Quantum security communication system and communication method

Abstract

The invention provides a quantum security communication system, which comprises a quantum security service platform, a service terminal, a quantum security gateway and a service server, and is characterized in that when the quantum security gateway and the service terminal receive a quantum key, the service terminal and the quantum security gateway call the quantum key to encrypt and decrypt service data; and when the quantum security gateway and / or the quantum security terminal does not receive the quantum key, the quantum security gateway obtains and encrypts the transition key, the service terminal decrypts the encrypted transition key to obtain the transition key, and the service terminal and the quantum security gateway call the transition key to encrypt and decrypt the service data. The preferred encryption mode of the quantum security communication system is the quantum encryption transmission mode, the quantum security gateway and / or the quantum security terminal can enter the transition encryption transmission mode only when the quantum security gateway and / or the quantum security terminal cannot receive the quantum key, and the quantum security gateway and the quantum security terminal are automatically switched to the quantum encryption transmission mode after receiving the quantum key again. Therefore, the security and reliability of communication are improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a quantum secure communication system and communication method. Background Art

[0002] For industries with high communication security requirements such as electricity, when the business terminal on the external network communicates with the business server on the internal network, there is a security risk that the business data may be obtained and cracked. Therefore, the business terminal needs to access the internal network through a security gateway to establish an encrypted channel and encrypt the business data for transmission. The quantum secure communication system can use quantum keys to encrypt the transmission of business data to achieve absolutely secure confidential communication.

[0003] The existing quantum secure communication system will be interrupted when the quantum key channel is destroyed or the quantum key transceiver equipment fails, resulting in low communication reliability. Summary of the invention

[0004] The present application is proposed based on the above-mentioned needs of the prior art. The technical problem to be solved by the present application is to provide a quantum secure communication system and a communication method, which can use transition keys to encrypt business data when the quantum key channel is destroyed or the quantum key transceiver equipment fails, thereby improving the security and reliability of communication.

[0005] In order to solve the above problems, this application provides the following technical solutions.

[0006] The present application proposes a quantum secure communication system, including a quantum secure service platform, a service terminal, and a quantum secure gateway, wherein the quantum secure service platform is responsible for generating and distributing quantum keys; the service terminal is responsible for generating service data; when the quantum secure gateway and the service terminal successfully receive the quantum key, the service terminal and the quantum secure gateway call the quantum key to encrypt and decrypt the service data; when the quantum secure gateway and / or the service terminal do not receive the quantum key, the quantum secure gateway obtains a transition key and encrypts it, and distributes the encrypted transition key to the service terminal; the service terminal obtains the encrypted transition key and obtains the transition key through decryption; the service terminal and the quantum secure gateway call the transition key to encrypt and decrypt the service data.

[0007] Furthermore, the quantum security gateway encrypts the transition key and distributes the encrypted transition key to the service terminal, including: the quantum security gateway calls the quantum key of the current session to encrypt and distribute the transition key; the service terminal calls the quantum key of the current session to decrypt the encrypted transition key to obtain the transition key.

[0008] Furthermore, the transition key is the latest valid quantum key obtained by the quantum security gateway or the key generated by the quantum security gateway through the SM3 algorithm.

[0009] Furthermore, the quantum security gateway uses a symmetric encryption algorithm to encrypt the transition key.

[0010] Furthermore, the quantum security gateway includes a quantum key management module, which is responsible for real-time or periodic monitoring of the quantum security gateway and the service terminal receiving the quantum key during the update period of the session key, and applying for the quantum key from the quantum security service platform in real-time or periodicity.

[0011] Furthermore, the quantum security gateway includes a main control board, a network port, a power supply and a password card, wherein the main control board is responsible for sending, receiving and processing data; the network port is responsible for communicating with the quantum security service platform, the business terminal and the business server; the power supply is responsible for power supply; the password card is responsible for receiving quantum keys and generating transition keys, as well as calling corresponding keys to encrypt and decrypt business data.

[0012] Furthermore, the main control board includes a detection module, which is communicatively connected to the network port and the quantum key management module to monitor the network port receiving the quantum key and feed back the reception status of the quantum key to the quantum key management module.

[0013] Furthermore, the quantum security gateway includes a cryptographic key to verify the identity of the person configuring the quantum security gateway; the number of the power supplies is multiple, and at least one of the power supplies serves as a backup power supply.

[0014] Furthermore, the quantum security gateway also includes a business server, which receives business data decrypted by the quantum security gateway or sends control data to the quantum security gateway.

