Transformer area safety communication and key updating method based on quantum communication

Abstract

The invention relates to a zone area safety communication and key updating method based on quantum communication. The method comprises the following steps: S1, a quantum key management platform charges a quantum protection key Kc and a certificate to a main control board of edge equipment; s2, the end device S performs identity authentication on the main control board of the side device C; s3, the main control board of the side equipment C performs identity authentication on the end equipment S; s4, the side equipment C generates a session key Kh and sends the session key Kh to the end equipment; s5, encryption and decryption of downlink data; s6, encryption and decryption of uplink data; and S7, updating the session key. The security, efficiency and reliability of data transmission are improved.

Description

Technical Field

[0001] The present invention relates to communication technology, and more specifically, to a method for secure communication and key updating in a quantum communication-based area, aiming to improve the security, efficiency and reliability of data transmission. Background Art

[0002] With the rapid development of information technology, communication security has become an urgent problem to be solved. Traditional encryption methods such as RSA and AES are powerless in the face of the potential threat of quantum computers. Quantum communication technology, with its unique non-cloning, unpredictability and high security, provides a new solution for communication security. Especially in regional communications, higher requirements are placed on key distribution and data encryption. Summary of the invention

[0003] The present invention aims to solve the problems of low efficiency of regional key distribution and insufficient data encryption security in the prior art, and to provide a regional secure communication and key update method based on quantum communication.

[0004] In order to achieve the above object, the present invention provides a method for secure communication and key update in a quantum communication-based area, comprising:

[0005] A method for secure communication and key updating in a station area based on quantum communication, comprising:

[0006] Step S1: The quantum key management platform injects the quantum protection key Kc and certificate into the main control board of the edge device, and the quantum key management platform injects the quantum protection key Ks and certificate into the end device; the quantum key management platform generates a quantum key and certificate, transmits the protection key Kc and certificate to the local communication warehouse of the edge device through offline injection, and transmits the protection key Ks and certificate to the end device;

[0007] Step S2: The end device S performs identity authentication on the main control board of the edge device C;

[0008] Step S3: The main control board of the edge device C performs identity authentication on the end device S;

[0009] Step S4: The edge device C generates a session key Kh and sends it to the end device;

[0010] Step S5: encryption and decryption of downlink data;

[0011] Step S6: encryption and decryption of uplink data;

[0012] Step S7: Session key update.

[0013] Preferably, step S2 further comprises:

[0014] The end device S sends its network access certificate to the local communication warehouse of the edge device C, and the local communication warehouse of the edge device C sends the network access certificate to the main control board of the edge device. The main control board of the edge device C authenticates its certificate and sends the authentication result to the end device S through the local communication warehouse of the edge device. Preferably, step S3 further includes:

[0015] The main control board of the edge device C sends its network access certificate to the end device S through the local communication warehouse of the edge device. The end device S authenticates its certificate and sends the authentication result to the main control board of the edge device C through the local communication warehouse of the edge device;

[0016] After the step S2 and the step S3, an authenticated communication connection is established between the main control board of the edge device C and the end device S through the local communication compartment of the edge device.

[0017] Preferably, step S4 further comprises:

[0018] Step S4.1: the end device S transmits the dispersion factor to the local communication warehouse of the edge device C through the established channel;

[0019] Step S4.2: the local communication bin of the edge device C sends the dispersion factor to the main control board;

[0020] Step S4.3: The main control board of the edge device C calculates the protection key Ks of the end device using the quantum protection key Kc and the dispersion factor;

[0021] Step S4.4: randomly generate a set of session keys Kh according to the key composition requirements;

[0022] Step S4.5: Encrypt the session key Kh using the protection key Ks to obtain the encrypted session key Ks(Kh), and send it to the local communication warehouse of the edge device C;

[0023] Step S4.6: Through the established channel, the local communication compartment of the edge device C transmits the encrypted session key Ks (Kh) to the end device S;

[0024] Step S4.7: The terminal device S receives the encrypted session key Ks(Kh), decrypts it, and obtains the session key Kh.

