can obtain the second key from the symmetric key paired with the access base station. Based on the second key, the encrypted encryption key is decrypted to obtain the encryption key.
[0058] After the quantum security terminal obtains the encryption key, it can perform encrypted communication with the shared key center based on the encryption key. Exemplarily, the quantum security terminal can generate a key download request based on the pairing key requirement information and the distribution identifier. The key download request is encrypted based on the quantum key in the encryption key. Then, the encrypted key download request is sent to the shared key center according to the center address information.
[0059] In a possible implementation, after the quantum security terminal obtains the encryption key, it can determine whether the encryption key passes the security check. Exemplarily, the security check includes one or more of the following:
[0060] 1. Integrity check
[0061] To ensure that the encryption key is not tampered with or damaged during transmission or storage, in this application, the quantum security terminal can perform an integrity check on the received encryption key. For example, by performing a hash check on the encryption key, it is determined whether the encryption key passes the integrity check. If the encryption key passes the integrity check, the quantum security terminal retains the encryption key; if the encryption key does not pass the integrity check, the quantum security terminal discards the encryption key.
[0062] 2.Consistency check
[0063] To prevent errors or inconsistencies in the encryption key during distribution or storage, the quantum security terminal can also perform consistency checks on the encryption key with the access base station. For example, the quantum security terminal can compare the hash value of the encryption key with the hash value of the encryption key received by the access base station to determine whether the encryption key meets the consistency check. If the encryption key passes the consistency check, the quantum security terminal retains the encryption key; if the encryption key fails the consistency check, the quantum security terminal discards the encryption key.
[0064] It should be noted that the quantum security terminal may perform security verification on the encryption key in one or more of the above-mentioned ways. When the security verification includes the above-mentioned multiple verification methods, that is, the security of the encryption key is ensured by combining integrity verification and consistency verification, the quantum security terminal first ensures that the encryption key has not been tampered with during transmission or storage through integrity verification; then, the consistency verification is used to ensure the consistency between the encryption key and the encryption key generated by the shared key center. If the encryption key passes both of these checks at the same time, it can be considered that the encryption key is safe and reliable and can be used for subsequent encrypted communications. If the encryption key fails any of the checks, then corresponding security measures need to be taken, such as discarding the encryption key, re-requesting the encryption key, or reporting a security incident.
[0065] After receiving the key download request encrypted and sent by the quantum security terminal, the shared key center can obtain the encryption key paired with the quantum security terminal. For example, the encryption key associated with the network access identifier is obtained. Then, based on the encryption key, the encrypted key download request is decrypted to obtain the key download request. Based on the key download request, the pairing key assigned to the quantum security terminal is obtained. For example, the shared key center can determine whether the pairing key associated with the distribution identifier is saved. If the pairing key associated with the distribution identifier is saved, the associated pairing key is used as the pairing key of the quantum security terminal; if the pairing key associated with the distribution identifier is not saved, the pairing key is assigned to the quantum security terminal based on the pairing key requirement information carried in the key download request, and the pairing key is associated with the distribution identifier and saved. After obtaining the pairing key, the shared key center encrypts the pairing key and sends it to the quantum security terminal through the quantum key in the encryption key paired with the quantum security terminal.
[0066] In a possible implementation, after obtaining the key download request, the shared key center can determine whether the distribution identifier associated with the network access identifier is stored according to the network access identifier carried in the encrypted key download request. If it is determined that the distribution identifier associated with the network access identifier is stored, the pairing key allocated to the quantum security terminal is obtained according to the key download request. If it is determined that the distribution identifier associated with the network access identifier is not stored, the key download request is rejected.
[0067] The quantum security terminal receives the encrypted pairing key sent by the shared key center and can decrypt the encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key.
[0068] In a possible implementation, after obtaining the pairing key, the quantum security terminal may also perform security verification on the pairing key. The way in which the quantum security terminal performs security verification on the pairing key may refer to the above-mentioned way of performing security verification on the encryption key, and the details may refer to the above-mentioned embodiment, which will not be described in detail here.
