Session key distribution method, electronic equipment and storage medium

Abstract

The invention provides a session key distribution method, electronic equipment and a storage medium, the method is applied to a quantum security networking controller, and the method comprises the following steps: receiving a session key distribution request sent by first equipment through an SDN controller, querying and determining a first password service platform corresponding to the first equipment according to an equipment identifier of the first equipment, forwarding the session key distribution request to a first password service platform to enable the first password service platform to generate a target session key for the first device, returning the target session key to the quantum security networking controller, receiving the target session key returned by the first password service platform, and sending the target session key to the quantum security networking controller; and sending the target session key to the first device through the SDN controller, so that the first device triggers and establishes a session channel with the second device based on the target session key. Through cooperative work of the SDN controller and the quantum security networking controller, double-layer key codes are realized, and the security and efficiency of key distribution are ensured.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a session key distribution method, an electronic device and a storage medium. Background Art

[0002] As network attacks become increasingly complex, traditional key distribution methods can no longer meet high security requirements. Software-Defined Networking (SDN) technology, as a new type of network architecture, can achieve flexible network programming and traffic control.

[0003] At present, the SDN controller interacts with devices through the southbound interface protocol (OpenFlow), collects network status information, and generates data forwarding paths according to business needs. At the same time, it connects with the quantum cryptography service platform through the northbound interface (NBI) to realize the issuance of key requests and distribution instructions.

[0004] However, the SDN controller not only needs to manage all devices, but also needs to connect to all quantum cryptography service platforms in a region, which increases the management difficulty of the SDN controller and reduces the efficiency of key distribution. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a session key distribution method, an electronic device and a storage medium to implement a double-layer key code through the collaborative work of an SDN controller and a quantum secure networking controller to ensure the security and efficiency of key distribution.

[0006] In a first aspect, an embodiment of the present application provides a session key distribution method, which is applied to a quantum security networking controller, and the method includes:

[0007] receiving a session key distribution request sent by a first device through an SDN controller, wherein the session key distribution request includes: a device identifier of the first device;

[0008] querying and determining, according to the device identifier of the first device, a first cryptographic service platform corresponding to the first device;

[0009] Forwarding the session key distribution request to the first cryptographic service platform, so that the first cryptographic service platform generates a target session key for the first device, and returns the target session key to the quantum secure networking controller;

[0010] The target session key is received from the first cryptographic service platform, and the target session key is sent to the first device through the SDN controller, so that the first device triggers establishment of a session channel with the second device based on the target session key.

[0011] In an optional embodiment, the method further comprises:

[0012] receiving a session key query request sent by the second device through the SDN controller, the session key query request including: a key identifier of the target session key, the key identifier being a key identifier obtained by the second device based on an application for establishing the session channel;

[0013] According to the key identifier, obtaining the target session key from the first cryptographic service platform;

[0014] The target session key is sent to the second device through the SDN controller, so that the second device establishes the session channel according to the target session key.

[0015] In an optional implementation, the session key query request further includes: a device identification of the first device and a device identification of the second device; wherein the device identification of the first device is a device identification obtained by the second device based on the application for establishing the session channel;

[0016] The acquiring the target session key from the first cryptographic service platform according to the key identifier includes:

[0017] querying and determining, according to the device identification of the first device and the device identification of the second device, whether a second cryptographic service platform corresponding to the second device and the first cryptographic service platform are the same cryptographic service platform;

[0018] If the second cryptographic service platform and the first cryptographic service platform are the same cryptographic service platform, sending the session key query request to the first cryptographic service platform, the session key query request including: the key identifier, so that the first cryptographic service platform returns the target session key;

[0019] Receive the target session key returned by the first cryptographic service platform.

[0020] In an optional implementation, the acquiring the target session key from the first cryptographic service platform according to the key identifier further includes:

[0021] If the second cryptographic service platform and the first cryptographic service platform are different cryptographic service platforms, sending a session key synchronization request to the first cryptographic service platform so that the first cryptographic service platform synchronizes the target session key to the second cryptographic service platform;

[0022] Receive the target session key returned by the second cryptographic service platform.

[0023] In an optional implementation, before receiving the session key distribution request sent by the first device through the SDN controller, the method further includes:

[0024] receiving a registration request sent by each of the first device and the second device through the SDN controller, wherein the registration request includes: a device identifier of each of the devices;

[0025] According to the device identification of each device, query and determine the target cryptographic service platform corresponding to each device;

[0026] Registering each device under the target cryptographic service platform according to the device identification of each device;

[0027] If the registration is successful, the SDN controller returns a successful registration indication message and access authentication information to each device;

[0028] If the registration fails, the SDN controller returns registration failure indication information to each device.