[0015] The present application also proposes a communication method for a quantum secure communication system, including: establishing an encrypted transmission channel: a service terminal negotiates with a quantum security gateway to establish a channel for encrypting and transmitting service data; applying for a quantum key: the service terminal and the quantum security gateway send a session key application to a quantum security service platform, so that the quantum security service platform generates and distributes a quantum key for the session; switching the encrypted transmission mode: when both the quantum security gateway and the service terminal receive the quantum key for the session, a quantum key encrypted transmission mode is adopted; when the quantum security gateway and / or the service terminal do not receive the quantum key, the quantum key encrypted transmission mode is switched to a transitional key encrypted transmission mode ; The quantum key encryption transmission mode is: when the quantum security gateway and the business terminal receive the quantum key, the business terminal and the quantum security gateway call the quantum key to encrypt and decrypt the business data; the transitional key encryption transmission mode is: when the quantum security gateway and / or the business terminal do not receive the quantum key, the quantum security gateway obtains the transitional key, the quantum security gateway calls the quantum key of the current session to encrypt and distribute the transitional key, and the business terminal calls the quantum key of the current session to decrypt the encrypted transitional key to obtain the transitional key; the business terminal and the quantum security gateway call the transitional key to encrypt and decrypt the business data.

[0016] Furthermore, the quantum security gateway obtains the transition key and encryption method as follows: the latest valid quantum key obtained by the quantum security gateway is used as the transition key or the key generated by the quantum security gateway through the SM3 algorithm is used as the transition key; the quantum security gateway uses a symmetric encryption algorithm to encrypt the transition key.

[0017] Furthermore, the encrypted transmission mode switching includes that within the update period of the quantum key of the session, the quantum security gateway monitors the situation of the quantum security gateway and the service terminal receiving the quantum key in real time or periodically, and applies for the quantum key of the session to the quantum security service platform in real time or periodically. When the quantum security gateway detects that the quantum security gateway and the service terminal have received the quantum key, the quantum security communication system maintains or immediately switches to the quantum key encrypted transmission mode; when the quantum security gateway detects that the quantum security gateway and / or the service terminal have not received the quantum key, the quantum security communication system maintains or immediately switches to the transitional key encrypted transmission mode.

[0018] Furthermore, when the quantum secure communication system is in the quantum encryption transmission mode, and the quantum secure gateway fails to detect that the quantum secure gateway has received the quantum key for three consecutive cycles, the quantum secure communication system immediately switches to the transitional key encryption transmission mode.

[0019] Furthermore, the communication method of the quantum secure communication system also includes an alarm for being unable to enter the quantum key encryption transmission mode: when the quantum security gateway does not detect that the quantum security gateway and the service terminal have received the quantum key, the quantum security gateway sends an alarm message to the quantum security service platform.

[0020] Furthermore, the communication method of the quantum secure communication system also includes plaintext data transmission: the quantum secure gateway sends the decrypted business data to the business server or the business server sends control data to the quantum secure gateway.

[0021] The beneficial effects of this application include:

[0022] (1) When the business terminal and quantum security gateway receive the quantum key, they use the quantum key to encrypt and decrypt the business data, thereby achieving absolutely secure confidential communication and improving the security of communication.

[0023] (2) When the quantum security gateway and / or the service terminal does not receive the quantum key, the quantum security gateway obtains the transition key and encrypts it, and distributes the encrypted transition key to the service terminal. The service terminal obtains the encrypted transition key and obtains the transition key through decryption. The service terminal and the quantum security gateway use the transition key to encrypt and decrypt the service data, so that the quantum security communication system can still work normally when the quantum key channel is destroyed or the quantum key transceiver fails, thereby ensuring that confidential communication is not interrupted and improving the security and reliability of communication.

[0024] (3) The preferred encryption mode of the quantum secure communication system is the quantum encryption transmission mode. The quantum secure communication system will enter the transitional encryption transmission mode only when the quantum secure gateway and / or the service terminal cannot receive the quantum key. When the quantum secure gateway and the service terminal receive the quantum key again, the system will automatically switch from the transitional encryption transmission mode to the quantum encryption transmission mode.

[0025] (4) The quantum security gateway can use a symmetric encryption algorithm to encrypt the transition key. Symmetric encryption has the characteristics of fast encryption and decryption speed, which can further improve the efficiency of encryption and decryption.

[0026] (5) During the update cycle of the session key, the quantum key management module can monitor the reception of the quantum key in real time or periodically, and apply for the quantum key to the quantum security service platform in real time or periodically. When the quantum key management module detects that the quantum security gateway has received the quantum key, it maintains or immediately switches to the quantum encryption transmission mode. When the quantum key management module detects that the quantum security gateway and the service terminal have not received the quantum key, it maintains or immediately switches to the transitional encryption transmission mode, thereby realizing rapid switching of the encryption mode during the update cycle of the session key.

[0027] (6) When the business server generates control data, the quantum security gateway calls the quantum key or transition key to encrypt and decrypt the control data to achieve confidential communication of the control data; the preferred encryption mode for the control data is also the quantum encryption transmission mode, and when the quantum security gateway does not receive the quantum key, it can switch to the transition encryption transmission mode in real time or periodically to improve the security and reliability of communication; it can also monitor the sending and receiving of the quantum key during the update cycle of the session key, thereby achieving rapid switching of the encryption mode. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1 It is a system schematic diagram of the quantum secure communication system in the specific implementation mode of this application.