[0069] It should be noted that since a reliable encrypted communication channel has not been established between the quantum security terminal and the quantum security terminal at the other end, the communication between the two quantum security terminals is not absolutely safe and reliable. Based on this, in this application, a shared key center can be introduced as a trusted third party, and the consistency check of the pairing key can be performed between the quantum security terminal and the shared key center, so that the pairing keys between the two quantum security terminals in direct communication are consistent, effectively reducing these security risks.
[0070] In some possible implementations, after the quantum security terminal successfully downloads the paired key, the shared key center records the key download status of the quantum security terminal as "successfully downloaded". For example, "successfully downloaded" is associated with the distribution identifier and the network access identifier of the quantum security terminal.
[0071] In order to determine that the quantum security terminal at the opposite end of the direct communication has also successfully downloaded the pairing key, in this application, the quantum security terminal can generate a query status request based on the distribution identifier and the network access identifier of the quantum security terminal at the opposite end. Then, the query status request is encrypted by the quantum key in the saved encryption key, and the encrypted query status request is sent to the shared key center.
[0072] After receiving the encrypted query status request, the shared key center can use the same quantum key to decrypt the encrypted query status request. Then, the corresponding key distribution record is found based on the distribution identifier carried by the query status request, and the target key download status of the quantum security terminal at the other end is further obtained based on the network access identifier carried by the query status request. The shared key center can encrypt the query status response carrying the target key download status and send it to the quantum security terminal that initiated the request through the quantum key in the encryption key.
[0073] After receiving the encrypted query status response, the quantum security terminal also uses the same quantum key to decrypt the encrypted query status response. According to the decrypted content (i.e., the target key download status), it is determined whether the quantum security terminal on the other end has successfully downloaded the pairing key. If the target key download status indicates that the quantum security terminal on the other end has successfully downloaded the pairing key, then the quantum security terminal can determine that the two parties have the ability to directly connect quantum encryption communication. If the target key download status indicates that the quantum security terminal on the other end has not successfully downloaded the pairing key, the quantum security terminal can choose to repeatedly send the query status request until it is confirmed that the quantum security terminal on the other end has successfully downloaded the pairing key. This repeated query mechanism ensures that the communicating parties can perform encrypted communication when the key is ready.
[0074] B. The two quantum security terminals communicate directly based on the pairing key, including:
[0075] Step B1: The sending end obtains the target IP address of the receiving end; based on the quantum key in the pairing key and the communication protocol parameters of the sending end, the communication data is encrypted to obtain ciphertext data; through the traditional network, based on the target IP address, the ciphertext data is sent to the receiving end.
[0076] Step B2: The receiving end decrypts the received ciphertext data based on the quantum key in the pairing key and the stored communication protocol parameters to obtain the communication data.
[0077] Based on the method of the above embodiment, two quantum security terminals in direct communication can obtain a pairing key, and based on the pairing key, direct quantum security communication can be performed. Exemplarily, when the sender is in direct communication with the receiver and the sender has saved the pairing key, the sender obtains the target IP address of the receiver. Then, based on the quantum key in the pairing key, the communication data to be sent to the receiver is encrypted according to the communication protocol parameters of the sender to obtain ciphertext data. Then, through the traditional network, based on the target IP address, the ciphertext data is sent to the receiver.
[0078] In a possible implementation, the target IP address may be manually configured to the sender, or may be carried in the communication protocol parameters when the sender and the receiver exchange the communication protocol parameters between the two parties, or may be queried by the sender from the shared key center. For example, when the sender sends a query status request to the shared key center, the query status request may carry request information for querying the IP address of the receiver. The shared key center may carry the target IP address of the receiver in the returned query status response.
[0079] When the receiving end receives the ciphertext data sent by the sending end, it can decrypt the ciphertext data based on the quantum key in the paired key corresponding to the sending end and according to the stored communication protocol parameters of the sending end to obtain the communication data.