[0029] In an optional implementation, registering each device on the target cryptographic service platform according to the device identification of each device includes:

[0030] Sending the device identification of each device to the target cryptographic service platform so that the target cryptographic service platform generates a first random number, and sending the first random number to the quantum secure networking controller;

[0031] Send the first random number to each device through the SDN controller, so that each device performs an HMAC operation on the first random number and a randomly generated second random number according to the pre-filled key corresponding to each device to obtain an HMAC value, and send a verification request to the quantum security networking controller through the SDN controller, the verification request including: the HMAC value and the second random number;

[0032] The verification request sent by each device is received through the SDN controller, and the verification request is forwarded to the target cryptographic service platform, so that the target cryptographic service platform verifies the HMAC value.

[0033] In an optional implementation manner, querying and determining a target cryptographic service platform corresponding to each device according to a device identification of each device includes:

[0034] Determine whether the device identifier of each device exists among multiple device identifiers managed by the preset networking operation platform;

[0035] If the device identification of each device exists in the multiple device identifications, the target cryptographic service platform is queried and determined according to the device identification of each device.

[0036] In an optional embodiment, the method further comprises:

[0037] If the device identifier of each device does not exist in the multiple device identifiers, indication information of registration failure is returned to each device through the SDN controller.

[0038] In a second aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to execute any one of the methods described in the first aspect.

[0039] In a third aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the method described in any one of the first aspects is executed.

[0040] The present application provides a session key distribution method, an electronic device, and a storage medium, which is applied to a quantum security networking controller, and includes: receiving a session key distribution request sent by a first device through an SDN controller, querying and determining a first cryptographic service platform corresponding to the first device according to a device identifier of the first device, forwarding the session key distribution request to the first cryptographic service platform so that the first cryptographic service platform generates a target session key for the first device, and returns the target session key to the quantum security networking controller, receiving the target session key returned by the first cryptographic service platform, and sending the target session key to the first device through the SDN controller so that the first device triggers the establishment of a session channel with the second device based on the target session key. Through the collaborative work of the SDN controller and the quantum security networking controller, a double-layer key code is realized to ensure the security and efficiency of key distribution. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 This is the operational architecture diagram of the existing quantum secure dedicated line;

[0043] Figure 2 An architectural diagram of a double-layer key agent for an SDN controller and a quantum security networking controller provided in an embodiment of the present application;

[0044] Figure 3 Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 1 ;

[0045] Figure 4 Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 2 ;

[0046] Figure 5 Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 3 ;

[0047] Figure 6 Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 4 ;

[0048] Figure 7 Schematic diagram of the process of quantum key distribution method provided in the embodiment of the present application Figure 5 ;

[0049] Figure 8 A schematic diagram of a registration process of a double-layer key application agent provided by an embodiment of the present application;

[0050] Fig. 9 A schematic diagram of a session key distribution and query process of a double-layer key application agent provided in an embodiment of the present application;

[0051] Fig.10 A schematic diagram of the structure of a session key distribution device provided in an embodiment of the present application;

[0052] Fig.11 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0054] First, the professional terms involved in this application are explained:

[0055] Software-Defined Networking (SDN): A new type of network architecture that separates the control plane and data plane of the network to achieve programmability and flexibility.

[0056] Quantum Key Distribution (QKD): A technology that uses the properties of quantum mechanics to ensure communication security.

[0057] Northbound Interface (NBI): A set of interfaces in the network management system that provide network resource data to third-party network management systems.

[0058] Southbound Interface Protocol (OpenFlow): A network communication protocol that belongs to the data link layer and can control the forwarding plane of online switches or routers to change the network path taken by network data packets.

[0059] Hash-based Message Authentication Code: (Hash-based Message Authentication Code, HMAC).

[0060] Figure 1 This is the existing quantum secure dedicated line operation architecture diagram, such as Figure 1 As shown, the devices include STN-U1 and STN-U2, the cryptographic service platforms include cryptographic service platform A and cryptographic service platform B, the SDN controller performs routing addressing according to the device identifier to find the corresponding cryptographic service platform, and the cryptographic service platform provides a quantum key distribution function for session key distribution.

[0061] It can be seen that the connection between the SDN controller and the upper-layer key proxy network is somewhat complex. The SDN controller not only needs to manage all devices, but also needs to connect to a regional (such as all cities in a province) quantum cryptography service platform, which increases the management difficulty of the SDN controller and reduces the efficiency of key distribution.

[0062] Based on this, this application provides an innovative key distribution and management system to solve the complexity of the SDN controller's docking with the upper-layer key proxy network. Through the collaborative work of the SDN controller and the quantum security networking controller, a double-layer key proxy is realized to ensure the security and efficiency of key distribution between devices.

[0063] Figure 2 The architecture diagram of the double-layer key agent of the SDN controller and quantum security networking controller provided in the embodiment of the present application is as follows: Figure 2 As shown, the devices include STN-U1 and STN-U2, the cryptographic service platform includes cryptographic service platform A and cryptographic service platform B, and the SDN controller serves as the control center, responsible for the scheduling of the overall network traffic and device management. It interacts with the device through the southbound interface protocol and connects with the quantum security networking controller through the northbound interface to realize the issuance of key requests and distribution instructions.