[0030] Figure 2 It is a flow chart of the quantum key encryption transmission mode for business data in the specific implementation mode of this application.

[0031] Figure 3 It is a flow chart of the transition key encryption transmission mode of business data in the specific implementation mode of this application.

[0032] Figure 4 It is a schematic diagram of the structure and connection relationship of the quantum security gateway in the specific implementation method of this application.

[0033] Figure 5 It is a flowchart of maintaining or switching the encryption mode of the quantum secure communication system during the update period of the session key in the specific implementation mode of the present application.

[0034] Figure 6 It is a schematic diagram of the flow of the quantum key encryption transmission mode for controlling data in the specific implementation mode of this application.

[0035] Figure 7 It is a flow chart of the transition key encryption transmission mode for controlling data in a specific implementation manner of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of this application clearer, the technical solution of this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described implementation is only a part of the implementation of this application, not all implementations. Based on the implementation in this application, all other implementations obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] This specific implementation manner is described by taking power communication as an example.

[0038] Example 1

[0039] like Figure 1 As shown, the quantum secure communication system provided by the present application includes a quantum secure gateway 100, a service terminal 200, a quantum secure service platform 300 and a service server 400.

[0040] The types of business terminals 200 include power station terminals, feeder terminals, etc., which are responsible for collecting business data such as fault inspection and monitoring, and also have functions such as key application, key reception status monitoring, data encryption and decryption, etc.

[0041] The service server 400 is installed in a data center, and can receive service data collected by the service terminal 200 , and can also analyze the operation status of the service terminal 200 based on the service data to generate control data for controlling the service terminal 200 .

[0042] The quantum security gateway 100 is installed in the data center. The quantum security gateway 100 is connected to the business server 400 through the intranet, and the quantum security gateway 100 is connected to the business terminal 200 through the extranet. As the entry device for extranet data, the quantum security gateway 100 needs to negotiate with the business terminal 200 and establish an encrypted channel. The business data is encrypted by the key and transmitted in the encrypted channel, so as to pass through the extranet and reach the quantum security gateway 100. The quantum security gateway 100 can call the key to decrypt the encrypted business data and send the decrypted business data to the business server 400.

[0043] The quantum security service platform 300 is installed in the data center and is used to generate and distribute quantum keys. The business terminal 200 and the quantum security gateway 100 respectively send applications to the quantum security service platform 300 to obtain quantum keys for encrypting and decrypting business data.

[0044] Specifically, the quantum security service platform 300 includes a key generation module, a key operation and maintenance module, a communication module and a power module. Among them, the key generation module is responsible for generating quantum keys; the key operation and maintenance module is responsible for receiving and storing quantum keys, and distributing quantum keys according to requests from the service terminal 200 and the quantum security gateway 100, and is also responsible for analyzing the generation and remaining status of quantum keys; the communication module may include wired network interfaces such as RJ-45 interfaces and SC optical fiber interfaces, and may also include wireless network interfaces, and the communication module is responsible for establishing communication connections with the service terminal 200 and the quantum security gateway 100; the power module is responsible for providing the power required for the operation of the quantum security service platform 300.

[0045] When both the business terminal 200 and the quantum security gateway 100 receive the quantum key, the business terminal 200 and the quantum security gateway 100 use the quantum key to encrypt and decrypt the business data, putting the quantum security communication system in quantum encryption transmission mode, achieving absolutely secure confidential communication.

[0046] When the service terminal 200 and / or the quantum security gateway 100 do not receive the quantum key, the quantum security gateway 100 obtains the transition key and encrypts it, and distributes the encrypted transition key to the service terminal 200. The service terminal 200 obtains the encrypted transition key and obtains the transition key through decryption. The service terminal 200 and the quantum security gateway 100 call the transition key to encrypt and decrypt the service data, so that the quantum security communication system can still work normally when the quantum key channel is destroyed or the quantum key transceiver equipment fails, thereby ensuring that confidential communication is not interrupted and improving the security and reliability of communication.

[0047] In order to ensure the security of communication, the preferred encryption mode of the quantum secure communication system is the quantum encryption transmission mode established based on the quantum key. Only when the quantum secure gateway 100 and / or the service terminal 200 cannot receive the quantum key, the quantum secure communication system will establish a transitional encryption transmission mode based on the transitional key, and when the quantum secure gateway 100 and the service terminal 200 receive the quantum key again, the transitional encryption transmission mode will be automatically switched to the quantum encryption transmission mode.

[0048] The quantum security gateway 100 can use a symmetric encryption algorithm to encrypt the transition key. Symmetric encryption has the characteristics of fast encryption and decryption speed, which can improve the efficiency of encryption and decryption, and at the same time improve the security of the quantum security gateway 100 sending the transition key to the service terminal 200.