[0080] The beneficial effects of this application are as follows:
[0081] 1. For any quantum security terminal in direct communication, the quantum security terminal can obtain a secure encryption key from the shared key center through a trusted access base station, ensuring the security of the encryption key. Subsequently, the quantum security terminal can use the encryption key to achieve encrypted communication with the shared key center, ensuring the security of the pairing key obtained by the quantum security terminal from the shared key center.
[0082] 2. After obtaining the pairing key, the two quantum security terminals in direct communication can communicate directly based on the pairing key, realizing direct communication based on the global quantum security network, that is, direct quantum secure encrypted communication between two quantum security terminals connected to the global quantum security network, without the need for key relay via an access base station, providing feasibility for high-efficiency and low-latency quantum security communication, reducing bandwidth occupancy and saving communication resources.
[0083] 3. Although the key distribution and encryption process uses advanced quantum technology, this method still relies on traditional networks during the data transmission stage, which reduces the difficulty of direct quantum secure encrypted communication between two quantum secure terminals and enables easy integration into existing communication systems without the need for large-scale modifications to the existing network architecture.
[0084] Embodiment 2:
[0085] In order to ensure the communication security between the quantum security terminal and the shared key center, based on the above embodiment, in this application, if the quantum security terminal determines that the encryption key meets the preset second supplementary condition, it includes:
[0086] The quantum security terminal sends an encryption key supplement request to the shared key center based on the quantum key in the encryption key; wherein the encryption key supplement request carries the distribution identifier and the encryption key supplement information;
[0087] The shared key center decrypts the encrypted encryption key supplement request based on the quantum key in the encryption key; allocates a supplementary encryption key to the quantum security terminal based on the encryption key supplement request, and associates the supplementary encryption key with the network access identifier and the distribution identifier for storage; and encrypts and distributes the supplementary encryption key to the quantum security terminal based on the quantum key in the encryption key;
[0088] The quantum security terminal receives the encrypted supplementary encryption key; decrypts the encrypted supplementary encryption key based on the quantum key in the encryption key; and supplements the encryption key based on the supplementary encryption key.
[0089] The quantum security terminal will continuously consume the quantum key in the encryption key during the process of encrypted communication with the shared key center. Due to the particularity of the quantum key - its generation and distribution depend on the principles of quantum mechanics, and once used, it cannot be copied or reused, so ensuring the sufficiency and effectiveness of the encryption key is crucial to maintaining communication security. Based on this, in order to cope with the consumption of the quantum key in the encryption key, the quantum security terminal is pre-configured with a supplementary condition for the encryption key (referred to as the first supplementary condition), so that the use of the encryption key can be monitored through the first supplementary condition, and the encryption key can be supplemented in time when the encryption key needs to be supplemented. Among them, the first supplementary condition can be one or more of the following: the size of the quantum key in the encryption key that has been used meets the preset first consumption threshold, the size of the remaining unused quantum key in the encryption key reaches the preset first remaining threshold, and the usage time of the encryption key reaches the preset first duration, which is not specifically limited here. Exemplarily, the quantum security terminal regularly monitors whether the stored encryption key meets the preset first supplementary condition. If it is determined that the saved encryption key does not meet the preset first supplementary condition, the encryption key continues to be monitored; if it is determined that the saved encryption key meets the preset first supplementary condition, the distribution identifier and the encryption key supplementary information are obtained, and an encryption key supplement request is generated according to the distribution identifier and the encryption key supplementary information. Then, based on the quantum key in the encryption key, the encryption key supplement request is encrypted and the encrypted encryption key supplement request is directly sent to the shared key center.
