Quantum key distribution method and device, related equipment, storage medium and computer program product

Abstract

The invention discloses a quantum key distribution method and device, related equipment, a storage medium and a computer program product. The method comprises the following steps: a first device receives first information sent by a first client, the first information is used for requesting a quantum key for quantum secret communication, and the first information comprises identification information of a first quantum key; sending the first information to a second device, wherein the second device is at least used for managing a quantum key; and receiving second information sent by the second device, and forwarding the second information to the first client, the second information including one or more second quantum keys encrypted by using the first quantum key, and the second quantum keys being used for the first client to perform quantum secret communication.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a quantum key distribution method, apparatus, related equipment, storage medium and computer program product. Background Art

[0002] In the related technology, in order to realize quantum secure communication, a quantum key distribution (QKD) device (hereinafter referred to as QKD device) is usually set for each device at both ends of the communication. The two QKD devices interact through a quantum communication network, generate the same quantum key, and send the generated quantum key to the corresponding devices respectively. In this way, the devices at both ends of the communication obtain the same quantum key and can use the quantum key to encrypt and decrypt the communication content, thereby realizing quantum secure communication.

[0003] However, in practical applications, there is currently no effective solution for how to efficiently distribute quantum keys. Summary of the invention

[0004] To solve related technical problems, the embodiments of the present application provide a quantum key distribution method, apparatus, related equipment, storage medium and computer program product.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present application provides a quantum key distribution method, which is applied to a first device. The method includes:

[0007] Receiving first information sent by a first client, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0008] Sending the first information to a second device, where the second device is at least used to manage quantum keys;

[0009] Receive second information sent by the second device, and forward the second information to the first client, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0010] In the above solution, communication is performed with the first client via an established first channel, and the first channel is used for quantum secure communication between the first device and the first client.

[0011] In the above scheme, the method further comprises:

[0012] receiving third information sent by the first client, where the third information is used to request to establish the first channel, and the third information includes identification information of a third quantum key;

[0013] Sending fourth information to the second device, where the fourth information is used to obtain the third quantum key, and the fourth information includes the third information;

[0014] Receiving the third quantum key sent by the second device;

[0015] The first channel is established using the third quantum key.

[0016] In the above scheme, the method further comprises:

[0017] receiving fifth information sent by the first client, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client;

[0018] authenticating the first credential through a server, the server being at least used to provide business services to the first client;

[0019] If the first credential is authenticated successfully, sending a second credential to the first client, so that the first client can use the first credential and the second credential to activate the quantum secure communication capability, wherein the second credential represents authorization for the first client to activate the quantum secure communication capability;

[0020] Upon receiving an authentication request from the server for the second credential, the second credential is authenticated; and if the second credential is authenticated successfully, quantum secure communication capability is activated for the first client.

[0021] In the above scheme, communication is performed with the server via an established second channel, and the second channel is used for quantum secure communication between the first device and the server.

[0022] In the above scheme, the method further comprises:

[0023] receiving sixth information sent by the server, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of a fourth quantum key;

[0024] Sending seventh information to the second device, where the seventh information is used to obtain the fourth quantum key, and the seventh information includes the sixth information;

[0025] Receiving the fourth quantum key sent by the second device;

[0026] The second channel is established using the fourth quantum key.

[0027] In the above scheme, the method further comprises:

[0028] receiving eighth information sent by the server, where the eighth information is used to register the server on the first device;

[0029] Ninth information is sent to the second device, where the ninth information is used to request the second device to assign multiple fifth quantum keys to the server, so that the server and a client associated with the server can establish a channel for quantum secure communication, where the multiple fifth quantum keys include at least the first quantum key, the third quantum key and the fourth quantum key, the client associated with the server includes at least the first client, and the channel for quantum secure communication includes at least the first channel and the second channel.

[0030] In the above scheme, the method further comprises:

[0031] Sending tenth information to the second device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a quantum random number generator QRNG, and where the sixth quantum keys are used for the first client to perform quantum secure communication;

[0032] Receive eleventh information sent by the second device, and forward the eleventh information to the first client, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

[0033] In the above scheme, the method further comprises:

[0034] receiving twelfth information sent by a second client, the twelfth information being used to request to obtain one or more sixth quantum keys of the one or more sixth quantum keys, wherein the second client includes a client performing quantum secure communication with the first client;

[0035] One or more sixth quantum keys are sent to the second client.

[0036] The embodiment of the present application further provides a quantum key distribution method, which is applied to a second device, where the second device is at least used to manage quantum keys, and the method includes:

[0037] receiving first information sent by a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0038] Sending second information to the first device so that the first device forwards the second information to the first client, wherein the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0039] In the above scheme, the method further comprises:

[0040] receiving tenth information sent by the first device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a QRNG, and where the sixth quantum keys are used by the first client to perform quantum secure communication;

[0041] Sending eleventh information to the first device, so that the first device forwards the eleventh information to the first client, wherein the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

[0042] In the above scheme, the method further comprises:

[0043] receiving fourth information sent by the first device, where the fourth information includes third information, the third information includes identification information of a third quantum key, and the fourth information is used to obtain the third quantum key;

[0044] The third quantum key is sent to the first device; wherein the third quantum key is used for the first device to establish a first channel, and the first channel is used for the first device to perform quantum secure communication with a first client.