[0025] Preferably, step S5 further comprises:

[0026] Step S5.1: The main control board of edge device C sends a downlink plaintext data Data to the local communication compartment of the edge device C;

[0027] Step S5.2: The local communication compartment of the edge device C encrypts the downlink plaintext data Data with the session key Kh;

[0028] Step S5.3: The terminal device decrypts the encrypted data Kh(Data) to obtain the downlink plaintext data Data.

[0029] Preferably, step S6 further comprises:

[0030] Step S6.1: The end device S encrypts the uplink plaintext data Data with the session key Kh and sends it to the local communication warehouse of the edge device C;

[0031] Step S6.2: The local communication compartment of edge device C sends the encrypted data to the main control board;

[0032] Step S6.3: Use the session key Kh to decrypt the encrypted data Kh(Data) to obtain the uplink plaintext data Data.

[0033] Preferably, step S7 further comprises:

[0034] The end device S makes a request to update the session key to the edge device C. The main control board of the edge device C regenerates a new set of session keys Kh', encrypts the new session keys Kh' with the session key Kh, and transmits the new session keys Kh' to the end device through the local communication warehouse of the edge device. The end device uses the session key Kh to decrypt the encrypted data Kh(Kh') to obtain the new session key Kh'.

[0035] The quantum key management platform generates two sets of associated quantum keys of length N, denoted as U and V, where U = [u1,u2,…,u N ],V=[v1,v2,…,v N ];

[0036] Randomly generate a set of keys of length 2N [r1, r2, …, r N ,r N+1 ,r N+2 ,…,r 2N ], the first half is inserted into U, and the second half is inserted into V, thus obtaining the protection keys Ks and Kc of length 2N;

[0037] Ks=[u1,r1,u2,r2,…,u N ,r N ],Kc=[v1,r N+1 ,v2,r N+2 ,…,v N ,r 2N ];

[0038] The key generated above is distributed to the end device S and the edge device C by offline charging.

[0039] Preferably, the method for updating the session key includes:

[0040] The session key Kh is generated by the edge device C, encrypted using the protection Ks and transmitted to the end device, and used as the decryption key of the end device S;

[0041] The session key Kh is a set of encryption keys, consisting of Q strings of length P, denoted as

[0042]

[0043] The session key is updated by a periodic update mechanism or an on-demand update mechanism.

[0044] Preferably, the regular update mechanism includes:

[0045] When the amount of encrypted output data reaches the threshold F_data, or the session key usage time reaches T_limit, the end device S sends a key update request to the edge device C. The edge device C uses a quantum random number generation chip to regenerate the session key and encrypts it for transmission to the end device S.

[0046] Preferably, the on-demand update mechanism includes:

[0047] Assume that the transmitted data is Data, the encryption key is Kh, and the edge device C transmits the encrypted data Kh(Data) to the end device S;

[0048] The end device S calculates the hash value Hd by the unique identification codes of the two communicating devices and the transmitted data, where the unique identification codes of the two communicating devices are denoted as As for the end device and Ac for the edge device;

[0049] As=[s1,s2,…,s M ],Ac=[c1,c2,…,c M ];

[0050] Hash value Hd = H({Data, As, Ac}), where H(·) is the hash value calculation function;

[0051] The edge device C transmits the encrypted hash value Kh(Hd) to the end device S;

[0052] After receiving the encrypted data Kh(Data) and hash value Kh(Hd), the end device S decrypts them to obtain the data Data' and hash value Hd';

[0053] According to the unique identification code of the data generator and itself, the hash value calculation function H(·) is used to calculate the hash value Hd'=H({Data',As,Ac}) of the currently received data.

[0054] If Hd' is consistent with Hd, it means that the current communication is secure;

[0055] If they are inconsistent, it means that there may be risks in the communication process. A resending signal is sent, and the edge device resends the data Kh (Data) and hash value Kh (Hd). If the hash value of the end device S is verified, communication continues. If the verification fails, a signal to change the key is sent.