[0090] The shared key center receives the encrypted encryption key supplement request, and decrypts the encrypted encryption key supplement request based on the quantum key in the encryption key that is stored and symmetric to the quantum security terminal. For example, according to the network access identifier carried in the encrypted encryption key supplement request, the encryption key corresponding to the stored network access identifier is determined. According to the quantum key in the encryption key, the encrypted encryption key supplement request is decrypted. Based on the encryption key supplement request, a supplementary encryption key is allocated to the quantum security terminal, and the supplementary encryption key is associated with the network access identifier and the distribution identifier and stored. Based on the quantum key in the encryption key allocated to the quantum security terminal, the supplementary encryption key is encrypted, and then the encrypted supplementary encryption key is distributed to the quantum security terminal.
[0091] In a possible implementation, after the shared key center obtains the encryption key supplement request, it can determine whether the distribution identifier carried by the encryption key supplement request is saved, and whether the saved distribution identifier is associated with the network access identifier of the quantum security terminal. If it is determined that the distribution identifier carried by the encryption key supplement request is saved, and the saved distribution identifier is associated with the network access identifier of the quantum security terminal, the supplementary encryption key is allocated to the quantum security terminal based on the encryption key supplement request.
[0092] The quantum security terminal receives the encrypted supplementary encryption key, decrypts the encrypted supplementary encryption key based on the quantum key in the stored encryption key, and then supplements the encryption key based on the supplementary encryption key.
[0093] In a possible implementation, after the quantum security terminal obtains the supplementary encryption key, it can perform security verification on the supplementary encryption key. The method of performing security verification on the supplementary encryption key can refer to the method of performing security verification on the encryption key in the above embodiment, and will not be described in detail here.
[0094] It should be noted that if the method for performing security verification on the supplementary encryption key includes consistency verification, the quantum security terminal can directly perform consistency verification on the supplementary encryption key with the shared key center.
[0095] In a possible implementation, if the shared key center detects that the quantum security terminal successfully downloads the supplementary encryption key, the shared key center may supplement the encryption key symmetric to the quantum security terminal based on the supplementary encryption key.
[0096] Embodiment 3:
[0097] In order to ensure direct communication, based on the above embodiments, in this application, if the quantum security terminal determines that the pairing key meets the preset second supplementary condition, it includes:
[0098] The quantum security terminal sends a key supplement request to the shared key center in an encrypted manner based on the quantum key in the encryption key; wherein the key supplement request carries the distribution identifier and the pairing key supplement information;
[0099] The shared key center decrypts the encrypted key supplement request based on the quantum key in the encryption key; determines the supplementary pairing key allocated to the quantum security terminal based on the key supplement request; and encrypts and distributes the supplementary pairing key to the quantum security terminal based on the quantum key in the encryption key;
[0100] The quantum security terminal decrypts the encrypted supplementary pairing key based on the quantum key in the encryption key; and supplements the encryption key based on the supplementary pairing key.
[0101] The quantum key in the pairing key will be continuously consumed during the direct communication process. Based on this, in this application, a supplementary condition (referred to as the second supplementary condition) for the pairing key is pre-configured in the quantum security terminal, so that the use of the pairing key can be monitored through the second supplementary condition, and the pairing key can be supplemented in time when the key needs to be supplemented. Among them, the second supplementary condition can be one or more of the following: the size of the quantum key in the pairing key that has been used meets the preset second consumption threshold, the size of the remaining unused quantum key in the pairing key reaches the preset second remaining threshold, and the usage time of the pairing key reaches the preset second time, which is not specifically limited here. Exemplarily, the quantum security terminal regularly monitors whether the stored pairing key meets the preset second supplementary condition. If it is determined that the stored pairing key does not meet the preset second supplementary condition, the pairing key continues to be monitored; if it is determined that the stored pairing key meets the preset second supplementary condition, the distribution identifier and the pairing key supplementary information are obtained, and a key supplement request is generated according to the distribution identifier and the pairing key supplementary information. Then, based on the quantum key in the encryption key, the key supplement request is encrypted, and the encrypted key supplement request is directly sent to the shared key center.