[0049] In this specific implementation, the service terminal 200 is connected to the quantum security gateway 100 through an external network, and the service terminal 200 negotiates with the quantum security gateway 100 and establishes an IPSec VPN, which represents a virtual private network based on the Internet security protocol, that is, a private network established on a public external network for encrypted communication, which can encrypt business data while achieving target address conversion and remote access. The quantum security gateway 100 is connected to the quantum security service platform 300 through an intranet, and the service terminal 200 is connected to the quantum security service platform 300 through an external network. The service terminal 200 and the quantum security gateway 100 apply for quantum keys from the quantum security service platform 300 respectively. The quantum security gateway 100 can generate a transition key. Depending on whether the quantum security gateway 100 and the service terminal 200 receive the quantum key, the IPSec VPN can use the quantum key or the transition key as a new session key, thereby establishing two tunnel modes. The two IPSec VPN tunnel modes are respectively used by the service terminal 200 to call the quantum key and the transition key to encrypt the service data. The encrypted service data is transmitted to the quantum security gateway 100 through the IPSec VPN, and the quantum security gateway 100 uses the corresponding key to decrypt the encrypted service data. The service server 400 is connected to the quantum security gateway 100 through the intranet, and the service server 400 receives the service data decrypted by the quantum security gateway 100.

[0050] like Figure 2 As shown, the quantum key encryption transmission mode of business data includes the following steps:

[0051] S11: The service terminal 200 negotiates with the quantum security gateway 100 and establishes an IPSec VPN.

[0052] S12: The business terminal 200 and the quantum security gateway 100 apply for a quantum key from the quantum security service platform 300.

[0053] S13: When the service terminal 200 and the quantum security gateway 100 receive the quantum key, the IPSec VPN uses the quantum key as a session key and establishes a tunnel mode.

[0054] S14: The business terminal 200 uses the quantum key to encrypt the business data and sends the encrypted business data to the quantum security gateway 100.

[0055] S15: The quantum security gateway 100 calls the quantum key to decrypt the encrypted business data, and sends the decrypted business data to the business server 400.

[0056] like Figure 3 As shown, the transition key encryption transmission mode of business data includes the following steps:

[0057] S21: The service terminal 200 negotiates with the quantum security gateway 100 and establishes an IPSec VPN.

[0058] S22: The business terminal 200 and the quantum security gateway 100 apply for a quantum key from the quantum security service platform 300.

[0059] S23: When the quantum security gateway 100 and / or the service terminal 200 does not receive the quantum key, the quantum security gateway 100 obtains the transition key and encrypts it, and distributes the encrypted transition key to the service terminal 200.

[0060] S24: The service terminal 200 obtains the encrypted transition key and obtains the transition key by decryption. The IPSec VPN uses the transition key as a session key and establishes a tunnel mode.

[0061] S25: The business terminal 200 calls the transition key to encrypt the business data, and sends the encrypted business data to the quantum security gateway 100.

[0062] S26: The quantum security gateway 100 calls the transition key to decrypt the encrypted business data, and sends the decrypted business data to the business server 400.

[0063] like Figure 4 As shown, in this specific implementation, the quantum security gateway 100 includes a main control board 101, a network port, a power supply, a USB interface 107, a PCIE interface 109 and a password card 110.

[0064] The main control board 101 may be a CPU, which is responsible for sending, receiving and processing business data, quantum keys, transition keys and other data.

[0065] The network port is set on the main control board 101, and the network port can be a plurality of wired network interfaces or wireless network interfaces, and includes a first network port 102, a second network port 103 and a third network port 104. The first network port 102 is connected to the quantum security service platform 300 by an intranet, and the quantum security gateway 100 sends a key application to the quantum security service platform 300 through the first network port 102, and receives the quantum key through the first network port 102. The second network port 103 is connected to multiple business terminals 200 by an external network, and the quantum security gateway 100 is connected to multiple business terminals 200 through the second network port 103 and establishes an encryption channel, thereby encrypting and transmitting business data; the third network port 104 is connected to the business server 400 by an intranet, and the quantum security gateway 100 is connected to the business server 400 through the third network port 104 to transmit decrypted business data or control data.

[0066] It should be noted that the quantum security gateway 100 can establish an encryption channel by multi-process and multi-thread concurrent processing, and while satisfying the requirement of quickly establishing a large number of encryption channels, increase the number of business terminals 200 accessed by a single quantum security gateway 100. For example, in this embodiment, each quantum security gateway 100 can access three thousand business terminals 200 through the second network port 103, so the data center only needs to set up one quantum security gateway 100, or only set up two quantum security gateways 100, one main and one backup, to achieve encrypted communication with a large number of business terminals 200, thereby reducing the number of quantum security gateways 100 set up in the data center, simplifying the network and security protection configuration between the quantum security gateway 100 and the quantum security service platform 300 and the business server 400, and further improving the security and reliability of communication.

[0067] The PCIE interface 109 is provided on the main control board 101. The types of the PCIE interface 109 include PCIe X8 and PCIe X16. The password card 110 is provided with a plug matching the PCIE interface 109. The password card 110 is inserted into the PCIE interface 109 and communicates with the main control board 101. The password card 110 is compatible with the national encryption SM2, SM3 and SM4 algorithms and can generate transition keys. The transition keys have various forms. For example, the transition key can include the ID and timestamp information of the password card 110. The transition key can also be obtained by generating a random number using a seed key, or by other methods of generating random numbers through an algorithm; the password card 110 can store quantum keys and transition keys to call quantum keys and transition keys to encrypt and decrypt business data.