[0056] Preferably, the method for generating the update key includes:

[0057] In the station area, each device has a unique identification code, and the terminal device structure dispersion factor is as follows:

[0058] Re-obtain the unique identification code of the device and the device to be communicated in the system, record the end device as As and the side device as Ac;

[0059] As=[s1,s2,…,s M ],Ac=[c1,c2,…,c M ];

[0060] For the end device As, use the quantum key U to encrypt (As, Ac) to form a new encryption sequence [s'1, s'2, ..., s' M ,c'1,c'2,…,c' M ];

[0061] According to the quantum key U, the quantum key V is determined and used to generate the random sequence [r1, r2, …, r N ] to encrypt, and get [r'1,r'2,…,r' N ];

[0062] The sequence [s'1,s'2,…,s' M ,c'1,c'2,…,c' M ,r'1,r'2,…,r' N ] is transmitted to the edge device C through the established channel, and the edge device C parses the above data.

[0063] Preferably, the specific calculation method of the session key Ks further includes:

[0064] The edge device C regenerates a set of session keys

[0065] Reassemble the Q row keys;

[0066] Kh' is written

[0067] Where K' i =[k' i1 k' i2 … k' iP ],i=1,2,…,Q;

[0068] The edge device C injects quantum protection key V=[v1,v2,…,v N ], reorder Kh';

[0069] Select Z groups of data from V in order, each group of data has a length of G, Z <Q,

[0070] {v1,v2,…,v G}、{v G+1 ,v G+2 ,…,v 2G}, …, {v ZG-G+1 ,v ZG-G+2 ,...,v ZG},

[0071] If ZG>N, then loop to select the value of the protection key, that is, select the value of the protection key. N Then, select v1;

[0072] Taking K'1 as an example, the new position of K'1 is ind = mod(val({v1,v2,…,v G}),Q),

[0073] Where val() is the calculation sequence {v1,v2,...,v G}, mod() is the remainder function, that is, {v1,v2, ... ,v G} is divided by the remainder of Q, and the remainder is the new position of K'1;

[0074] Note that if the remainder is 0, the position is not changed. In addition, if the calculated new position has been used before, the position is not changed. The positions of the other Z-1 keys are calculated in the same way, and we get

[0075]

[0076] Preferably, the specific calculation method of the session key Ks further includes a decryption and restoration step of the session key Kh', which is as follows:

[0077] Kh(Kh'*) is transmitted to the end device, and the end device S decrypts it to obtain Kh'*, according to its own quantum key U = [u1,u2,…,uN ] calculate the edge device V = [v1,v2,…,v N ], select Z groups of data {v1,v2,…,v G}、{v G+1 ,v G+2 ,…,v 2G}, …, {v ZG-G+1 ,v ZG-G+2 ,…,v ZG}, by performing the reverse operation according to the steps of recombining the Q row keys, Kh' can be obtained, thereby completing the key update.

[0078] Compared with the prior art, the present invention has the following beneficial effects:

[0079] 1) Key updates are based on periodic mechanisms and on-demand update mechanisms, ensuring the security of data transmission while guaranteeing the cost-effectiveness of communications.

[0080] 2) When updating the key during communication transmission, the quantum key sequence is changed to ensure the security of the key. The quantum key is only stored by the communicating parties, which can effectively prevent leakage.

[0081] 3) By verifying the communication data, risks in the communication can be discovered in time and the key can be replaced in time. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 This is a security protection solution for low-voltage distribution business in an area based on quantum encryption according to the present invention.

[0083] Figure 2 This is a flow chart of edge-to-end quantum key session key distribution and business data transmission protection of the present invention. DETAILED DESCRIPTION

[0084] The present invention is further described in detail below in conjunction with the accompanying drawings:

[0085] In order to better understand the present invention, the embodiments of the present invention are explained in detail below with reference to the accompanying drawings.

[0086] The present invention provides embodiment 1 which discloses the relevant structure of the quantum encryption device of the present invention.

[0087] Embodiment 1 discloses a quantum encryption communication system structure.

[0088] The present invention relies on quantum key technology, integrates quantum security chips in the main control board of edge devices such as power distribution terminals and fusion terminals, integrates security chips (when the equipment is an internal asset) or external security modules (when the equipment is an external asset) in end devices such as smart circuit breakers, photovoltaic grid-connected circuit breakers, and LTUs, and builds an edge-to-end quantum security encryption channel. The specific implementation ideas are as follows.