[0045] In the above scheme, the method further comprises:

[0046] receiving seventh information sent by the first device, where the seventh information includes sixth information, the sixth information includes identification information of a fourth quantum key, and the seventh information is used to obtain the fourth quantum key;

[0047] Sending the fourth quantum key to the first device; wherein the fourth quantum key is used for the first device to establish a second channel, the second channel is used for the first device to perform quantum secure communication with a server, and the server is at least used to provide business services for the first client.

[0048] In the above scheme, the method further comprises:

[0049] Receive ninth information sent by the first device, where the ninth information is used to request the second device to allocate multiple fifth quantum keys to the server, so that the server and the client associated with the server can establish a channel for quantum secure communication; wherein the multiple fifth quantum keys at least include the first quantum key, the third quantum key and the fourth quantum key; the third quantum key is used to establish a first channel, where the first channel is used for the first device to perform quantum secure communication with the first client; the fourth quantum key is used to establish a second channel, where the second channel is used for the first device to perform quantum secure communication with the server; the server is at least used to provide business services for the first client, and the channel for quantum secure communication includes at least the first channel and the second channel;

[0050] Allocate the plurality of fifth quantum keys to the server.

[0051] The embodiment of the present application also provides a quantum key distribution method, which is applied to a first client, and the method includes:

[0052] Sending first information to a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0053] Receive second information forwarded by the first device from a second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

[0054] In the above scheme, the method further comprises:

[0055] Sending fifth information to the first device, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client;

[0056] Receiving a second credential sent by the first device, where the second credential represents authorization for the first client to activate quantum secure communication capability;

[0057] Sending thirteenth information to the server, where the thirteenth information is used to request activation of quantum secure communication capability, the thirteenth information includes the first certificate and the second certificate, and the server is at least used to provide business services for the first client;

[0058] Receive information related to activating quantum secure communication capability sent by the first device.

[0059] In the above scheme, the method further comprises:

[0060] A plurality of fifth quantum keys and the first certificate are obtained from the server, wherein the plurality of fifth quantum keys at least include the first quantum key and a third quantum key, the third quantum key is used to establish a first channel, and the first channel is used to perform quantum secure communication with the first device.

[0061] In the above scheme, the method further comprises:

[0062] Sending third information to the first device, where the third information is used to request to establish a first channel, and the third information includes identification information of the third quantum key.

[0063] In the above scheme, the method further comprises:

[0064] Receive eleventh information sent by the first device, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key, where the sixth quantum key is generated by a QRNG, and where the sixth quantum key is used for the first client to perform quantum secure communication.

[0065] The embodiment of the present application also provides a quantum key distribution method, which is applied to a server, and the server is at least used to provide a business service for a first client. The method includes:

[0066] Upon receiving an authentication request from a first device for a first credential, authenticating the first credential; the first credential represents the identity of the first client;

[0067] When the thirteenth information sent by the first client is received, the second credential is authenticated by the first device so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated. The thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

[0068] In the above scheme, the method further comprises:

[0069] Sending eighth information to the first device, where the eighth information is used to register the server on the first device;

[0070] Acquire a plurality of fifth quantum keys allocated to the server from the second device, wherein the plurality of fifth quantum keys at least include a third quantum key and a fourth quantum key; the third quantum key is used to establish a first channel, and the first channel is used for the first client to perform quantum secure communication with the first device; the fourth quantum key is used to establish a second channel, and the second channel is used for the server to perform quantum secure communication with the first device;

[0071] The second channel is established using the fourth quantum key, and the third quantum key is sent to the first client so that the first client can establish the first channel with the first device.

[0072] In the above solution, sending the third quantum key to the first client includes:

[0073] receiving identity authentication information of the first client;

[0074] In a case where the identity authentication of the first client is passed, a third quantum key and a first certificate are provided to the first client, where the first certificate represents the identity of the first client.

[0075] In the above solution, the step of establishing the second channel by using the fourth quantum key includes:

[0076] Sending sixth information to the first device, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of the fourth quantum key.

[0077] The embodiment of the present application also provides a quantum key distribution device, including:

[0078] A first receiving unit is configured to receive first information sent by a first client, the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and receive second information sent by a second device, the second information includes one or more second quantum keys encrypted using the first quantum key, the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys;

[0079] The first sending unit is used to send the first information to the second device, and forward the second information to the first client.