[0064] By adding a quantum security networking controller to the overall architecture, the receiving device sends a session key application through the SDN controller, and uses quantum key distribution technology to obtain a highly secure session key from the cryptographic service platform corresponding to the device. That is, the quantum cryptographic distribution platform has the QKD function, and through the optimized routing strategy, it ensures that the session key is securely transmitted to the device. At the same time, it also has the key application agent function, which can handle complex interactions during the key transmission process and improve the response speed and stability of the overall system. Among them, the cryptographic service platform, as the source of the key, distributes the session key to the terminal device through the dual agent of the SDN controller and the quantum security networking controller.

[0065] It can be seen that through the two-layer key proxy mechanism, the first layer is implemented by the SDN controller, which is responsible for the key request and distribution strategy formulation at the network level, and the second layer is implemented by the quantum security networking controller, which uses the quantum security networking controller for routing selection and proxy functions to ensure the security of the key transmission path. The two-layer proxy mechanism cooperates with each other, which not only ensures the flexibility of network management, but also ensures the high security of key distribution.

[0066] Through the collaborative work of the SDN controller and the quantum security networking controller, a double-layer key proxy mechanism is implemented to ensure the high security of the key negotiation process between devices. In addition, through the original management path of the SDN controller, the original transmission channel is reused, which reduces the deployment cost, improves the utilization rate of network resources, shortens the service launch cycle, and improves the operation and maintenance efficiency. In addition, the combination of the SDN controller and the quantum security networking controller has promoted the development of new technologies in the field of network security and provided possibilities for higher-level secure communications in the future.

[0067] It is worth noting that the SDN controller and the quantum security networking controller can be deployed on the same physical device or on different physical devices, and the cryptographic service platform and the SDN controller are deployed on different physical devices. For example, the SDN controller and the quantum security networking controller are deployed on a physical device corresponding to a province, and the cryptographic service platform is deployed on a physical device corresponding to a city in a province. This embodiment does not specifically limit this. The physical device may be a server.

[0068] Figure 3 Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 1 The execution subject of this embodiment may be a quantum security networking controller.

[0069] like Figure 3 As shown, the method may include:

[0070] S101. Receive a session key distribution request sent by a first device through an SDN controller.

[0071] The session key distribution request includes: a device identifier of the first device, the first device sends a session key distribution request to the SDN controller, the SDN controller forwards the session key distribution request to the quantum secure networking controller, and the quantum secure networking controller receives the session key distribution request forwarded by the SDN controller.

[0072] It is worth noting that the device identifier is a unique identifier of the first device, which can be a secure medium identifier based on the serial number (Serial Number, SN) of the first device or generated based on the SN number. The session key application can also include some relevant information about the session key application. For details, please refer to the relevant description of the prior art. This embodiment does not make any special limitations on this.

[0073] S102: Query and determine a first cryptographic service platform corresponding to the first device according to the device identifier of the first device.

[0074] Among them, there is a mapping relationship between the device identification and the cryptographic service platform. According to the device identification of the first device, by querying the mapping relationship, the first cryptographic service platform (CSP1) corresponding to the first device can be determined. The first cryptographic service platform is the cryptographic service platform corresponding to the first device.

[0075] In an optional implementation, the quantum security networking controller sends a platform query request to a quantum service management platform (CMSP), the platform query request includes: a device identifier of the first device, the quantum service management platform stores the mapping relationship, the quantum service management platform queries the first cryptographic service platform corresponding to the first device, and sends information of the first cryptographic service platform to the quantum security networking controller, which information may include address information.

[0076] Among them, the quantum security networking controller and the quantum business management platform can be deployed on the same physical device or on different physical devices, and this embodiment does not specifically limit this.

[0077] S103. Forward the session key distribution request to the first cryptographic service platform, so that the first cryptographic service platform generates a target session key for the first device, and returns the target session key to the quantum secure networking controller.

[0078] The quantum security networking controller forwards the session key distribution request to the first cryptographic service platform, the first cryptographic service platform generates a target session key for the first device, and returns the target session key to the quantum security networking controller, wherein the target session key is the session key between the first device and the second device, and the target session key can be a quantum session key.

[0079] Among them, the first cryptographic service platform can be connected to the cryptographic machine to generate a target session key for the first device.

[0080] S104: Receive the target session key returned by the first cryptographic service platform, and send the target session key to the first device through the SDN controller, so that the first device triggers establishment of a session channel with the second device based on the target session key.

[0081] The quantum secure networking controller receives the target session key returned by the first cryptographic service platform and sends the target session key to the SDN controller. The SDN controller forwards the target session key to the first device, and the first device is used to trigger the establishment of a session channel with the second device based on the target session key.