[0089] The structure of the low-voltage distribution business security protection solution based on quantum encryption is as follows: Figure 1 As shown:

[0090] The encrypted communication system includes edge nodes and end nodes, and realizes encrypted communication between the edge nodes and the end nodes by adding a security chip in an embedded or external security module manner.

[0091] The side of the substation distribution network is generally a distribution terminal. A security chip with a built-in quantum random number generator is deployed in the local communication warehouse of the edge device, and the quantum session key is encrypted and issued using a quantum protection key.

[0092] In particular, the security chip of the quantum random number generator can be a quantum random number generator or a quantum random number chip or other devices or means that can generate true random numbers.

[0093] The end side of the distribution network in the substation area is mainly the power consumption (generation) node equipment in the power grid, and a security chip is embedded in the end device or a security module with an external integrated security chip is installed.

[0094] The security chip on the terminal side is mainly embedded in the terminal device and integrated with the device, which is called the embedded mode of secure communication; it can also be used for external terminal devices; the security module provides security services to the terminal device through hardware modification, such as embedding the tail module, external security isolation device, etc., which is called the external mode of secure communication.

[0095] The end-side device protects the transmission of edge-to-end business data through quantum key encryption.

[0096] Another aspect of the present invention discloses the composition of encrypted communication system equipment.

[0097] In the process of implementing quantum encryption communication in the distribution network of the substation, the following equipment is involved:

[0098] (1) The key management platform is used to generate and issue the initial protection key and certificate of the communication "edge-to-end". It is the basic platform for the communication key management of the distribution network in the substation area. In quantum encryption secure communication, the protection key and certificate are generally charged offline.

[0099] (2) Edge devices mainly include security chips and local communication bins. The device main control board is a device for information generation, processing and execution, and the local communication bin is an encrypted secure communication device. The main control board and the local communication bin constitute the secure communication and information processing control node of the edge device. The security chip is integrated in the main control board.

[0100] (3) End equipment, including end equipment functional system and encryption security communication module. The end equipment functional system mainly refers to the corresponding facilities and equipment of the distribution network terminal, such as various types of power consumption devices, power grid safety protection devices, etc. The security communication module is the main carrier for realizing quantum encryption security communication.

[0101] The protection keys between edge and end are uniformly generated and issued by the key management platform. The session keys between edge and end are generated by the quantum random numbers built into the edge security chip and issued to the end device. The edge device is responsible for the maintenance and management of the session keys of the end device.

[0102] The second embodiment of the present invention discloses the process of implementing encrypted communication of the present invention, as shown in the attached Figure 2 shown.

[0103] The edge device is denoted as C and the end device is denoted as S. The method for implementing quantum encryption secure communication between devices C and S is described as follows:

[0104] It can be understood that the edge device includes a main control board, a local communication compartment and a security chip.

[0105] Step S1: The quantum key management platform injects the quantum protection key Kc and certificate into the main control board of the edge device, and the quantum key management platform injects the quantum protection key Ks and certificate into the end device;

[0106] The key management platform generates quantum keys and certificates, transmits the protection key Kc and certificate to the local communication warehouse of the edge device through offline charging, and transmits the protection key Ks and certificate to the end device. The function of charging the protection key Kc is placed on the main control board of the edge device.

[0107] Step S2: The end device S performs identity authentication on the main control board in the edge device C.

[0108] The end device S sends its network access certificate to the local communication warehouse of the edge device C. The local communication warehouse of the edge device C sends the network access certificate to the main control board of the edge device. The main control board of the edge device C authenticates its certificate and sends the authentication result to the end device S through the local communication warehouse of the edge device.

[0109] Step S3: The main control board of edge device C performs identity authentication on end device S.

[0110] The main control board of edge device C sends its network access certificate to end device S through the local communication warehouse of the edge device. End device S authenticates its certificate and sends the authentication result to the main control board of edge device C through the local communication warehouse of the edge device.

[0111] After steps S2 and S3, an authenticated communication connection is established between the main control board of the edge device C and the end device S.

[0112] Step S4: The edge device C generates a session key Kh and sends it to the end device.

[0113] Step S4.1: The end device S transmits the dispersion factor to the local communication bin of the edge device C through the established channel.

[0114] Step S4.2: The local communication bin of edge device C sends the dispersion factor to the main control board.

