Quantum security communication system and method

Abstract

The invention provides a quantum security communication system, which comprises a quantum security service platform, a service terminal, a quantum security gateway and a service server, and is characterized in that the quantum security service platform is responsible for generating and distributing quantum keys, the service terminal is responsible for collecting service data, and the quantum security gateway is responsible for negotiating with the service terminal and establishing an encryption channel; when both the service terminal and the quantum security gateway receive the quantum key, the quantum security communication system enters a quantum encryption mode, otherwise, the quantum security gateway generates a classical key, the system enters the classical encryption mode, the quantum security gateway calls the corresponding key to decrypt encrypted service data, and the service terminal and the quantum security gateway send the decrypted service data to the quantum security gateway. And the business server is responsible for receiving the decrypted business data. According to the quantum secure communication system and method provided by the invention, the preferred encryption mode is the quantum encryption mode, and when the quantum encryption mode cannot be entered, the classical encryption mode can be automatically switched, so that secure communication is not interrupted, and the security and reliability of communication are improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a quantum secure communication system and method. Background Art

[0002] For industries with high communication security requirements such as electricity, when the business terminal on the external network communicates with the business server on the internal network, there is a security risk that the business data may be obtained and cracked. Therefore, the business terminal needs to access the internal network through a security gateway to establish an encrypted channel and encrypt the business data for transmission. The quantum secure communication system can use quantum keys to encrypt the transmission of business data to achieve absolutely secure confidential communication.

[0003] The existing quantum secure communication system will be interrupted when the quantum key channel is destroyed or the quantum key transceiver equipment fails, resulting in low communication reliability. Summary of the invention

[0004] The present application is proposed based on the above-mentioned needs of the prior art. The technical problem to be solved by the present application is to provide a quantum secure communication system and method, which can use classical keys to encrypt business data when the quantum key channel is destroyed or the quantum key transceiver equipment fails, thereby improving the security and reliability of communication.

[0005] In order to solve the above problems, this application provides the following technical solutions.

[0006] The present application proposes a quantum security communication system, including a quantum security service platform, a business terminal, a quantum security gateway and a business server, wherein the quantum security service platform is responsible for generating quantum keys and distributing quantum keys to the quantum security gateway and the business terminal; the business terminal is responsible for collecting business data; the quantum security gateway is responsible for negotiating with the business terminal and establishing an encryption channel. When the quantum security gateway and the business terminal both receive the quantum key, the business terminal calls the quantum key to encrypt and transmit the business data, and the quantum security gateway calls the quantum key to decrypt the encrypted business data; the quantum security gateway is also responsible for generating classical keys. When the quantum security gateway or the business terminal does not receive the quantum key, the business terminal calls the classical key to encrypt and transmit the business data, and the quantum security gateway calls the classical key to decrypt the encrypted business data; the business server is responsible for receiving the business data decrypted by the quantum security gateway.

[0007] Furthermore, the quantum security gateway includes a main control board, a network port, a power supply and a password card, among which the main control board is responsible for sending, receiving and processing data; the network port is responsible for communicating with the quantum security service platform, business terminals and business servers; the power supply is responsible for power supply; the password card is responsible for receiving quantum keys and generating classical keys, as well as calling the corresponding keys to encrypt and decrypt business data.

[0008] Furthermore, the quantum security gateway also includes a quantum key management module, which monitors the quantum security gateway and the service terminal receiving the quantum key in real time or periodically, and applies for the quantum key to the quantum security service platform in real time or periodically.

[0009] Furthermore, the main control board includes a detection module, which is communicatively connected to the network port and the quantum key management module to monitor the network port receiving the quantum key and feed back the reception status of the quantum key to the quantum key management module.

[0010] Furthermore, the quantum security gateway includes a cryptographic key to verify the identity of the person configuring the quantum security gateway.

[0011] Furthermore, there are multiple power supplies, and at least one power supply serves as a backup power supply.

[0012] Furthermore, the backup power supply is a UPS power supply.

[0013] The present application also proposes a communication method using the above-mentioned quantum secure communication system, including: establishing an encryption channel: the business terminal negotiates with the quantum security gateway to establish a channel for encrypting and transmitting business data; applying for a quantum key: the business terminal and the quantum security gateway send an application to the quantum security service platform, so that the quantum security service platform generates and distributes a quantum key; entering a quantum encryption mode: when the quantum security gateway and the business terminal receive the quantum key, the business terminal calls the quantum key to encrypt the business data; entering a classical encryption mode: when the quantum security gateway or the business terminal does not receive the quantum key, the quantum security gateway negotiates with the business terminal and generates a classical key, and the business terminal calls the classical key to encrypt the business data; decrypting and sending plaintext: the quantum security gateway receives the encrypted business data transmitted through the encryption channel, calls the corresponding key to decrypt the encrypted business data, and sends the decrypted business data to the business server.