[0102] The shared key center receives the encrypted key supplement request, and decrypts the encrypted key supplement request based on the quantum key in the encryption key that is symmetric to the quantum security terminal. For example, according to the network access identifier carried in the encrypted key supplement request, the encryption key corresponding to the network access identifier is determined. According to the quantum key in the encryption key, the encrypted key supplement request is decrypted. Based on the key supplement request, the supplementary pairing key assigned to the quantum security terminal is obtained. For example, the shared key center can determine whether the supplementary pairing key associated with the distribution identifier is saved. If the supplementary pairing key associated with the distribution identifier is saved, the associated supplementary pairing key is used as the supplementary pairing key of the quantum security terminal; if the supplementary pairing key associated with the distribution identifier is not saved, the supplementary pairing key is assigned to the quantum security terminal based on the pairing key supplementary information carried in the key download request, and the supplementary pairing key is associated with the distribution identifier and saved. Then the shared key center encrypts the supplementary pairing key based on the quantum key in the encryption key assigned to the quantum security terminal, and then distributes the encrypted supplementary pairing key to the quantum security terminal.
[0103] In a possible implementation, after the shared key center obtains the key supplement request, it can determine whether the distribution identifier carried by the key supplement request is saved, and whether the saved distribution identifier is associated with the network access identifier of the quantum security terminal. Only when it is determined that the distribution identifier carried by the key supplement request is saved, and the saved distribution identifier is associated with the network access identifier of the quantum security terminal, is a supplementary pairing key allocated to the quantum security terminal based on the key supplement request.
[0104] The quantum security terminal receives the encrypted supplementary pairing key, decrypts the encrypted supplementary pairing key based on the quantum key in the stored encryption key, and then supplements the pairing key based on the supplementary pairing key.
[0105] In a possible implementation, after the quantum security terminal obtains the supplementary pairing key, it can perform security verification on the supplementary pairing key. The method of performing security verification on the supplementary pairing key can refer to the method of performing security verification on the encryption key in the above embodiment, and will not be described in detail here.
[0106] It should be noted that, since the two quantum security terminals in direct communication already have the capability of direct communication, if the method for performing security verification on the supplementary pairing key includes consistency verification, the quantum security terminal can directly perform consistency verification on the supplementary pairing key with the quantum security terminal of the other end.
[0107] In a possible implementation, if the shared key center detects that the quantum security terminal successfully downloads the supplementary pairing key, the shared key center may supplement the pairing key associated with the distribution identifier based on the supplementary pairing key.
[0108] Embodiment 4:
[0109] The specific direct communication process based on the global quantum security network provided by the present application is described below through a specific embodiment. The process mainly includes three stages, namely, the pairing key acquisition stage, the direct communication stage, and the key supplement stage. The steps included in each stage are described as follows:
[0110] Phase 1: Pairing key acquisition phase.
[0111] Figure 2 A specific flow chart of the pairing key acquisition phase provided in the embodiment of the present application, for two quantum security terminals that need to communicate directly in the global quantum security network, any quantum security terminal obtains the pairing key through the following steps:
[0112] S201: The quantum security terminal sends an encryption key request to an access base station to which the quantum security terminal accesses.
[0113] Among them, the encryption key request carries a distribution identifier, a network access identifier of a quantum security terminal, encryption key requirement information, and central address information of a shared key center. The distribution identifier is pre-allocated by the shared key center to the two quantum security terminals.
[0114] S202: The access base station forwards the encryption key request to the shared key center based on the center address information carried in the encryption key request.
[0115] S203: The shared key center allocates an encryption key to the quantum security terminal based on the received encryption key request, and stores the encryption key, network access identifier, and distribution identifier in correspondence.
[0116] S204: The shared key center sends the encryption key to the access base station.
[0117] S205: The access base station encrypts the encryption key based on the symmetric key paired with the quantum security terminal and sends it to the quantum security terminal.
[0118] S206: When the quantum security terminal obtains the encryption key, it performs an integrity check on the encryption key and performs a consistency check on the encryption key with the access base station.