[0082] In this embodiment, the SDN controller and the quantum secure networking controller work together to realize double-layer key agency, thereby ensuring the security and efficiency of key distribution between devices.

[0083] Figure 4Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 2 ,like Figure 4 As shown, in an optional embodiment, the method may further include:

[0084] S201. Receive a session key query request sent by a second device through an SDN controller.

[0085] The session key query request includes: a key identifier of a target session key, where the key identifier is a key identifier obtained by the second device based on an application for establishing a session channel.

[0086] The first device is used to trigger the establishment of a session channel with the second device based on the target session key. The first device sends an establishment application for the session channel to the second device. The establishment application includes: a key identifier of the target session key.

[0087] The second device extracts the key identifier of the target session key from the establishment application, and sends a session key query request to the SDN controller. The SDN controller forwards the session key query request to the quantum secure networking controller. The session key query request includes: the key identifier of the target session key.

[0088] S202. Obtain a target session key from the first cryptographic service platform according to the key identifier.

[0089] After receiving the key identifier of the target session key, the quantum security networking controller can send a session key acquisition application to the first cryptographic service platform to obtain the target session key from the first cryptographic service platform. The session key acquisition application includes: the key identifier of the target session key.

[0090] S203: Send the target session key to the second device through the SDN controller, so that the second device establishes a session channel according to the target session key.

[0091] The quantum secure networking controller sends the target session key to the SDN controller, and the SDN controller forwards the target session key to the second device. The second device receives the target session key and can establish a session channel with the first device according to the target session key. After the session channel is established, the second device can also send a message to the first device that the session channel is established. The second device is any device to establish a session channel with the first device.

[0092] In this embodiment, a double-layer agent based on the SDN controller and the quantum security networking controller queries the session key from the cryptographic service platform to achieve key negotiation between the first device and the second device, and establish a secure session channel to implement double-layer key agency, thereby ensuring the security and efficiency of key distribution between devices.

[0093] Figure 5 Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 3 ,like Figure 5 As shown, in an optional implementation, the session key query request also includes: a device identifier of the first device and a device identifier of the second device, wherein the device identifier of the first device is a device identifier obtained by the second device based on an application for establishing a session channel.

[0094] The session channel establishment application sent by the first device to the second device also includes: a device identifier of the first device, and the device identifier of the first device is extracted from the establishment application.

[0095] The device identifier of the second device is a unique identifier of the second device, and may be a secure medium identifier generated based on the serial number SN of the second device.

[0096] The above step S202, obtaining the target session key from the first cryptographic service platform according to the key identifier, includes:

[0097] S301. According to the device identification of the first device and the device identification of the second device, query and determine whether the second cryptographic service platform corresponding to the second device and the first cryptographic service platform are the same cryptographic service platform.

[0098] According to the device identification of the first device and the device identification of the second device, the mapping relationship between the pre-saved device identification and the corresponding cryptographic service platform is queried to determine whether the second cryptographic service platform (CSP2) corresponding to the second device and the first cryptographic service platform are the same cryptographic service platform.

[0099] Among them, the second cryptographic service platform is the cryptographic service platform corresponding to the second device, and the first cryptographic service platform and the second cryptographic service platform are deployed on physical devices corresponding to different municipal areas.

[0100] In an optional implementation, the quantum security networking controller sends a platform query request to a quantum service management platform (CMSP), the platform query request includes: the device identification of the second device, the quantum service management platform queries the second cryptographic service platform corresponding to the second device, and sends the information of the second cryptographic service platform to the quantum security networking controller.

[0101] S302: If the second cryptographic service platform and the first cryptographic service platform are the same cryptographic service platform, a session key query request is sent to the first cryptographic service platform, where the session key query request includes a key identifier, so that the first cryptographic service platform returns a target session key.

[0102] S303: Receive the target session key returned by the first cryptographic service platform.

[0103] If the second cryptographic service platform and the first cryptographic service platform are the same cryptographic service platform, the quantum security networking controller sends a session key query request to the first cryptographic service platform, and the session key query request includes: a key identifier, so that the first cryptographic service platform returns the target session key to the quantum security networking controller, and the quantum security networking controller receives the target session key returned by the first cryptographic service platform.

[0104] The above step S202, obtaining the target session key from the first cryptographic service platform according to the key identifier, also includes:

[0105] S304: If the second cryptographic service platform and the first cryptographic service platform are different cryptographic service platforms, send a session key synchronization request to the first cryptographic service platform, so that the first cryptographic service platform synchronizes the target session key to the second cryptographic service platform.

[0106] S305: Receive the target session key returned by the second cryptographic service platform.