[0014] Furthermore, the communication method of the quantum security communication system also includes: quickly switching the encryption mode: during the update period of the session key, the quantum security gateway monitors the reception of the quantum key in real time or periodically, and applies for the quantum key to the quantum security service platform in real time or periodically. When the quantum security gateway detects that the quantum security gateway and the service terminal have received the quantum key, the quantum security communication system maintains or immediately switches to the quantum encryption mode; when the quantum security gateway does not detect that the quantum security gateway and the service terminal have received the quantum key, the quantum security communication system maintains or immediately switches to the classical encryption mode.

[0015] Furthermore, when the quantum secure communication system is in quantum encryption mode, and the quantum secure gateway fails to detect that the service terminal and the quantum secure gateway have received the quantum key for three consecutive cycles, the quantum secure communication system immediately switches to classical encryption mode.

[0016] Furthermore, the communication method of the quantum security communication system also includes: an alarm for failing to enter the quantum encryption mode: when the quantum security gateway fails to detect that the quantum security gateway and the service terminal have received the quantum key, the quantum security gateway sends an alarm message to the quantum security service platform.

[0017] Furthermore, the communication method of the quantum security communication system also includes: control data generation: the business server generates control data; establishing an encryption channel: the quantum security gateway monitors the control data and negotiates with the business terminal to establish a channel for encrypting and transmitting the control data; applying for a quantum key: the business terminal and the quantum security gateway send an application to the quantum security service platform, so that the quantum security service platform generates and distributes a quantum key; entering a quantum encryption mode: when the quantum security gateway and the business terminal receive the quantum key, the quantum security gateway receives the control data and calls the quantum key to encrypt the control data; entering a classical encryption mode: when the quantum security gateway or the business terminal does not receive the quantum key, the quantum security gateway negotiates with the business terminal and generates a classical key, the quantum security gateway receives the control data, and calls the classical key to encrypt the control data; sending ciphertext and decryption: the business terminal calls the corresponding key to decrypt the encrypted control data it receives.

[0018] Furthermore, the encrypted channel is IPSec VPN.

[0019] The beneficial effects of this application include:

[0020] (1) When both the business terminal and the quantum security gateway receive the quantum key, the business terminal uses the quantum key to encrypt the business data to achieve absolutely secure confidential communication and improve the security of communication.

[0021] (2) When the business terminal or quantum security gateway does not receive the quantum key, the quantum security gateway can negotiate with the business terminal and generate a classical key. The business terminal uses the classical key to encrypt the business data, so that the quantum security communication system can still work normally when the quantum key channel is destroyed or the quantum key transceiver equipment fails, thereby ensuring that confidential communication is not interrupted and improving the security and reliability of communication.

[0022] (3) The preferred encryption mode of the quantum secure communication system is the quantum encryption mode. The quantum secure communication system will only enter the classical encryption mode when the service terminal or quantum secure gateway has not received the quantum key, and will automatically switch from the classical encryption mode to the quantum encryption mode after the transmission of the quantum key returns to normal.

[0023] (4) During the update cycle of the session key, the quantum security gateway can monitor the reception of the quantum key in real time or periodically, and apply for the quantum key from the quantum security service platform in real time or periodically. When the quantum security gateway detects that the business terminal and the quantum security gateway have received the quantum key, it maintains or immediately switches to the quantum encryption mode; when the quantum security gateway does not detect that the business terminal and the quantum security gateway have received the quantum key, it maintains or immediately switches to the classical encryption mode.

[0024] (5) When the business server generates control data, the quantum security gateway uses the quantum key or classical key to encrypt the control data to achieve confidential communication of the control data. The preferred encryption mode for control data is also the quantum encryption mode, and it can switch to the classical encryption mode in real time or periodically when the business terminal or quantum security gateway does not receive the quantum key, thereby improving the security of communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0026] Figure 1 It is a system schematic diagram of the quantum secure communication system in the specific implementation mode of this application.

[0027] Figure 2 It is a flowchart of the quantum secure communication method in the specific implementation mode of this application.

[0028] Figure 3 It is a schematic diagram of the structure and connection relationship of the quantum security gateway in the specific implementation method of this application.

[0029] Figure 4 It is a flowchart of maintaining or switching the encryption mode of the quantum secure communication system during the update period of the session key in the specific implementation mode of the present application.