[0068] The specific working steps of the quantum secure communication system are as follows:

[0069] Establish IPSec VPN: The service terminal 200 is connected to the second network port 103 of the quantum security gateway 100 through a 4G or 5G network communication connection. The service terminal 200 initiates an IKE session with the quantum security gateway 100 to establish a security association (SA), so that the service terminal 200 and the quantum security gateway 100 can perform identity authentication and negotiate encryption algorithms, hash algorithms, authentication methods, etc.

[0070] Applying for quantum keys: The quantum security service platform 300 is connected to the first network port 102 of the quantum security gateway 100 through intranet communication, and the quantum security service platform 300 is connected to the business terminal 200 through 4G or 5G network communication. The business terminal 200 and the quantum security gateway 100 respectively apply for quantum keys from the quantum security service platform 300.

[0071] Generate and distribute keys: In response to the requests of the business terminal 200 and the quantum security gateway 100, the quantum security service platform 300 generates a pair of quantum keys, and the quantum security service platform 300 sends the quantum keys to the business terminal 200 and the quantum security gateway 100.

[0072] Key reception: The quantum key is transmitted to the password card 110 through the intranet and via the first network port 102, the main control board 101 and the PCIE interface 109. The password card 110 receives and stores the quantum key. The quantum key is also transmitted to the business terminal 200 through the external network. The business terminal 200 receives and stores the quantum key.

[0073] Entering quantum encryption transmission mode: the quantum security gateway 100 monitors whether it has received the quantum key through the first network port 102; the service terminal 200 can also monitor whether it has received the quantum key, and feedback the reception of the quantum key to the quantum security gateway 100 through the second network port 103. When the service terminal 200 and the quantum security gateway 100 receive the quantum key, the IPSec VPN uses the quantum key as the session key and establishes a tunnel mode based on the quantum key.

[0074] Entering the transitional encryption transmission mode: When the quantum security gateway 100 receives the quantum key and the service terminal 200 does not receive the quantum key, the quantum security gateway 100 uses the received quantum key as the transitional key, and then calls the quantum key of the current session and uses the symmetric encryption algorithm to encrypt the transitional key. The encrypted transitional key is transmitted to the service terminal 200 through the PCIE interface 109, the main control board 101 and the second network port 103. The service terminal 200 calls the quantum key of the current session and uses the symmetric encryption algorithm to decrypt the encrypted transitional key. IPSec VPN also uses the transition key as the session key and establishes a tunnel mode based on the transition key, wherein the quantum key of the current session is a valid key that is about to expire; and when the quantum security gateway 100 does not receive the quantum key, the service terminal 200 negotiates with the quantum security gateway 100, so that the password card 110 of the quantum security gateway 100 generates a transition key through the SM3 algorithm, and the quantum security gateway 100 calls the quantum key of the current session and uses a symmetric encryption algorithm to encrypt the transition key. The encrypted transition key is transmitted to the service terminal 200 through the PCIE interface 109, the main control board 101 and the second network port 103. The service terminal 200 calls the quantum key of the current session and uses a symmetric encryption algorithm to decrypt the encrypted transition key. The IPSec VPN uses the transition key as the session key and establishes a tunnel mode based on the transition key.

[0075] Business data encryption and transmission: The business terminal 200 calls the quantum key or transition key to encrypt the business data. The encrypted business data enters the IPSec VPN from the business terminal 200 and is transmitted to the password card 110 of the quantum security gateway 100 through the second network port 103, the main control board 101 and the PCIE interface 109 in sequence.

[0076] Decryption and sending plain text: The password card 110 of the quantum security gateway 100 calls the quantum key or transition key to decrypt the encrypted business data. The decrypted business data is sent to the business server 400 through the PCIE interface 109, the main control board 101, and the third network port 104 in sequence.

[0077] The power supply of the quantum security gateway 100 includes a first power supply 105, which is connected to the power supply interface to supply power to the quantum security gateway 100. In order to improve the reliability of the quantum security communication system, the quantum security gateway 100 may include a second power supply 106 as a backup power supply to achieve dual power supply. For example, the first power supply 105 and the second power supply 106 can be connected to the power supply interface at the same time. When one of the power supplies cannot be powered normally due to voltage instability or other reasons, the quantum security gateway 100 is powered by another power supply and continues to work. Alternatively, the second power supply 106 can be a UPS power supply, using the first power supply 105 connected to the power supply interface as the main power supply and the second power supply 106 as the backup power supply. When the first power supply 105 cannot be powered normally, the quantum security gateway 100 can automatically switch to be powered by the second power supply 106 to provide the time required for saving data or restoring power.