[0107] If the second cryptographic service platform and the first cryptographic service platform are different cryptographic service platforms, the quantum security networking controller sends a session key synchronization request to the first cryptographic service platform. The session key synchronization request includes: the key identifier of the target session key. The first cryptographic service platform synchronizes the target session key to the second cryptographic service platform based on the session key synchronization request. The second cryptographic service platform returns the target session key to the quantum security networking controller, and the quantum security networking controller receives the target session key returned by the second cryptographic service platform.

[0108] In this embodiment, based on the double-layer proxy of the SDN controller and the quantum secure networking controller, cross-regional key synchronization is triggered to query the session key, so as to realize the key negotiation between the first device and the second device, and establish a secure session channel to realize the double-layer key proxy, thereby ensuring the security and efficiency of key distribution between devices.

[0109] Figure 6 Schematic diagram of the process of distributing session keys provided in the embodiment of the present application Figure 4 ,like Figure 6 As shown, in an optional implementation manner, before the above step S101, receiving the session key distribution request sent by the first device through the SDN controller, the method may further include:

[0110] S401: Receive a registration request sent by each of the first device and the second device through the SDN controller.

[0111] Among them, each device in the first device and the second device can send a registration request to the SDN controller, the SDN controller forwards the registration request to the quantum secure networking controller, and the quantum secure networking controller receives the registration request sent by each device through the SDN controller, wherein the registration request includes: the device identification of each device.

[0112] S402: According to the device identification of each device, query and determine the target cryptographic service platform corresponding to each device.

[0113] There is a mapping relationship between the device identification and the cryptographic service platform. According to the device identification of each device, the mapping relationship can be queried to determine the target cryptographic service platform corresponding to each device. For the first device, the target cryptographic service platform is the first cryptographic service platform, and for the second device, the target cryptographic service platform is the second cryptographic service platform.

[0114] In an optional implementation, the above step S402, querying and determining the target cryptographic service platform corresponding to each device according to the device identification of each device, includes:

[0115] Determine whether a device identifier of each device exists among multiple device identifiers managed by a preset networking operation platform;

[0116] If the device identification of each device exists in the multiple device identifications, the target cryptographic service platform is queried and determined according to the device identification of each device.

[0117] Among them, after the device is powered on, its own device identification can be sent to the preset networking operation platform for management. The preset networking operation platform manages multiple device identifications, and determines whether the device identification of each device exists among the multiple device identifications. If so, it is determined that each device has successfully connected to the preset networking operation platform, and the target cryptographic service platform is determined based on the device identification of each device.

[0118] If the device identification of each device does not exist, it means that each device has not been connected to the preset networking operation platform, and then the SDN controller returns registration failure indication information to each device.

[0119] It is worth noting that the preset networking operation platform and the quantum security networking controller can be deployed on the same physical device or on different physical devices, and this embodiment does not specifically limit this.

[0120] S403. Register each device on the target cryptographic service platform according to the device identification of each device.

[0121] According to the device identification of each device, each device is registered under the target cryptographic service platform, that is, the first device is registered to the first cryptographic service platform, and the second device is registered to the second cryptographic service platform.

[0122] S404: If the registration is successful, the SDN controller returns registration success indication information and access authentication information to each device.

[0123] If the registration is successful, the quantum secure networking controller sends a successful registration indication message and access authentication information to the SDN controller, and the SDN controller forwards the successful registration indication message and access authentication information to the first device and the second device. The access authentication information is used to indicate that each device has successfully accessed the target cryptographic service platform.

[0124] Among them, the access authentication information can be an access token, and the session key distribution request also includes: access authentication information, so that when the first cryptographic service platform receives the session key distribution request, it can return the target session key to the vector network controller in response to the access authentication information.

[0125] The session key query request also includes: access authentication information, so that when the first cryptographic service platform receives the session key query request, it can return the target session key to the quantum security networking controller in response to the access authentication information.

[0126] The session key synchronization request also includes: access authentication information, so that when the first cryptographic service platform receives the session key synchronization request, it can respond to the access authentication information and synchronize the target session key to the second cryptographic service platform, and the second cryptographic service platform returns the target session key to the quantum security networking controller.

[0127] That is to say, when both the first device and the second device are successfully registered with the corresponding cryptographic service platform, the above session key distribution process is performed.

[0128] S405: If the registration fails, the SDN controller returns registration failure indication information to each device.

[0129] In this embodiment, based on the double-layer agent of SDN controller and quantum secure networking controller, the device is registered to the cryptographic service platform to ensure the security and efficiency of the registration process.

[0130] Figure 7 Schematic diagram of the process of quantum key distribution method provided in the embodiment of the present application Figure 5 ,like Figure 7 As shown, in an optional implementation, the above step S403, registering each device under the target cryptographic service platform according to the device identification of each device, includes:

[0131] S501. Send the device identification of each device to the target cryptographic service platform so that the target cryptographic service platform generates a first random number, and sends the first random number to the quantum security networking controller.