[0030] Figure 5 It is a schematic diagram of the control data encryption transmission process of the quantum secure communication system in the specific implementation mode of this application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of this application clearer, the technical solution of this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described implementation is only a part of the implementation of this application, not all implementations. Based on the implementation in this application, all other implementations obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] The present application proposes a quantum security communication system, including a quantum security service platform, a business terminal, a quantum security gateway and a business server, wherein the quantum security service platform is responsible for generating quantum keys and distributing quantum keys to the quantum security gateway and the business terminal; the business terminal is responsible for collecting business data; the quantum security gateway is responsible for negotiating with the business terminal and establishing an encryption channel. When the quantum security gateway and the business terminal both receive the quantum key, the business terminal calls the quantum key to encrypt and transmit the business data, and the quantum security gateway calls the quantum key to decrypt the encrypted business data; the quantum security gateway is also responsible for generating classical keys. When the quantum security gateway or the business terminal does not receive the quantum key, the business terminal calls the classical key to encrypt and transmit the business data, and the quantum security gateway calls the classical key to decrypt the encrypted business data; the business server is responsible for receiving the business data decrypted by the quantum security gateway.

[0033] The present application also proposes a communication method using the above-mentioned quantum secure communication system, including: establishing an encryption channel: the business terminal negotiates with the quantum security gateway to establish a channel for encrypting and transmitting business data; applying for a quantum key: the business terminal and the quantum security gateway send an application to the quantum security service platform, so that the quantum security service platform generates and distributes a quantum key; entering a quantum encryption mode: when the quantum security gateway and the business terminal receive the quantum key, the business terminal calls the quantum key to encrypt the business data; entering a classical encryption mode: when the quantum security gateway or the business terminal does not receive the quantum key, the quantum security gateway negotiates with the business terminal and generates a classical key, and the business terminal calls the classical key to encrypt the business data; decrypting and sending plaintext: the quantum security gateway receives the encrypted business data transmitted through the encryption channel, calls the corresponding key to decrypt the encrypted business data, and sends the decrypted business data to the business server.

[0034] The quantum secure communication system in this application includes two encryption modes, namely quantum encryption mode and classical encryption mode. The quantum encryption mode can ensure the absolute security of communication and is the preferred encryption mode of the quantum secure communication system. When the quantum encryption mode cannot be entered, the quantum secure communication system can automatically switch to the classical encryption mode, thereby ensuring uninterrupted confidential communication and improving the security and reliability of communication.

[0035] In addition, the quantum secure communication system can monitor the reception of quantum keys and apply for quantum keys in real time or periodically during the update cycle of the session key, maintain or switch the encryption mode more quickly, and further improve the security and reliability of communication.

[0036] This specific implementation manner is described by taking power communication as an example.

[0037] Example 1

[0038] like Figure 1 As shown, the quantum secure communication system provided by the present application includes a quantum secure gateway 100, a service terminal 200, a quantum secure service platform 300 and a service server 400.

[0039] The types of business terminals 200 include power station terminals, feeder terminals, etc., which are responsible for collecting business data such as fault inspection and monitoring, and also have functions such as key application, key reception status monitoring, data encryption and decryption, etc.

[0040] The service server 400 is installed in a data center, and can receive service data collected by the service terminal 200 , and can also analyze the operation status of the service terminal 200 based on the service data to generate control data for controlling the service terminal 200 .

[0041] The quantum security gateway 100 is installed in the data center. The quantum security gateway 100 is connected to the business server 400 through the intranet, and the quantum security gateway 100 is connected to the business terminal 200 through the extranet. As the entry device for extranet data, the quantum security gateway 100 needs to negotiate with the business terminal 200 and establish an encrypted channel. The business data is encrypted by the key and transmitted in the encrypted channel, so as to pass through the extranet and reach the quantum security gateway 100. The quantum security gateway 100 can call the key to decrypt the encrypted business data and send the decrypted business data to the business server 400.

[0042] The quantum security service platform 300 is installed in the data center and is used to generate and distribute quantum keys. The business terminal 200 and the quantum security gateway 100 respectively send applications to the quantum security service platform 300 to obtain quantum keys for encrypting or decrypting business data.

[0043] Specifically, the quantum security service platform 300 includes a key generation module, a key operation and maintenance module, a communication module and a power module. Among them, the key generation module is responsible for generating quantum keys; the key operation and maintenance module is responsible for receiving and storing quantum keys, and distributing quantum keys according to requests from the service terminal 200 and the quantum security gateway 100, and is also responsible for analyzing the generation and remaining status of quantum keys; the communication module may include wired network interfaces such as RJ-45 interfaces and SC optical fiber interfaces, and may also include wireless network interfaces, and the communication module is responsible for establishing communication connections with the service terminal 200 and the quantum security gateway 100; the power module is responsible for providing the power required for the operation of the quantum security service platform 300.