[0078] The USB interface 107 is provided on the main control board 101, and the USB interface 107 can be USB2.0 or USB3.0. The password key 108 is provided with a USB plug matching the USB interface 107. When configuring the quantum security gateway 100, the password key 108 needs to be inserted into the USB interface 107 to complete the identity authentication of the system administrator, security administrator or audit administrator, thereby improving the security of communication.

[0079] Example 2

[0080] Embodiment 2 provides another quantum secure communication system and communication method. The difference from Embodiment 1 is that in order to enable the quantum secure communication system to switch encryption modes within the update period of the session key, the quantum secure gateway 100 includes a quantum key management module 111.

[0081] like Figure 4As shown, the quantum key management module 111 is a functional module of the main control board 101 for monitoring the key status. The quantum key management module 111 can monitor the key type received by the quantum security gateway 100 and the service terminal 200 in real time or periodically, as well as the type of key in the password card 110, the key usage, the remaining key amount, the timestamp and other information. The quantum key management module 111 also has the function of executing tasks at a scheduled time, triggering key monitoring tasks, key application tasks and key status reporting tasks in real time or at a predetermined time interval, and controlling the execution of the above tasks through the main control board 101.

[0082] Based on the above functions, the quantum key management module 111 can monitor the quantum security gateway 100 and the service terminal 200 receiving the quantum key in real time or periodically during the update period of the session key, and can also apply for the quantum key from the quantum security service platform 300 in real time or periodically.

[0083] During the update cycle of the session key, if the quantum key management module 111 detects that the quantum security gateway 100 and / or the service terminal 200 have not received the quantum key, the quantum security communication system maintains or immediately switches to the transitional encryption transmission mode, and sends an alarm message to the quantum security service platform 300. The quantum security service platform 300 analyzes the generation and reception of the quantum key based on the alarm message, and reminds the user by sending a text message or a pop-up window, so that the user understands that the quantum security communication system cannot enter the quantum encryption transmission mode, and there is a risk of encrypted business data being cracked. During the update cycle of the session key, if the quantum key management module 111 detects that the quantum security gateway 100 and the service terminal 200 have received the quantum key, the quantum security communication system maintains or immediately switches to the quantum encryption transmission mode to avoid the quantum security communication system being in the transitional encryption transmission mode for a long time, thereby improving the security of communication.

[0084] It should be noted that the time interval predetermined by the quantum key management module 111 is less than the time interval of the session key update period, that is, the monitoring, application and situation reporting of the quantum key in this embodiment are more frequent to meet the needs of the quantum secure communication system to quickly switch the encryption mode. When the time interval predetermined by the quantum key management module 111 reaches the second level, for example, the predetermined time interval is 10 seconds, it can be considered that the quantum key management module 111 can monitor the quantum key reception situation and apply for the quantum key in real time.

[0085] The quantum security gateway 100 can monitor the reception of the quantum key through the first network port 102, and feed back the reception of the quantum key to the quantum key management module 111 through the main control board 101; the business terminal 200 itself can monitor the reception of the quantum key, and the business terminal 200 can feed back the reception of the quantum key to the quantum key management module 111 through the IPSec VPN, the second network port 103 and the main control board 101.

[0086] Since the network port includes multiple types, in some embodiments, the first network port 102 and the second network port 103 do not have the function of monitoring the reception of the quantum key, so the main control board 101 may also include a detection module. The detection module is connected in communication with the network port and the quantum key management module 111 to monitor the network port receiving the quantum key. In this embodiment, the detection module includes a first detection module and a second detection module. The first detection module is connected in communication with the first network port 102 and the quantum key management module 111 to monitor the quantum security gateway 100 receiving the quantum key and feedback to the quantum key management module 111; the second detection module is connected in communication with the second network port 103 and the quantum key management module 111 to monitor the service terminal 200 receiving the quantum key and feedback to the quantum key management module 111.

[0087] like Figure 5 As shown, the main steps for the quantum secure communication system to maintain or switch the encryption mode during the update cycle of the session key include:

[0088] S31: The service terminal 200 negotiates with the quantum security gateway 100 and establishes an IPSec VPN.

[0089] S32: During the update period of the session key, the quantum key management module 111 monitors the reception of the quantum key in real time or periodically, and applies for the quantum key from the quantum security service platform 300 in real time or periodically.

[0090] S33: When the quantum key management module 111 detects that the quantum security gateway 100 and the service terminal 200 have received the quantum key, the IPSec VPN uses the quantum key as a session key and establishes a tunnel mode, and the quantum security communication system maintains or immediately switches to the quantum encryption transmission mode.

[0091] S34: When the quantum key management module 111 does not detect that the quantum security gateway 100 and the service terminal 200 have received the quantum key, the IPSec VPN uses the transition key as the session key and establishes a tunnel mode, and the quantum security communication system maintains or immediately switches to the transition encryption transmission mode.

[0092] Through the above steps, the quantum security gateway 100 can monitor the reception of quantum keys in real time or periodically during the update period of the session key, and apply for quantum keys to the quantum security service platform 300 in real time or periodically, thereby realizing rapid switching of encryption modes during the update period of the session key.