[0132] The quantum security networking controller sends the device identification of each device to the target cryptographic service platform. The target cryptographic service platform randomly generates a first random number corresponding to the device identification of each device and sends the first random number to the quantum security networking controller. The quantum security networking controller receives the first random number sent by the target cryptographic service platform.

[0133] S502: Send a first random number to each device through the SDN controller, so that each device performs an HMAC operation on the first random number and a randomly generated second random number according to a pre-filled key corresponding to each device to obtain an HMAC value, and sends a verification request to the quantum security networking controller through the SDN controller.

[0134] The quantum security networking controller sends a first random number to the SDN controller, and the SDN controller forwards the first random number to each device. Each device randomly generates a second random number based on the pre-filled key corresponding to each device, and performs HMAC operation on the first random number and the second random number according to the pre-filled key to obtain the HMAC value. Each device sends a verification request to the quantum security networking controller through the SDN controller, where the verification request includes: HMAC value and second random number.

[0135] The pre-charging key corresponding to each device is a charging key obtained in advance by each device through a charging outlet, and the pre-charging key is bound to the device identification of each device.

[0136] S503: Receive the verification request sent by each device through the SDN controller, and forward the verification request to the target cryptographic service platform, so that the target cryptographic service platform verifies the HMAC value.

[0137] The quantum secure networking controller receives the verification request sent by each device through the SDN controller, and forwards the verification request to the target cryptographic service platform. The target cryptographic service platform queries the pre-charged key of each device according to the device identification of each device, and performs HMAC operation on the first random number and the second random number according to the pre-charged key to obtain the HMAC value, and verifies the HMAC value in the verification request according to the HMAC value calculated by the target cryptographic service platform. If they are consistent, the verification passes and the registration is successful, that is, each device is successfully registered with the target cryptographic service platform. If they are inconsistent, the verification fails and the registration fails, that is, each device is not successfully registered with the target cryptographic service platform.

[0138] In this embodiment, based on the double-layer agent of SDN controller and quantum secure networking controller, the device is registered to the cryptographic service platform to ensure the security and efficiency of the registration process.

[0139] Taking the devices as the first device and the second device as an example, the following describes the combination of Figure 8The registration process of the double-layer key application agent of this application is described. Figure 8 A schematic diagram of a registration process of a double-layer key application agent provided by an embodiment of the present application is shown in FIG. Figure 8 As shown, the following steps are included:

[0140] Step 1: The device carries the unique device identifier and initiates a registration request to the SDN controller.

[0141] Step 2: The SDN controller forwards the registration request to the quantum secure networking controller.

[0142] Step 3: The quantum security networking controller receives the registration request and verifies whether the device exists on the preset networking operation platform. If not, it returns a registration failure indication to the device. If so, it queries the cryptographic service platform address corresponding to the device from the quantum business management platform.

[0143] Step 4: The quantum security networking controller queries the cryptographic service platform corresponding to the device from the quantum business management platform (CMSP), and obtains the random number a from the corresponding cryptographic service platform based on the unique identifier of the device.

[0144] Step 5: The SDN controller sends the random number a to the device. The device generates a random number b, calculates the HMAC value, and initiates a request to verify the HMAC value.

[0145] Step 6: The SDN controller forwards the verification request to the quantum security networking controller, and the quantum security networking controller sends the request to the corresponding cryptographic service platform.

[0146] Step 7: The corresponding cryptographic service platform verifies that the quantum secure networking controller and SDN controller return the result to the device. The device obtains the result and access token, and successfully registers on the cryptographic service platform.

[0147] In this embodiment, the high security of the device registration process is ensured through the collaborative work of the SDN controller and the quantum secure networking controller.

[0148] Combine the following Fig. 9 The session key distribution and query process of the double-layer key application agent of this application is described. Fig. 9 A schematic diagram of a session key distribution and query process of a double-layer key application agent provided in an embodiment of the present application, such as Fig. 9 As shown, the following steps are included:

[0149] Step 1: After successful registration, the first device initiator initiates a session key distribution application to the SDN controller with the device unique identifier.

[0150] Step 2: The quantum security networking controller obtains the session key distribution application forwarded by the SDN controller and queries the first cryptographic service platform corresponding to the first device from the quantum service management platform (CMSP).

[0151] Step 3: The quantum security networking controller applies for a session key from the first cryptographic service platform and returns the target session key.

[0152] Step 4: Return the target session key to the first device through the SDN controller.

[0153] Step 5: The first device obtains the target session key, carries the key identifier and the unique identifier of the local device, and applies to the second device to establish a session channel.

[0154] Step 6: The second device carries the unique identifier of the local device, the key identifier, and the unique identifier of the peer device to initiate a session key query request and sends it to the quantum security networking controller via the SDN controller.

[0155] Step 7: The quantum security networking controller double-layer agent queries the second cryptographic service platform corresponding to the second device from the quantum service management platform (CMSP).