[0044] When both the business terminal 200 and the quantum security gateway 100 receive the quantum key, the business terminal 200 uses the quantum key to encrypt the business data to achieve absolutely secure confidential communication, thereby improving the security of communication.

[0045] When the business terminal 200 or the quantum security gateway 100 does not receive the quantum key, the quantum security gateway 100 can negotiate with the business terminal 200 and generate a classical key. The business terminal 200 calls the classical key to encrypt the business data, so that the quantum security communication system can still work normally when the quantum key channel is destroyed or the quantum key transceiver equipment fails, thereby ensuring that confidential communication is not interrupted and improving the security and reliability of communication.

[0046] Specifically, the service terminal 200 is connected to the quantum security gateway 100 through the external network, and the service terminal 200 negotiates with the quantum security gateway 100 to establish an IPSec VPN, which represents a virtual private network based on the Internet security protocol, that is, a private network for encrypted communication established on a public external network, which can encrypt business data while achieving target address conversion and remote access. The quantum security gateway 100 is connected to the quantum security service platform 300 through the intranet, and the service terminal 200 is connected to the quantum security service platform 300 through the external network. The service terminal 200 and the quantum security gateway 100 apply for quantum keys from the quantum security service platform 300 respectively. The quantum security gateway 100 can negotiate with the service terminal 200 and generate a classical key. Depending on whether the service terminal 200 and the quantum security gateway 100 have both received the quantum key, the IPSec VPN can use the quantum key or the classical key as the session key, thereby establishing two tunnel modes. The two IPSec VPN tunnel modes are respectively used by the service terminal 200 to call the quantum key and the classical key to encrypt the service data. The encrypted service data is transmitted to the quantum security gateway 100 through the IPSec VPN, and the quantum security gateway 100 uses the corresponding key to decrypt the encrypted service data. The service server 400 is connected to the quantum security gateway 100 through the intranet, and the service server 400 receives the service data decrypted by the quantum security gateway 100.

[0047] In order to ensure the security of communication, the preferred encryption mode of the quantum secure communication system is the IPSec VPN tunnel mode established based on the quantum key, that is, the quantum encryption mode. Only when the service terminal 200 or the quantum secure gateway 100 has not received the quantum key, the quantum secure communication system will establish the IPSec VPN tunnel mode based on the classical key, that is, the classical encryption mode.

[0048] like Figure 2 As shown, the communication method of the quantum secure communication system mainly includes the following steps:

[0049] S11: The service terminal 200 negotiates with the quantum security gateway 100 and establishes an IPSec VPN.

[0050] S12: The business terminal 200 and the quantum security gateway 100 apply for a quantum key from the quantum security service platform 300.

[0051] S13: When both the service terminal 200 and the quantum security gateway 100 receive the quantum key, the IPSec VPN uses the quantum key as the session key and establishes a tunnel mode.

[0052] S14: The business terminal 200 uses the quantum key to encrypt the business data and sends the encrypted business data to the quantum security gateway 100.

[0053] S15: The quantum security gateway 100 calls the quantum key to decrypt the encrypted business data, and sends the decrypted business data to the business server 400.

[0054] S16: When the service terminal 200 or the quantum security gateway 100 does not receive the quantum key, the service terminal 200 negotiates with the quantum security gateway 100 to generate a classical key, and the IPSec VPN uses the classical key as a session key and establishes a tunnel mode.

[0055] S17: The business terminal 200 calls the classical key to encrypt the business data, and sends the encrypted business data to the quantum security gateway 100.

[0056] S18: The quantum security gateway 100 calls the classical key to decrypt the encrypted business data, and sends the decrypted business data to the business server 400.

[0057] like Figure 3 As shown, in this specific implementation, the quantum security gateway 100 includes a main control board 101, a network port, a power supply, a USB interface 107, a PCIE interface 109 and a password card 110.

[0058] The main control board 101 may be a CPU, which is responsible for sending, receiving and processing business data, quantum keys, classical keys and other data.

[0059] The network port is set on the main control board 101, and the network port can be a plurality of wired network interfaces or wireless network interfaces, and includes a first network port 102, a second network port 103 and a third network port 104. The first network port 102 is connected to the quantum security service platform 300 by an intranet, and the quantum security gateway 100 sends a key application to the quantum security service platform 300 through the first network port 102, and receives the quantum key through the first network port 102. The second network port 103 is connected to multiple business terminals 200 by an external network, and the quantum security gateway 100 is connected to multiple business terminals 200 through the second network port 103 and establishes an encryption channel, thereby encrypting and transmitting business data; the third network port 104 is connected to the business server 400 by an intranet, and the quantum security gateway 100 is connected to the business server 400 through the third network port 104 to transmit decrypted business data or control data.