[0093] In this embodiment, when the quantum secure communication system is in the quantum encryption transmission mode, only when the condition "the quantum key management module 111 of the quantum security gateway 100 monitors the reception of the quantum key three times in a row, and the quantum security gateway 100 and the service terminal 200 have not been monitored to receive the quantum key for three times" is met, the quantum security gateway 100 and / or the service terminal 200 are determined to be unable to receive the quantum key, and the quantum security communication system will switch from the quantum encryption transmission mode to the transitional encryption transmission mode. The above method can improve the accuracy of quantum key monitoring, avoid frequent switching of encryption modes due to failure to receive quantum keys in a short period of time, and avoid the situation of being in the transitional encryption transmission mode for a long time, thereby improving the security and reliability of communication.

[0094] In step S34, when the quantum key management module 111 does not detect that the service terminal 200 and the quantum security gateway 100 have received the quantum key, the quantum key management module 111 sends an alarm message to the key operation and maintenance module of the quantum security service platform 300 through the main control board 101. The alarm message includes device identification and key status, etc. The quantum security service platform 300 notifies relevant personnel by pop-up windows, text messages, emails, etc., so that relevant personnel can promptly understand that the quantum security communication system is currently in a transitional encryption transmission mode with security risks. The quantum security service platform 300 can also store the alarm record in the key operation and maintenance module of the quantum security service platform 300 for subsequent query and audit.

[0095] Example 3

[0096] Embodiment 3 provides another quantum secure communication method. The difference from Embodiment 1 and Embodiment 2 is that this embodiment further includes a step of encrypting and transmitting the control data generated by the service server 400.

[0097] like Figure 6 As shown, the quantum key encryption transmission mode of control data includes the following steps:

[0098] S41: The service server 400 generates control data.

[0099] S42: The quantum security gateway 100 receives the control data generated by the business server 400 through the third network port 104, and the quantum security gateway 100 negotiates with the business terminal 200 to establish a channel for encrypting and transmitting the control data.

[0100] S43: The quantum security gateway 100 and the service terminal 200 send an application to the quantum security service platform 300, so that the quantum security service platform 300 generates and distributes quantum keys.

[0101] S44: When the service terminal 200 and the quantum security gateway 100 receive the quantum key, the quantum security communication system uses the quantum key as the session key.

[0102] S45: The service terminal 200 and the quantum security gateway 100 use the quantum key to encrypt and decrypt the control data.

[0103] like Figure 7 As shown, the transition key encryption transmission mode of control data includes the following steps:

[0104] S51: The service server 400 generates control data.

[0105] S52: The quantum security gateway 100 receives the control data generated by the business server 400 through the third network port 104, and the quantum security gateway 100 negotiates with the business terminal 200 to establish a channel for encrypting and transmitting the control data.

[0106] S53: The quantum security gateway 100 and the service terminal 200 send an application to the quantum security service platform 300, so that the quantum security service platform 300 generates and distributes quantum keys.

[0107] S54: When the quantum security gateway 100 and / or the service terminal 200 does not receive the quantum key, the quantum security gateway 100 obtains the transition key and encrypts it, and distributes the encrypted transition key to the service terminal 200.

[0108] S55: The service terminal 200 obtains the encrypted transition key and obtains the transition key through decryption. The quantum secure communication system uses the transition key as the session key.

[0109] S56: The business terminal 200 and the quantum security gateway 100 call the transition key to encrypt and decrypt the control data.

[0110] When the service server 400 generates control data, the quantum security gateway 100 and the service terminal 200 call the quantum key or transition key to encrypt and decrypt the control data to achieve confidential communication of the control data. The preferred encryption mode for the control data is also the quantum encryption transmission mode, and it can switch to the transition encryption transmission mode in real time or periodically when the quantum security gateway 100 does not receive the quantum key, thereby improving the security and reliability of communication. It is also possible to monitor the sending and receiving of the quantum key during the update cycle of the session key, thereby achieving rapid switching of the encryption mode.

[0111] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A quantum secure communication system, characterized in that: It includes quantum security service platform, business terminal and quantum security gateway, among which: The quantum security service platform is responsible for generating and distributing quantum keys; The business terminal is responsible for generating business data; When the quantum security gateway and the service terminal successfully receive the quantum key, the service terminal and the quantum security gateway use the quantum key to encrypt and decrypt the service data; When the quantum security gateway and / or the service terminal does not receive the quantum key, the quantum security gateway obtains the transition key and encrypts it, and distributes the encrypted transition key to the service terminal; the service terminal obtains the encrypted transition key and obtains the transition key by decryption; the service terminal and the quantum security gateway call the transition key to encrypt and decrypt the service data.

2. The quantum secure communication system according to claim 1, characterized in that: The quantum security gateway encrypts the transition key and distributes the encrypted transition key to the service terminal, including: the quantum security gateway calls the quantum key of the current session to encrypt and distribute the transition key; the service terminal calls the quantum key of the current session to decrypt the encrypted transition key to obtain the transition key.