[0156] Step 8: The quantum security networking controller queries the target session key from the second cryptographic service platform.

[0157] Step 9: Return the target session key to the second device through the SDN controller.

[0158] Step 10: The second device implements key negotiation between the first device and the second device, establishes a session channel, and sends a message that the session channel establishment is complete to the first device.

[0159] If cross-domain synchronization is triggered, the first cryptographic service platform synchronizes the target session key to the second cryptographic service platform and executes step 8. If cross-domain synchronization is not triggered, the quantum security networking controller queries the target session key from the first cryptographic service platform.

[0160] In this embodiment, a double-layer key proxy mechanism is implemented through the collaborative work of the SDN controller and the quantum secure networking controller, ensuring the high security of the key negotiation process between devices.

[0161] Fig.10 This is a structural diagram of a session key distribution device provided in an embodiment of the present application, which can be integrated in a quantum secure networking controller.

[0162] like Fig.10 As shown, the device may include:

[0163] The receiving module 601 is configured to receive a session key distribution request sent by a first device through an SDN controller, where the session key distribution request includes: a device identifier of the first device;

[0164] A determination module 602 is used to query and determine a first cryptographic service platform corresponding to the first device according to a device identifier of the first device;

[0165] A sending module 603 is used to forward the session key distribution request to the first cryptographic service platform, so that the first cryptographic service platform generates a target session key for the first device, and returns the target session key to the quantum secure networking controller;

[0166] The receiving module 601 is further configured to receive a target session key returned by the first cryptographic service platform, and send the target session key to the first device through the SDN controller, so that the first device triggers establishment of a session channel with the second device based on the target session key.

[0167] In an optional implementation manner, the receiving module 601 is further configured to:

[0168] receiving a session key query request sent by the second device through the SDN controller, where the session key query request includes: a key identifier of a target session key, where the key identifier is a key identifier obtained by the second device based on an application for establishing a session channel;

[0169] The device also includes:

[0170] An acquisition module 604 is used to acquire a target session key from the first cryptographic service platform according to the key identifier;

[0171] The sending module 603 is further configured to send the target session key to the second device through the SDN controller, so that the second device establishes a session channel according to the target session key.

[0172] In an optional implementation, the acquisition module 604 is specifically configured to:

[0173] According to the device identification of the first device and the device identification of the second device, query and determine whether the second cryptographic service platform corresponding to the second device and the first cryptographic service platform are the same cryptographic service platform;

[0174] If the second cryptographic service platform and the first cryptographic service platform are the same cryptographic service platform, a session key query request is sent to the first cryptographic service platform, the session key query request including: a key identifier, so that the first cryptographic service platform returns a target session key;

[0175] Receive the target session key returned by the first cryptographic service platform.

[0176] In an optional implementation, the acquisition module 604 is specifically configured to:

[0177] If the second cryptographic service platform and the first cryptographic service platform are different cryptographic service platforms, sending a session key synchronization request to the first cryptographic service platform so that the first cryptographic service platform synchronizes the target session key to the second cryptographic service platform;

[0178] Receive the target session key returned by the second cryptographic service platform.

[0179] In an optional implementation manner, the receiving module 601 is further configured to:

[0180] Receiving a registration request sent by each device in the first device and the second device through the SDN controller, the registration request including: a device identifier of each device;

[0181] The determination module 602 is further used to query and determine the target cryptographic service platform corresponding to each device according to the device identification of each device;

[0182] A registration module 605 is used to register each device under the target cryptographic service platform according to the device identification of each device;

[0183] The sending module 603 is further configured to return registration success indication information and access authentication information to each device through the SDN controller if the registration is successful;

[0184] The sending module 603 is further configured to return registration failure indication information to each device through the SDN controller if the registration fails.

[0185] In an optional implementation, the registration module 605 is specifically configured to:

[0186] Sending a device identification of each device to a target cryptographic service platform so that the target cryptographic service platform generates a first random number, and sending the first random number to a quantum security networking controller;

[0187] Sending a first random number to each device through the SDN controller, so that each device performs an HMAC operation on the first random number and a randomly generated second random number according to a pre-filled key corresponding to each device to obtain an HMAC value, and sending a verification request to the quantum security networking controller through the SDN controller, the verification request including: the HMAC value and the second random number;

[0188] The SDN controller receives the verification request sent by each device and forwards the verification request to the target cryptographic service platform so that the target cryptographic service platform verifies the HMAC value.

[0189] In an optional implementation, the determination module 602 is specifically configured to:

[0190] Determine whether a device identifier of each device exists among multiple device identifiers managed by a preset networking operation platform;

[0191] If the device identification of each device exists in the multiple device identifications, the target cryptographic service platform is queried and determined according to the device identification of each device.