[0060] It should be noted that the quantum security gateway 100 can establish an encryption channel in a multi-process, multi-threaded concurrent processing manner, while satisfying the requirement of quickly establishing a large number of encryption channels, and increasing the number of business terminals 200 accessed by a single quantum security gateway 100. For example, in this embodiment, each quantum security gateway 100 can access three thousand business terminals 200 through the second network port 103, so the data center only needs to set up one quantum security gateway 100, or only set up two quantum security gateways 100, one main and one backup, to achieve encrypted communication with a large number of business terminals 200, thereby reducing the number of quantum security gateways 100 set up in the data center, and simplifying the network and security protection configuration between the quantum security gateway 100 and the quantum security service platform 300 and the business server 400, further improving the security and reliability of communication.

[0061] The PCIE interface 109 is provided on the main control board 101. The types of the PCIE interface 109 include PCIe X8 and PCIe X16. The password card 110 is provided with a plug matching the PCIE interface 109. The password card 110 is inserted into the PCIE interface 109 and communicates with the main control board 101. The password card 110 is compatible with the national encryption SM2, SM3 and SM4 algorithms and can generate classical keys. The password card 110 can store quantum keys and classical keys to call quantum keys or classical keys to encrypt and decrypt business data.

[0062] The specific working steps of the quantum secure communication system are as follows:

[0063] Establish IPSec VPN: The service terminal 200 is connected to the second network port 103 of the quantum security gateway 100 through a 4G or 5G network communication connection. The service terminal 200 initiates an IKE session with the quantum security gateway 100 to establish a security association (SA), so that the service terminal 200 and the quantum security gateway 100 can perform identity authentication and negotiate encryption algorithms, hash algorithms, authentication methods, etc.

[0064] Applying for quantum keys: The quantum security service platform 300 is connected to the first network port 102 of the quantum security gateway 100 through intranet communication, and the quantum security service platform 300 is connected to the business terminal 200 through 4G or 5G network communication. The business terminal 200 and the quantum security gateway 100 respectively apply for quantum keys from the quantum security service platform 300.

[0065] Generate and distribute keys: In response to the requests of the business terminal 200 and the quantum security gateway 100, the quantum security service platform 300 generates a pair of quantum keys, and the quantum security service platform 300 sends the quantum keys to the business terminal 200 and the quantum security gateway 100.

[0066] Key reception: The quantum key is transmitted to the password card 110 through the intranet and via the first network port 102, the main control board 101 and the PCIE interface 109. The password card 110 receives and stores the quantum key. The quantum key is also transmitted to the business terminal 200 through the external network. The business terminal 200 receives and stores the quantum key.

[0067] Entering quantum encryption mode: the quantum security gateway 100 monitors whether it has received the quantum key through the first network port 102; the service terminal 200 can also monitor whether it has received the quantum key, and feedback the reception of the quantum key to the quantum security gateway 100 through the second network port 103. When both the service terminal 200 and the quantum security gateway 100 have received the quantum key, the IPSec VPN uses the quantum key as the session key and establishes a tunnel mode based on the quantum key. The service terminal 200 uses its stored quantum key to encrypt the service data.

[0068] Entering the classical encryption mode: When the service terminal 200 or the quantum security gateway 100 has not received the quantum key, the service terminal 200 negotiates with the quantum security gateway 100 to enable the password card 110 of the quantum security gateway 100 to generate a classical key. The classical key enters the IPSec VPN through the PCIE interface 109, the main control board 101 and the second network port 103. The IPSec VPN uses the classical key as the session key and establishes a tunnel mode based on the classical key. The service terminal 200 receives the classical key through the IPSec VPN and calls the classical key to encrypt the service data.

[0069] Encrypted business data transmission: Encrypted business data enters the IPSec VPN from the business terminal 200, and is transmitted to the password card 110 of the quantum security gateway 100 through the second network port 103, the main control board 101 and the PCIE interface 109 in sequence.

[0070] Decryption and sending plain text: The password card 110 of the quantum security gateway 100 calls the corresponding quantum key or classical key to decrypt the encrypted business data. The decrypted business data is sent to the business server 400 through the PCIE interface 109, the main control board 101, and the third network port 104 in sequence.