[0119] S207: When the quantum security terminal determines that the encryption key passes the integrity check and the consistency check, the key download request is encrypting based on the quantum key in the encryption key.
[0120] The key download request carries pairing key requirement information and a distribution identifier.
[0121] S208: The quantum security terminal sends an encrypted key download request to the shared key center according to the center address information.
[0122] S209: The shared key center decrypts the received encrypted key download request based on the quantum key in the encryption key.
[0123] S210: The shared key center obtains the pairing key allocated to the quantum security terminal according to the key download request.
[0124] S211: The shared key center encrypts the pairing key using the quantum key in the encryption key and sends it to the quantum security terminal.
[0125] S212: The quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key, performs an integrity check on the pairing key, and performs a consistency check on the pairing key with the shared key center.
[0126] S213: When it is determined that the paired key passes the integrity check and the consistency check, the shared key center records the key download status of the quantum security terminal as successful download.
[0127] S214: The quantum security terminal encrypts and sends a query status request to the shared key center using the quantum key in the encryption key.
[0128] The query status request carries the distribution identifier and the network access identifier of the quantum security terminal at the other end.
[0129] S215: The shared key center decrypts the received encrypted query status request based on the quantum key in the encryption key, and obtains the target key download status corresponding to the network access identifier based on the distribution identifier.
[0130] S216: The shared key center encrypts the query status response carrying the target key download status and sends it to the quantum security terminal based on the quantum key in the encryption key.
[0131] S217: The quantum security terminal decrypts the received encrypted query status response based on the quantum key in the encryption key, and determines whether the target key download status represents that the quantum security terminal with the network access identification has successfully downloaded the paired key. If so, execute S218, otherwise, execute S214.
[0132] S218: The quantum security terminal determines that the quantum security terminal and the quantum security terminal with the network access identification have direct quantum encryption communication capabilities.
[0133] It should be noted that when the quantum security terminal determines that the quantum security terminal and the quantum security terminal of the network access identifier have the capability of direct quantum encryption communication, the quantum security terminal can directly communicate with the quantum security terminal of the network access identifier based on the pairing key, that is, enter stage two.
[0134] Phase 2: Direct communication phase.
[0135] Figure 3 A schematic diagram of a specific direct communication process provided in an embodiment of the present application, the process includes:
[0136] S301: The sender obtains the target IP address of the receiver.
[0137] The target IP address is obtained in the following manner: from the communication protocol parameters of the stored receiving end, or by querying the target IP address of the receiving end from the shared key center.
[0138] S302: The sender encrypts the communication data based on the quantum key in the pairing key and the communication protocol parameters of the sender to obtain ciphertext data.
[0139] S303: The sender sends the encrypted data to the receiver based on the target IP address through the traditional network.
[0140] S304: The receiving end decrypts the received ciphertext data based on the quantum key in the pairing key and the stored communication protocol parameters to obtain the communication data.
[0141] Phase three: key supplement phase.
[0142] During the execution of phase 2, the encryption key and pairing key will be continuously consumed. Therefore, two quantum security terminals in direct communication can execute phase 3 while executing phase 2. The following is an explanation of the execution process of one of the quantum security terminals:
[0143] Figure 4 A schematic diagram of a specific key supplement process provided in an embodiment of the present application, the process includes:
[0144] S401: The quantum security terminal determines whether the encryption key meets the preset first supplementary condition. If so, execute S402; otherwise, execute S401.
[0145] Among them, the first supplementary condition can be one or more of the following: the size of the used quantum key in the encryption key meets the preset first consumption threshold, the size of the remaining unused quantum key in the encryption key reaches the preset first remaining threshold, and the usage time of the encryption key reaches the preset first time, which is not specifically limited here.
[0146] S402: The quantum security terminal sends an encrypted encryption key supplement request to the shared key center based on the quantum key in the encryption key.
[0147] The encryption key supplement request carries a distribution identifier and encryption key supplement information.