[0115] Step S4.3: The main control board of edge device C uses the quantum protection key Kc and the dispersion factor to calculate the protection key Ks of the end device.

[0116] Step S4.3: Randomly generate a set of session keys Kh according to the key composition requirements.

[0117] Step S4.4: Use the protection key Ks to encrypt the session key Kh, obtain the encrypted session key Ks(Kh), and send it to the local communication warehouse.

[0118] Step S4.5: Through the established channel, the local communication warehouse of the edge device C transmits the encrypted session key Ks (Kh) to the end device S.

[0119] Step S4.6: The end device S receives the encrypted session key Ks(Kh), decrypts it, and obtains the session key Kh.

[0120] Step S5: Encryption and decryption of downlink data.

[0121] Step S5.1: The main control board of edge device C sends a downlink plaintext data Data to the local communication warehouse;

[0122] Step S5.2: The local communication compartment of edge device C encrypts the downlink plaintext data Data with the session key Kh;

[0123] Step S5.3: The terminal device S decrypts the encrypted data Kh(Data) to obtain the downlink plaintext data Data.

[0124] Step S6: Encryption and decryption of uplink data.

[0125] Step S6.1: The end device S encrypts the uplink plaintext data Data with the session key Kh and sends it to the local communication warehouse of the edge device C;

[0126] Step S6.2: The local communication compartment of edge device C sends the encrypted data to the main control board;

[0127] Step S6.3: Use the session key Kh to decrypt the encrypted data Kh(Data) to obtain the uplink plaintext data Data.

[0128] Step S7: Key update.

[0129] To ensure communication security, the session key needs to be updated regularly. The end device S makes a request to the edge device C to update the session key. The main control board of the edge device C regenerates a new set of session keys Kh', and encrypts the new session key Kh' with the current session key Kh and transmits it to the end device S through the local communication warehouse of the edge device. The end device S uses the current session key Kh to decrypt the encrypted data Kh (Kh') to obtain the new session key Kh'.

[0130] Specifically, a method for calculating a session key Ks is also provided in Embodiment 3 of the present invention.

[0131] The quantum key management platform generates two sets of associated quantum keys of length N, denoted as U and V, where U = [u1,u2,…,u N ],V=[v1,v2,…,v N ], in order to ensure key security, improve the efficiency of quantum key use and enhance economic efficiency, the following methods are used

[0132] Randomly generate a set of keys of length 2N [r1, r2, …, r N ,r N+1 ,r N+2 ,…,r 2N ], the first half of the interval is inserted into U, and the second half of the interval is inserted into V, thus obtaining the protection keys KS and Kc of length 2N.

[0133] Ks=[u1,r1,u2,r2,…,u N ,r N ],Kc=[v1,r N+1 ,v2,r N+2 ,…,v N ,r 2N ]

[0134] The key generated above is distributed to the end device S and the variable device C by offline charging.

[0135] Specifically, the present invention also provides a session key updating method.

[0136] The session key Kh is generated by the edge device C, encrypted using the protection Ks and transmitted to the end device, and used as the decryption key of the end device S.

[0137] Usually the session key Kh is a set of encryption keys, including Q strings of length P, denoted as

[0138]

[0139] There are two mechanisms for updating the session key. One is a periodic update mechanism. After the current key Kh is used for a certain period of time, the edge device C regenerates a set of keys. The other is that during the communication process, if the information verification fails, there is data loss or tampering, the end device applies to regenerate the session key Kh'. The specific method is as follows:

[0140] Mechanism 1: Regular updates

[0141] When the amount of encrypted output data reaches the threshold F_data, or the session key usage time reaches T_limit, the end device S sends a key update request to the edge device C. The edge device uses the quantum random number generation chip to regenerate the session key and encrypts it for transmission to the end device S.

[0142] Mechanism 2: Update on demand.

[0143] Assume that the transmitted data is Data, the encryption key is Kh, and the edge device C transmits the encrypted data Kh(Data) to the end device S. In addition, the end device calculates the hash value Hd with the unique identification code of the communicating devices and the transmitted data, where the unique identification code of the communicating devices is As for the end device and Ac for the edge device.