[0071] The power supply includes a first power supply 105, which is connected to the power supply interface to supply power to the quantum security gateway 100. In order to improve the reliability of the quantum security communication system, the quantum security gateway 100 may include a second power supply 106 as a backup power supply to achieve dual power supply. For example, the first power supply 105 and the second power supply 106 can be connected to the power supply interface at the same time. When one of the power supplies cannot supply power normally due to voltage instability or other reasons, the quantum security gateway 100 supplies power through another power supply and continues to work. Alternatively, the second power supply 106 can be a UPS power supply, using the first power supply 105 connected to the power supply interface as the main power supply and the second power supply 106 as the backup power supply. When the first power supply 105 cannot supply power normally, the quantum security gateway 100 can automatically switch to the second power supply 106 for power supply to provide the time required for saving data or restoring power.

[0072] The USB interface 107 is provided on the main control board 101, and the USB interface 107 can be USB2.0 or USB3.0. The password key 108 is provided with a USB plug matching the USB interface 107. When configuring the quantum security gateway 100, the password key 108 needs to be inserted into the USB interface 107 to complete the identity authentication of the system administrator, security administrator or audit administrator, thereby improving the security of communication.

[0073] Example 2

[0074] Embodiment 2 provides another quantum secure communication system and method. The difference from Embodiment 1 is that in order to enable the quantum secure communication system to switch encryption modes within the update period of the session key, the quantum secure gateway 100 may further include a quantum key management module 111.

[0075] like Figure 3 As shown, the quantum key management module 111 is a functional module of the main control board 101 for monitoring the key status. The quantum key management module 111 can monitor the key type received by the quantum security gateway 100 and the service terminal 200 in real time or periodically, as well as the type of key in the password card 110, the key usage, the remaining key amount, the timestamp and other information. The quantum key management module 111 also has the function of executing tasks at a scheduled time, triggering key monitoring tasks, key application tasks and key status reporting tasks in real time or at a predetermined time interval, and controlling the execution of the above tasks through the main control board 101.

[0076] Based on the above functions, the quantum key management module 111 can monitor the quantum security gateway 100 and the service terminal 200 receiving the quantum key in real time or periodically during the update period of the session key, and can also apply for the quantum key from the quantum security service platform 300 in real time or periodically. If the quantum key management module 111 does not monitor that both the service terminal 200 and the quantum security gateway 100 have received the quantum key, the quantum security communication system maintains or immediately switches to the classical encryption mode, and sends an alarm message to the quantum security service platform 300. The quantum security service platform 300 analyzes the generation and sending of the quantum key based on the alarm message, and reminds the user by sending a text message or a pop-up window, so that the user understands that the quantum security communication system cannot enter the quantum encryption mode, and there is a risk of encrypted business data being cracked. If the quantum key management module 111 monitors that the service terminal 200 and the quantum security gateway 100 have received the quantum key, the quantum security communication system maintains or immediately switches to the quantum encryption mode to avoid the risk of data being cracked when the quantum security communication system is in the classical encryption mode for a long time, thereby improving communication security.

[0077] It should be noted that the time interval predetermined by the quantum key management module 111 is less than the time interval of the session key update period, that is, the monitoring, application and situation reporting of the quantum key in this embodiment are more frequent to meet the needs of the quantum secure communication system to quickly switch the encryption mode. When the time interval predetermined by the quantum key management module 111 reaches the second level, for example, the predetermined time interval is 10 seconds, it can be considered that the quantum key management module 111 can monitor the quantum key reception situation and apply for the quantum key in real time.

[0078] The quantum security gateway 100 can monitor the reception of the quantum key through the first network port 102, and feed back the reception of the quantum key to the quantum key management module 111 through the main control board 101; the business terminal 200 itself can monitor the reception of the quantum key, and the business terminal 200 can feed back the reception of the quantum key to the quantum key management module 111 through the IPSec VPN, the second network port 103 and the main control board 101.

[0079] Since the network port includes multiple types, in some embodiments, the first network port 102 and the second network port 103 do not have the function of monitoring the reception of the quantum key, so the main control board 101 may also include a detection module. The detection module is connected in communication with the network port and the quantum key management module 111 to monitor the network port receiving the quantum key. In this embodiment, the detection module includes a first detection module and a second detection module. The first detection module is connected in communication with the first network port 102 and the quantum key management module 111 to monitor the quantum security gateway 100 receiving the quantum key and feedback to the quantum key management module 111; the second detection module is connected in communication with the second network port 103 and the quantum key management module 111 to monitor the service terminal 200 receiving the quantum key and feedback to the quantum key management module 111.

[0080] like Figure 4 As shown, the main steps for the quantum secure communication system to maintain or switch the encryption mode during the update cycle of the session key include:

[0081] S21: The service terminal 200 negotiates with the quantum security gateway 100 and establishes an IPSec VPN.