[0148] S403: The shared key center decrypts the encrypted encryption key supplement request based on the quantum key in the encryption key; based on the encryption key supplement request, allocates a supplementary encryption key to the quantum security terminal, and associates the supplementary encryption key with the network access identifier and the distribution identifier for storage.
[0149] S404: The shared key center encrypts and distributes the supplementary encryption key to the quantum security terminal based on the quantum key in the encryption key.
[0150] S405: The quantum security terminal decrypts the received encrypted supplementary encryption key based on the quantum key in the encryption key, performs an integrity check on the supplementary encryption key, and performs a consistency check on the supplementary encryption key with the shared key center.
[0151] S406: When the quantum security terminal determines that the supplementary encryption key passes the integrity check and the consistency check, the encryption key is supplemented based on the supplementary encryption key.
[0152] S407: When the shared key center determines that the quantum security terminal has successfully downloaded the supplementary encryption key, the shared key center supplements the encryption key allocated to the quantum security terminal according to the supplementary encryption key.
[0153] S408: The quantum security terminal determines whether the pairing key meets the preset second supplementary condition. If so, execute S409; otherwise, execute S408.
[0154] Among them, the second supplementary condition can be one or more of the following: the size of the used quantum key in the pairing key meets the preset second consumption threshold, the size of the remaining unused quantum key in the pairing key reaches the preset second remaining threshold, and the usage time of the pairing key reaches the preset second time, which is not specifically limited here.
[0155] S409: The quantum security terminal sends an encrypted key supplement request to the shared key center based on the quantum key in the encryption key.
[0156] The key supplement request carries a distribution identifier and pairing key supplement information.
[0157] S410: The shared key center decrypts the encrypted key supplement request based on the quantum key in the encryption key; and obtains the supplementary pairing key allocated to the quantum security terminal based on the key supplement request.
[0158] S411: The shared key center encrypts and distributes the supplementary pairing key to the quantum security terminal based on the quantum key in the encryption key.
[0159] S412: The quantum security terminal decrypts the received encrypted supplementary pairing key based on the quantum key in the encryption key, performs an integrity check on the supplementary pairing key, and performs a consistency check on the supplementary pairing key with the quantum security terminal at the other end.
[0160] S413: When the quantum security terminal determines that the supplementary pairing key passes the integrity check and the consistency check, the pairing key is supplemented based on the supplementary pairing key.
[0161] It should be noted that the above steps S401 to S407 and S408 to S413 may be performed simultaneously or sequentially.
Claims
1. A direct communication method based on a global quantum security network, characterized in that: The method comprises: A. Distribute pairing keys for two quantum security terminals that are directly connected in the global quantum security network through a pre-assigned shared key center, including: The quantum security terminal sends an encryption key request to the shared key center through the access base station to which it accesses; wherein the encryption key request carries a distribution identifier, a network access identifier of the quantum security terminal, encryption key requirement information, and the central address information of the shared key center, and the distribution identifier is pre-allocated by the shared key center to the two quantum security terminals; The shared key center allocates an encryption key to the quantum security terminal based on the received encryption key request, and stores the encryption key, the network access identifier, and the distribution identifier in correspondence; and sends the encryption key to the quantum security terminal through the access base station; When the quantum security terminal obtains the encryption key, the key download request is encrypted based on the quantum key in the encryption key; wherein the key download request carries the pairing key requirement information and the distribution identifier; and the encrypted key download request is sent to the shared key center according to the center address information; The shared key center decrypts the received encrypted key download request based on the quantum key in the encryption key; obtains the pairing key assigned to the quantum security terminal according to the key download request; and encrypts the pairing key and sends it to the quantum security terminal using the quantum key in the encryption key; The quantum security terminal decrypts the received encrypted pairing key based on the quantum key in the encryption key to obtain the pairing key; B. The two quantum security terminals communicate directly based on the pairing key, including: The sending end obtains the target IP address of the receiving end; based on the quantum key in the pairing key and the communication protocol parameters of the sending end, the communication data is encrypted to obtain ciphertext data; and the ciphertext data is sent to the receiving end based on the target IP address through a traditional network; The receiving end decrypts the received ciphertext data based on the quantum key in the pairing key and the stored communication protocol parameters to obtain the communication data.