[0144] As=[s1,s2,…,s M ],Ac=[c1,c2,…,c M ]. The hash value Hd is calculated as follows:

[0145] Hd=H({Data,As,Ac})

[0146] Where H(·) is the hash value calculation function.

[0147] Then, the edge device C transmits the encrypted hash value Kh(Hd) to the end device S.

[0148] After receiving the encrypted data Kh(Data) and hash value Kh(Hd), the end device S decrypts the data to obtain the data Data' and hash value Hd'. Then, based on the unique identifier of the data generator and itself, the hash value calculation function H(·) is used to calculate the hash value of the currently received data.

[0149] Hd'=H({Data',As,Ac}),

[0150] If Hd' is consistent with Hd, it means that the current communication is safe. If they are inconsistent, it means that there may be risks in the communication process. A resend signal is sent, and the edge device resends the data Kh (Data) and hash value Kh (Hd). If the hash value of the end device S is verified, the communication continues. If the verification fails, a signal for changing the key is sent.

[0151] The above process is also applicable to the case where the end device S sends data to the edge device C. If the edge device finds that the obtained data is inconsistent with the hash value verification, it sends a retransmission signal. If the verification still fails, the key is replaced.

[0152] The invention also provides a method for generating an update key.

[0153] Edge device C regenerates a set of session keys Since the previous session key Kh is used for encrypted transmission, the following method is adopted to improve data security.

[0154] Reassemble the Q row keys.

[0155] Kh' can be written as

[0156]

[0157] Where K' i =[k' i1 k' i2 … k' iP ],i=1,2,…,Q.

[0158] The edge device C injects quantum protection key V=[v1,v2,…,v N ], reorder Kh'. Select Z groups of data from V in order, each group of data has a length of G, Z <Q。{v1,v2,…,v G}、{v G+1 ,v G+2 ,…,v 2G}, …, {v ZG-G+1 ,v ZG-G+2 ,…,v ZG If ZG>N, the protection key value is selected cyclically, that is, the selection is complete. N Then, select v1.

[0159] Taking K'1 as an example, the new position of K'1 is:

[0160] ind=mod(val({v1,v2,…,vG}),Q),

[0161] Where val() is the calculation sequence {v1,v2,…,v G}, mod() is the remainder function, that is, {v1,v2,…,v G} divided by Q. The remainder is the new position of K'1.

[0162] Note that if the remainder is 0, the position is not changed. In addition, if the calculated new position has been used before, the position is not changed. The positions of the other Z-1 keys are calculated in the same way, and we get

[0163]

[0164] The session key Kh' is decrypted and restored.

[0165] Kh(Kh'*) is transmitted to the end device, which decrypts it to obtain Kh'*, and then uses its own quantum key U = [u1,u2,…,u N ] calculate the edge device V = [v1,v2,…,v N ], then select Z groups of data {v1,v2,…,v G}、{v G+1 ,v G+2 ,…,v 2G}, …, {v ZG-G+1 ,v ZG-G+2 ,…,v ZG}, according to the reverse operation of the above steps, Kh' can be obtained, thereby completing the key update.

[0166] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "connected" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0167] In the description of the present invention, unless otherwise specified, the terms "upper", "lower", "left", "right", "inside", "outside", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they cannot be understood as limitations on the present invention.

[0168] Finally, it should be explained that the above technical solution is only one implementation method of the present invention. For those skilled in the art, it is easy to make various types of improvements or modifications based on the application methods and principles disclosed in the present invention, and it is not limited to the method described in the above specific implementation method of the present invention. Therefore, the method described above is only preferred and does not have a restrictive meaning.

Claims

1. A method for secure communication and key update in a quantum communication-based area, characterized in that: Step S1: The quantum key management platform injects the quantum protection key Kc and the certificate into the main control board of the edge device, and the quantum key management platform injects the quantum protection key Ks and the certificate into the end device; The quantum key management platform generates quantum keys and certificates, transmits the protection key Kc and certificate to the local communication warehouse of the edge device through offline filling, and transmits the protection key Ks and certificate to the end device; Step S2: The end device S performs identity authentication on the main control board of the edge device C; Step S3: The main control board of the edge device C performs identity authentication on the end device S; Step S4: The edge device C generates a session key Kh and sends it to the end device; Step S5: encryption and decryption of downlink data; Step S6: encryption and decryption of uplink data; Step S7: Session key update.