[0082] S22: During the update period of the session key, the quantum key management module 111 monitors the reception of the quantum key in real time or periodically, and the quantum key management module 111 applies for the quantum key to the quantum security service platform 300 in real time or periodically.

[0083] S23: When the quantum key management module 111 detects that both the service terminal 200 and the quantum security gateway 100 have received the quantum key, the IPSec VPN uses the quantum key as the session key and establishes a tunnel mode, so that the quantum security communication system maintains or immediately switches to the quantum encryption mode.

[0084] S24: When the quantum key management module 111 does not detect that the service terminal 200 and the quantum security gateway 100 have received the quantum key, the IPSec VPN uses the classical key as the session key and establishes a tunnel mode, so that the quantum security communication system maintains or immediately switches to the classical encryption mode.

[0085] Through the above steps, the quantum security gateway 100 can monitor the reception of the quantum key in real time or periodically during the update cycle of the session key, and apply for the quantum key to the quantum security service platform 300 in real time or periodically, thereby realizing the rapid switching of the encryption mode during the update cycle of the session key.

[0086] In this embodiment, when the quantum secure communication system is in quantum encryption mode, only when the condition "the quantum key management module 111 of the quantum security gateway 100 monitors the reception of the quantum key three times in a row, and the service terminal 200 and the quantum security gateway 100 are not monitored to receive the quantum key three times" is met, the service terminal 200 or the quantum security gateway 100 is determined to be unable to receive the quantum key, and the quantum secure communication system will switch from the quantum encryption mode to the classical encryption mode. The above method can improve the accuracy of quantum key monitoring, avoid frequent switching of encryption modes due to failure to receive quantum keys in a short period of time, and avoid being in the classical encryption mode for a long time, thereby improving the security and reliability of communication.

[0087] In step S24, when the quantum key management module 111 does not detect that the service terminal 200 and the quantum security gateway 100 have received the quantum key, the quantum key management module 111 sends an alarm message to the key operation and maintenance module of the quantum security service platform 300 through the main control board 101. The alarm information includes device identification and key status, etc. The quantum security service platform 300 notifies relevant personnel by pop-up windows, text messages, emails, etc., so that relevant personnel can promptly understand that the quantum security communication system is currently in a classical encryption mode with security risks. The quantum security service platform 300 can also store the alarm record in the key operation and maintenance module of the quantum security service platform 300 for subsequent query and audit.

[0088] Example 3

[0089] Embodiment 3 provides another quantum secure communication method. The difference from Embodiment 1 and Embodiment 2 is that this embodiment further includes a step of encrypting and transmitting the control data generated by the service server 400.

[0090] like Figure 5 As shown, the encrypted transmission of control data includes the following steps:

[0091] S31: The service server 400 generates control data.

[0092] S32: The quantum security gateway 100 monitors the business server 400 generating control data through the third network port 104, and the quantum security gateway 100 negotiates with the business terminal 200 to establish a channel for encrypting and transmitting control data.

[0093] S33: The quantum security gateway 100 and the service terminal 200 send an application to the quantum security service platform 300, so that the quantum security service platform 300 generates and distributes quantum keys.

[0094] S34: When both the service terminal 200 and the quantum security gateway 100 receive the quantum key, the quantum security gateway 100 receives the control data and calls the quantum key to encrypt the control data.

[0095] S35: When the service terminal 200 or the quantum security gateway 100 does not receive the quantum key, the quantum security gateway 100 negotiates with the service terminal 200 and generates a classical key. The quantum security gateway 100 receives the control data and calls the classical key to encrypt the control data.

[0096] S36: The service terminal 200 calls the corresponding key to decrypt the encrypted control data it receives.

[0097] In this embodiment, the quantum secure communication system can encrypt and transmit the control data generated by the business server 400, and the encryption mode of the control data can also be switched according to the reception of the quantum key, and the encryption mode of the control data can be switched in real time or periodically during the update cycle of the session key.

[0098] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A quantum secure communication system, characterized in that: It includes quantum security service platform, business terminal, quantum security gateway and business server, among which: The quantum security service platform is responsible for generating quantum keys and distributing quantum keys to the quantum security gateway and the service terminal; The business terminal is responsible for collecting business data; The quantum security gateway is responsible for negotiating with the service terminal and establishing an encrypted channel. When both the quantum security gateway and the service terminal receive the quantum key, the service terminal calls the quantum key to encrypt and transmit the service data, and the quantum security gateway calls the quantum key to decrypt the encrypted service data. The quantum security gateway is also responsible for generating a classical key. When the quantum security gateway or the service terminal does not receive the quantum key, the service terminal calls the classical key to encrypt and transmit the service data, and the quantum security gateway calls the classical key to decrypt the encrypted service data. The business server is responsible for receiving the business data decrypted by the quantum security gateway.