[0192] In an optional implementation manner, the sending module 603 is further configured to:

[0193] If the device identifier of each device does not exist in the multiple device identifiers, the SDN controller returns registration failure indication information to each device.

[0194] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0195] Fig.11 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, and the electronic device can be implemented by the above-mentioned quantum secure networking controller.

[0196] like Fig.11 As shown, the device may include: a processor 701, a memory 702 and a bus 703. The memory 702 stores machine-readable instructions executable by the processor 701. When the electronic device is running, the processor 701 communicates with the memory 702 through the bus 703, and the processor 701 executes the machine-readable instructions to perform the above method.

[0197] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the above method.

[0198] In the embodiment of the present application, the computer program can also execute other machine-readable instructions when run by the processor to execute other methods described in the embodiment. For the specific execution method steps and principles, please refer to the description of the embodiment, which will not be repeated here.

[0199] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0200] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0201] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0202] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0203] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0204] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A session key distribution method, characterized in that: Applied to a quantum security networking controller, the method includes: receiving a session key distribution request sent by a first device through an SDN controller, wherein the session key distribution request includes: a device identifier of the first device; querying and determining, according to the device identifier of the first device, a first cryptographic service platform corresponding to the first device; Forwarding the session key distribution request to the first cryptographic service platform, so that the first cryptographic service platform generates a target session key for the first device, and returns the target session key to the quantum secure networking controller; The target session key is received from the first cryptographic service platform, and the target session key is sent to the first device through the SDN controller, so that the first device triggers establishment of a session channel with the second device based on the target session key.

2. The method according to claim 1, characterized in that: The method further comprises: receiving a session key query request sent by the second device through the SDN controller, the session key query request including: a key identifier of the target session key, the key identifier being a key identifier obtained by the second device based on an application for establishing the session channel; According to the key identifier, obtaining the target session key from the first cryptographic service platform; The target session key is sent to the second device through the SDN controller, so that the second device establishes the session channel according to the target session key.

3. The method according to claim 2, characterized in that The session key query request also includes: a device identification of the first device and a device identification of the second device; wherein the device identification of the first device is a device identification obtained by the second device based on the application for establishing the session channel; The acquiring the target session key from the first cryptographic service platform according to the key identifier includes: querying and determining, according to the device identification of the first device and the device identification of the second device, whether a second cryptographic service platform corresponding to the second device and the first cryptographic service platform are the same cryptographic service platform; If the second cryptographic service platform and the first cryptographic service platform are the same cryptographic service platform, sending the session key query request to the first cryptographic service platform, the session key query request including: the key identifier, so that the first cryptographic service platform returns the target session key; Receive the target session key returned by the first cryptographic service platform.

4. The method according to claim 3, characterized in that The acquiring the target session key from the first cryptographic service platform according to the key identifier further includes: If the second cryptographic service platform and the first cryptographic service platform are different cryptographic service platforms, sending a session key synchronization request to the first cryptographic service platform so that the first cryptographic service platform synchronizes the target session key to the second cryptographic service platform; Receive the target session key returned by the second cryptographic service platform.

5. The method according to any one of claims 1 to 4, characterized in that: Before receiving the session key distribution request sent by the first device through the SDN controller, the method further includes: receiving a registration request sent by each of the first device and the second device through the SDN controller, wherein the registration request includes: a device identifier of each of the devices; According to the device identification of each device, query and determine the target cryptographic service platform corresponding to each device; Registering each device under the target cryptographic service platform according to the device identification of each device; If the registration is successful, the SDN controller returns a successful registration indication message and access authentication information to each device; If the registration fails, the SDN controller returns registration failure indication information to each device.

6. The method according to claim 5, characterized in that The registering each device on the target cryptographic service platform according to the device identification of each device includes: Sending the device identification of each device to the target cryptographic service platform so that the target cryptographic service platform generates a first random number, and sending the first random number to the quantum secure networking controller; Sending the first random number to each device through the SDN controller, so that each device performs an HMAC operation on the first random number and a randomly generated second random number according to the pre-filled key corresponding to each device to obtain an HMAC value, and sending a verification request to the quantum security networking controller through the SDN controller, the verification request including: the HMAC value and the second random number; The verification request sent by each device is received through the SDN controller, and the verification request is forwarded to the target cryptographic service platform, so that the target cryptographic service platform verifies the HMAC value.

7. The method according to claim 5, characterized in that The querying and determining, according to the device identification of each device, a target cryptographic service platform corresponding to each device includes: Determine whether the device identifier of each device exists among multiple device identifiers managed by the preset networking operation platform; If the device identification of each device exists in the multiple device identifications, the target cryptographic service platform is queried and determined according to the device identification of each device.

8. The method according to claim 7, characterized in that The method further comprises: If the device identifier of each device does not exist in the multiple device identifiers, indication information of registration failure is returned to each device through the SDN controller.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and the processor executes the machine-readable instructions to perform the method described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is executed.

Images