2. The method according to claim 1, characterized in that: The step S2 further comprises: The end device S sends its network access certificate to the local communication warehouse of the edge device C. The local communication warehouse of the edge device C sends the network access certificate to the main control board of the edge device. The main control board of the edge device C authenticates its certificate and sends the authentication result to the end device S through the local communication warehouse of the edge device.

3. The method according to claim 2, characterized in that The step S3 further comprises: The main control board of the edge device C sends its network access certificate to the end device S through the local communication warehouse of the edge device. The end device S authenticates its certificate and sends the authentication result to the main control board of the edge device C through the local communication warehouse of the edge device; After the step S2 and the step S3, an authenticated communication connection is established between the main control board of the edge device C and the end device S through the local communication compartment of the edge device.

4. The method according to claim 3, characterized in that The step S4 further comprises: Step S4.1: the end device S transmits the dispersion factor to the local communication warehouse of the edge device C through the established channel; Step S4.2: the local communication bin of the edge device C sends the dispersion factor to the main control board; Step S4.3: The main control board of the edge device C calculates the protection key Ks of the end device using the quantum protection key Kc and the dispersion factor; Step S4.4: randomly generate a set of session keys Kh according to the key composition requirements; Step S4.5: Encrypt the session key Kh using the protection key Ks to obtain the encrypted session key Ks(Kh), and send it to the local communication warehouse of the edge device C; Step S4.6: Through the established channel, the local communication compartment of the edge device C transmits the encrypted session key Ks (Kh) to the end device S; Step S4.7: The terminal device S receives the encrypted session key Ks(Kh), decrypts it, and obtains the session key Kh.

5. The method according to claim 4, characterized in that The step S5 further comprises: Step S5.1: the main control board of the edge device C sends a downlink plaintext data Data to the local communication compartment of the edge device C; Step S5.2: The local communication compartment of the edge device C encrypts the downlink plaintext data Data with the session key Kh; Step S5.3: The terminal device decrypts the encrypted data Kh(Data) to obtain downlink plaintext data Data.

6. The method according to claim 5, characterized in that The step S6 further comprises: Step S6.1: The end device S encrypts the uplink plaintext data Data with the session key Kh and sends it to the local communication warehouse of the edge device C; Step S6.2: The local communication compartment of the edge device C sends the encrypted data to the main control board; Step S6.3: Use the session key Kh to decrypt the encrypted data Kh(Data) to obtain the uplink plaintext data Data.

7. The method according to claim 6, characterized in that The step S7 further comprises: The end device S makes a request to update the session key to the edge device C. The main control board of the edge device C regenerates a new set of session keys Kh', encrypts the new session key Kh' by the session key Kh, and transmits it to the end device through the local communication warehouse of the edge device. The end device uses the session key Kh to decrypt the encrypted data Kh (Kh') to obtain the new session key Kh'; the quantum key management platform generates two sets of associated quantum keys of length N, denoted as U and V, where U = [u1, u2, ..., u N ],V=[v1,v2,…,v N ]; Randomly generate a set of keys of length 2N [r1, r2, …, r N ,r N+1 ,r N+2 ,…,r 2N ], the first half is inserted into U, and the second half is inserted into V, thus obtaining the protection keys Ks and Kc of length 2N; Ks=[u1,r1,u2,r2,…,u N ,r N ],Kc=[v1,r N+1 ,v2,r N+2 ,…,v N ,r 2N ]; The key generated above is distributed to the end device S and the edge device C in an offline charging manner.

8. The method according to claim 7, characterized in that The method for updating the session key includes: The session key Kh is generated by the edge device C, encrypted using the protection Ks and transmitted to the end device, and used as the decryption key of the end device S; The session key Kh is a set of encryption keys, including Q strings of length P, denoted as The session key is updated by a periodic update mechanism or an on-demand update mechanism.