2. The quantum secure communication system according to claim 1, characterized in that: The quantum security gateway includes a main control board, a network port, a power supply and a password card, wherein: The main control board is responsible for sending, receiving and processing data; The network port is responsible for communicating with the quantum security service platform, the business terminal and the business server; The power supply is responsible for supplying power; The cryptographic card is responsible for receiving quantum keys and generating classical keys, as well as calling corresponding keys to encrypt and decrypt the business data.

3. The quantum secure communication system according to claim 2, characterized in that: The quantum security gateway also includes a quantum key management module, which monitors the quantum security gateway and the service terminal receiving the quantum key in real time or periodically, and applies for the quantum key from the quantum security service platform in real time or periodically.

4. The quantum secure communication system according to claim 3, characterized in that: The main control board includes a detection module, which is communicatively connected with the network port and the quantum key management module to monitor the network port receiving the quantum key and feed back the reception status of the quantum key to the quantum key management module.

5. The quantum secure communication system according to claim 4, characterized in that: The quantum security gateway includes a cryptographic key to verify the identity of the person configuring the quantum security gateway.

6. The quantum secure communication system according to claim 2, characterized in that: There are multiple power supplies, and at least one of the power supplies serves as a backup power supply.

7. The quantum secure communication system according to claim 6, characterized in that: The backup power supply is a UPS power supply.

8. A communication method using a quantum secure communication system as claimed in any one of claims 1 to 7, characterized in that: include: Establishing an encrypted channel: the business terminal negotiates with the quantum security gateway to establish a channel for encrypting and transmitting the business data; Applying for quantum keys: the business terminal and the quantum security gateway send an application to the quantum security service platform, so that the quantum security service platform generates and distributes quantum keys; Entering quantum encryption mode: when the quantum security gateway and the service terminal receive the quantum key, the service terminal uses the quantum key to encrypt the service data; Entering the classical encryption mode: when the quantum security gateway or the service terminal does not receive the quantum key, the quantum security gateway negotiates with the service terminal and generates a classical key, and the service terminal uses the classical key to encrypt the service data; Decryption and sending plaintext: The quantum security gateway receives the encrypted business data transmitted through the encrypted channel, calls the corresponding key to decrypt the encrypted business data, and sends the decrypted business data to the business server.

9. The communication method of the quantum secure communication system according to claim 8, characterized in that: Also includes: Rapidly switch encryption mode: During the update period of the session key, the quantum security gateway monitors the reception of the quantum key in real time or periodically, and applies for the quantum key from the quantum security service platform in real time or periodically. When the quantum security gateway detects that the quantum security gateway and the service terminal have received the quantum key, the quantum security communication system maintains or immediately switches to the quantum encryption mode; When the quantum security gateway does not detect that the quantum security gateway and the service terminal receive the quantum key, the quantum security communication system maintains or immediately switches to the classical encryption mode.

10. The communication method of the quantum secure communication system according to claim 9, characterized in that: When the quantum secure communication system is in the quantum encryption mode, and the quantum secure gateway fails to detect that the service terminal and the quantum secure gateway have received the quantum key for three consecutive cycles, the quantum secure communication system immediately switches to the classical encryption mode.

11. The communication method of the quantum secure communication system according to claim 9, characterized in that: Also includes: Unable to enter quantum encryption mode alarm: When the quantum security gateway fails to detect that the quantum security gateway and the service terminal have received the quantum key, the quantum security gateway sends an alarm message to the quantum security service platform.

12. The communication method of the quantum secure communication system according to claim 9, characterized in that: Also includes: Control data generation: the service server generates control data; Establishing an encrypted channel: the quantum security gateway monitors the control data and negotiates with the service terminal to establish a channel for encrypting and transmitting the control data; Applying for quantum keys: the business terminal and the quantum security gateway send an application to the quantum security service platform, so that the quantum security service platform generates and distributes quantum keys; Entering quantum encryption mode: when the quantum security gateway and the service terminal receive the quantum key, the quantum security gateway receives the control data and uses the quantum key to encrypt the control data; Entering the classical encryption mode: when the quantum security gateway or the service terminal does not receive the quantum key, the quantum security gateway negotiates with the service terminal and generates a classical key, the quantum security gateway receives the control data, and calls the classical key to encrypt the control data; Sending ciphertext and decryption: The service terminal calls the corresponding key to decrypt the encrypted control data it receives.

13. The communication method of the quantum secure communication system according to claim 9, characterized in that: The encryption channel is IPSec VPN.

Images