2. The method according to claim 1, characterized in that After distributing pairing keys to two quantum security terminals in direct communication through a pre-assigned shared key center, and before the two quantum security terminals perform direct communication based on the pairing keys, the method further includes: The shared key center and the quantum security terminal determine that the pairing key passes a consistency check.
3. The method according to claim 2, characterized in that The method further comprises: The shared key center records the key download status of the quantum security terminal as successful download; The quantum security terminal encrypts and sends a query status request to the shared key center through the quantum key in the encryption key; wherein the query status request carries the distribution identifier and the network access identifier of the quantum security terminal of the other end; The shared key center decrypts the received encrypted query status request based on the quantum key in the encryption key; obtains the target key download status corresponding to the network access identifier based on the distribution identifier; and encrypts the query status response carrying the target key download status and sends it to the quantum security terminal based on the quantum key in the encryption key; The quantum security terminal decrypts the received encrypted query status response based on the quantum key in the encryption key; if it is determined that the target key download status represents that the quantum security terminal of the network access identifier has successfully downloaded the pairing key, it is determined that the quantum security terminal and the quantum security terminal of the network access identifier have direct quantum encryption communication capabilities; if it is determined that the target key download status represents that the quantum security terminal of the network access identifier has not successfully downloaded the pairing key, the query status request is repeatedly sent to the shared key center in encrypted form until it is determined that the quantum security terminal and the quantum security terminal of the network access identifier have direct quantum encryption communication capabilities.
4. The method according to claim 3, characterized in that The target IP address is obtained in the following way: Acquire from the stored communication protocol parameters of the receiving end; or The target IP address of the receiving end is queried from the shared key center.
5. The method according to claim 1, characterized in that If the quantum security terminal determines that the encryption key satisfies a preset first supplementary condition, it includes: The quantum security terminal sends an encryption key supplement request to the shared key center based on the quantum key in the encryption key; wherein the encryption key supplement request carries the distribution identifier and the encryption key supplement information; The shared key center decrypts the encrypted encryption key supplement request based on the quantum key in the encryption key; allocates a supplementary encryption key to the quantum security terminal based on the encryption key supplement request, and associates the supplementary encryption key with the network access identifier and the distribution identifier for storage; and encrypts and distributes the supplementary encryption key to the quantum security terminal based on the quantum key in the encryption key; The quantum security terminal receives the encrypted supplementary encryption key; decrypts the encrypted supplementary encryption key based on the quantum key in the encryption key; and supplements the encryption key based on the supplementary encryption key.
6. The method according to claim 5, characterized in that The method further comprises: If the shared key center determines that the quantum security terminal successfully downloads the supplementary encryption key, the encryption key stored and allocated to the quantum security terminal is supplemented according to the supplementary encryption key.
7. The method according to claim 1, characterized in that If the quantum security terminal determines that the paired key meets a preset second supplementary condition, it includes: The quantum security terminal sends a key supplement request to the shared key center in an encrypted manner based on the quantum key in the encryption key; wherein the key supplement request carries the distribution identifier and the pairing key supplement information; The shared key center decrypts the encrypted key supplement request based on the quantum key in the encryption key; determines the supplementary pairing key allocated to the quantum security terminal based on the key supplement request; and encrypts and distributes the supplementary pairing key to the quantum security terminal based on the quantum key in the encryption key; The quantum security terminal decrypts the encrypted supplementary pairing key based on the quantum key in the encryption key; and supplements the encryption key based on the supplementary pairing key.
8. The method according to claim 7, characterized in that After the quantum security terminal obtains the supplementary pairing key and before supplementing the encryption key based on the supplementary pairing key, the method further includes: The quantum security terminal and the quantum security terminal at the opposite end determine that the supplementary pairing key passes a consistency check.