9. The method according to claim 8, characterized in that The periodic update mechanism includes: When the amount of encrypted output data reaches the threshold F_data, or the session key usage time reaches T_limit, the end device S sends a key update request to the edge device C. The edge device C uses a quantum random number generation chip to regenerate the session key and encrypts it for transmission to the end device S.

10. The method according to claim 8, characterized in that The on-demand update mechanism includes: Assume that the transmitted data is Data, and the encryption key is Kh, the edge device C transmits the encrypted data Kh(Data) to the end device S; The end device S calculates the hash value Hd of the unique identification codes of the two communicating devices and the transmission data, where the unique identification codes of the two communicating devices are denoted as As for the end device and Ac for the edge device; As=[s1,s2,…,s M ],Ac=[c1,c2,…,c M ]; Hash value Hd = H({Data, As, Ac}), where H(·) is the hash value calculation function; The edge device C transmits the encrypted hash value Kh(Hd) to the end device S; After receiving the encrypted data Kh(Data) and the hash value Kh(Hd), the terminal device S decrypts the data to obtain the data Data' and the hash value Hd'; According to the unique identification code of the data generator and itself, the hash value calculation function H(·) is used to calculate the hash value Hd'=H({Data',As,Ac}) of the currently received data. If Hd' is consistent with Hd, it means that the current communication is secure; If they are inconsistent, it means that there may be risks in the communication process. A resending signal is sent, and the edge device resends the data Kh (Data) and hash value Kh (Hd). If the hash value of the end device S is verified, communication continues. If the verification fails, a signal to change the key is sent.

11. The method according to claim 9 or 10, characterized in that The method for generating an update key includes: in a station area, each device has a unique identification code, and the terminal device constructs a dispersion factor as follows: Re-obtain the unique identification code of the device and the device to be communicated in the system, record the end device as As and the side device as Ac; As=[s1,s2,…,s M ],Ac=[c1,c2,…,c M ]; For the end device As, use the quantum key U to encrypt (As, Ac) to form a new encryption sequence [s'1, s'2, ..., s' M ,c'1,c'2,…,c' M ]; According to the quantum key U, the quantum key V is determined and used to generate the random sequence [r1, r2, …, r N ] to encrypt, and get [r'1,r'2,…,r' N ]; The sequence [s'1,s'2,…,s' M ,c'1,c'2,…,c' M ,r'1,r'2,…,r' N ] is transmitted to the edge device C through the established channel, and the edge device C parses the above data.

12. The method according to claim 11, characterized in that The specific calculation method of the session key Ks further includes: The edge device C regenerates a set of session keys Reassemble the Q row keys; Kh' is written Where K' i =[k' i1 k' i2 … k' iP ],i=1,2,…,Q; The edge device C is configured to inject quantum protection key V=[v1,v2,…,v N ], reorder Kh'; Select Z groups of data from V in order, each group of data has a length of G, Z <Q, {v1,v2,…,v G }、{v G+1 ,v G+2 ,…,v 2G },…,{v ZG-G+1 ,v ZG-G+2 ,…,v ZG }, If ZG>N, then loop to select the value of the protection key, that is, select the value of the protection key. N Then, select v1; Taking K'1 as an example, the new position of K'1 is ind = mod(val({v1,v2,…,v G }),Q), Where val() is the calculation sequence {v1,v2,…,v G }, mod() is the remainder function, that is, {v1,v2,…,v G } is divided by the remainder of Q, and the remainder is the new position of K'1; Note that if the remainder is 0, the position will not be changed; In addition, if the calculated new position has been used before, the position will not be changed; The positions of the other Z-1 keys are calculated in the same way, and we get 13. The method according to claim 12, characterized in that The specific calculation method of the session key Ks further includes a decryption and restoration step of the session key Kh', which is as follows: Kh(Kh'*) is transmitted to the end device, and the end device S decrypts it to obtain Kh'*, according to its own quantum key U = [u1,u2,…,u N ] calculate the edge device V = [v1,v2,…,v N ], select Z groups of data {v1,v2,…,v G }、{v G+1 ,v G+2 ,…,v 2G }, …, {v ZG-G+1 ,v ZG-G+2 ,…,v ZG }, by performing the reverse operation according to the steps of recombining the Q row keys, Kh' can be obtained, thereby completing the key update.

Images