3. The quantum secure communication system according to claim 2, characterized in that: The transition key is the latest valid quantum key obtained by the quantum security gateway or the key generated by the quantum security gateway through the SM3 algorithm.

4. The quantum secure communication system according to claim 3, characterized in that: The quantum security gateway uses a symmetric encryption algorithm to encrypt the transition key.

5. The quantum secure communication system according to claim 4, characterized in that: The quantum security gateway includes a quantum key management module, which is responsible for real-time or periodic monitoring of the quantum security gateway and the service terminal receiving the quantum key during the update period of the session key, and applying for the quantum key from the quantum security service platform in real-time or periodicity.

6. The quantum secure communication system according to claim 5, characterized in that: The quantum security gateway includes a main control board, a network port, a power supply and a password card, wherein: The main control board is responsible for sending, receiving and processing data; The network port is responsible for communicating with the quantum security service platform, the business terminal and the business server; The power supply is responsible for supplying power; The cryptographic card is responsible for receiving quantum keys and generating transition keys, as well as calling corresponding keys to encrypt and decrypt business data.

7. The quantum secure communication system according to claim 6, characterized in that: The main control board includes a detection module, which is communicatively connected with the network port and the quantum key management module to monitor the network port receiving the quantum key and feed back the reception status of the quantum key to the quantum key management module.

8. The quantum secure communication system according to claim 7, characterized in that: The quantum security gateway includes a cryptographic key to verify the identity of a person configuring the quantum security gateway; the number of the power supplies is multiple, and at least one of the power supplies serves as a backup power supply.

9. The quantum secure communication system according to claim 7, characterized in that: It also includes a business server, which receives business data decrypted by the quantum security gateway or sends control data to the quantum security gateway.

10. A communication method of a quantum secure communication system, characterized in that: include: Establishing an encrypted transmission channel: The business terminal negotiates with the quantum security gateway to establish a channel for encrypting and transmitting business data; Applying for quantum key: the service terminal and the quantum security gateway send a session key application to the quantum security service platform, so that the quantum security service platform generates and distributes the quantum key for the session; Encrypted transmission mode switching: when the quantum security gateway and the service terminal both receive the quantum key of the session, the quantum key encrypted transmission mode is adopted; when the quantum security gateway and / or the service terminal do not receive the quantum key, the quantum key encrypted transmission mode is switched to the transitional key encrypted transmission mode; The quantum key encryption transmission mode is: when the quantum security gateway and the service terminal receive the quantum key, the service terminal and the quantum security gateway call the quantum key to encrypt and decrypt the service data; the transitional key encryption transmission mode is: when the quantum security gateway and / or the service terminal do not receive the quantum key, the quantum security gateway obtains the transitional key, the quantum security gateway calls the quantum key of the current session to encrypt and distribute the transitional key, and the service terminal calls the quantum key of the current session to decrypt the encrypted transitional key to obtain the transitional key; the service terminal and the quantum security gateway call the transitional key to encrypt and decrypt the service data.

11. The communication method of the quantum secure communication system according to claim 10, characterized in that: The quantum security gateway obtains the transition key and the encryption method is as follows: the latest valid quantum key obtained by the quantum security gateway is used as the transition key or the key generated by the quantum security gateway through the SM3 algorithm is used as the transition key; the quantum security gateway uses a symmetric encryption algorithm to encrypt the transition key.

12. The communication method of the quantum secure communication system according to claim 10, characterized in that: The encrypted transmission mode switching includes that during the update period of the quantum key of the session, the quantum security gateway monitors the situation of the quantum security gateway and the service terminal receiving the quantum key in real time or periodically, and applies for the quantum key of the session from the quantum security service platform in real time or periodically. When the quantum security gateway monitors that the quantum security gateway and the service terminal receive the quantum key, the quantum security communication system maintains or immediately switches to the quantum key encrypted transmission mode; when the quantum security gateway monitors that the quantum security gateway and / or the service terminal do not receive the quantum key, the quantum security communication system maintains or immediately switches to the transitional key encrypted transmission mode.

13. The communication method of the quantum secure communication system according to claim 12, characterized in that: When the quantum secure communication system is in the quantum encryption transmission mode, and the quantum secure gateway fails to detect that the quantum secure gateway has received the quantum key for three consecutive cycles, the quantum secure communication system immediately switches to the transitional key encryption transmission mode.

14. The communication method of the quantum secure communication system according to claim 13, characterized in that: Also includes: Unable to enter quantum key encryption transmission mode alarm: When the quantum security gateway does not detect that the quantum security gateway and the service terminal have received the quantum key, the quantum security gateway sends an alarm message to the quantum security service platform.

15. The communication method of the quantum secure communication system according to claim 13, characterized in that: It also includes plaintext data transmission: the quantum security gateway sends the decrypted business data to the business server or the business server sends control data to the quantum security gateway.

Images