[0080] The embodiment of the present application also provides a quantum key distribution device, including:

[0081] A second receiving unit is configured to receive first information sent by a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0082] The second sending unit is used to send second information to the first device, so that the first device forwards the second information to the first client, the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0083] The embodiment of the present application also provides a quantum key distribution device, which is arranged on a first client and includes:

[0084] A third sending unit is configured to send first information to the first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0085] The third receiving unit is used to receive second information forwarded by the first device from the second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

[0086] The embodiment of the present application further provides a quantum key distribution device, which is arranged at a server end, and the server end is at least used to provide business services for a first client, including:

[0087] A first authentication unit, configured to authenticate a first credential upon receiving an authentication request for a first credential from a first device; the first credential represents an identity of the first client;

[0088] The second authentication unit is used to authenticate the second credential through the first device when receiving the thirteenth information sent by the first client, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated. The thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

[0089] The embodiment of the present application further provides a first device, comprising: a first processor and a first communication interface; wherein,

[0090] The first communication interface is used to receive first information sent by a first client, the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; send the first information to a second device, the second device is at least used to manage quantum keys; and receive second information sent by the second device and forward the second information to the first client, the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0091] The embodiment of the present application further provides a second device, which is at least used to manage quantum keys, including: a second processor and a second communication interface; wherein,

[0092] The second communication interface is used to receive first information sent by a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and to send second information to the first device so that the first device forwards the second information to a first client, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0093] The embodiment of the present application further provides a client, comprising: a third processor and a third communication interface; wherein,

[0094] The third communication interface is used to send first information to the first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and receive second information forwarded by the first device from the second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

[0095] The embodiment of the present application further provides a server, which is at least used to provide business services for the first client, including: a fourth processor and a fourth communication interface; wherein,

[0096] The fourth processor is configured to authenticate the first credential when an authentication request for a first credential is received from the first device through the fourth communication interface; the first credential represents the identity of the first client; and when thirteenth information sent by the first client is received through the fourth communication interface, authenticate the second credential through the first device, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated, the thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

[0097] The embodiment of the present application further provides a first device, comprising: a first processor and a first memory for storing a computer program that can be run on the processor,

[0098] Wherein, when the first processor is used to run the computer program, it executes the steps of any one of the above-mentioned methods on the first device side.

[0099] The embodiment of the present application further provides a second device, comprising: a second processor and a second memory for storing a computer program that can be run on the processor,

[0100] Wherein, the second processor is used to execute the steps of any one of the above-mentioned methods on the second device side when running the computer program.

[0101] The embodiment of the present application further provides a client, comprising: a third processor and a third memory for storing a computer program that can be run on the processor,

[0102] The third processor is used to execute the steps of any one of the above-mentioned methods on the first client side when running the computer program.

[0103] The embodiment of the present application further provides a server, comprising: a fourth processor and a fourth memory for storing a computer program that can be run on the processor,

[0104] The fourth processor is used to execute the steps of any one of the above-mentioned methods on the server side when running the computer program.

[0105] An embodiment of the present application also provides a storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program implements the steps of any method on the first device side, or implements the steps of any method on the second device side, or implements the steps of any method on the first client side, or implements the steps of any method on the server side.

[0106] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any method on the first device side, or implements the steps of any method on the second device side, or implements the steps of any method on the first client side, or implements the steps of any method on the server side.

[0107] In the quantum key distribution method, apparatus, related equipment, storage medium and computer program product provided by the embodiments of the present application, a first client sends first information to a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; after the first device receives the first information sent by the first client, the first device sends the first information to a second device, where the second device is at least used to manage quantum keys; after the second device receives the first information sent by the first device, the second device sends second information to the first device, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication; after the first device receives the second information sent by the second device, it forwards the second information to the first client. The solution provided by the embodiment of the present application is that the second device for managing quantum keys distributes quantum keys to the client through the first device. In the scenario where the first client and the second client need to perform quantum secure communication, the first client and the second client correspond to a first device and a second device respectively, and can obtain the quantum key through the above process. At this time, since the first client is not directly connected to the second device, the first client can obtain the quantum key in the second device corresponding to the first client through the first device corresponding to the first client, and can also obtain the quantum key in the second device corresponding to the second client through the first device corresponding to the second client. In this way, when the second device corresponding to the first client distributes the quantum key to the first client, it does not need to synchronize with the second device corresponding to the second client, and can directly distribute the quantum key to the first client efficiently. Even if the quantum keys obtained by the first client and the second client are not exactly the same, the second client can also obtain the quantum key that has not been obtained through the first device and the second device corresponding to the first client when negotiating the quantum key for quantum secure communication with the first client. It can be seen that the solution provided by the embodiment of the present application can realize the efficient distribution of quantum keys to clients with quantum secure communication needs.

[0108] At the same time, upon receiving an authentication request from the first device for the first credential, the server authenticates the first credential; the first credential represents the identity of the first client; upon receiving the thirteenth information sent by the first client, the server authenticates the second credential through the first device, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated, and the thirteenth information contains the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability. In the solution provided in the embodiment of the present application, the server and the first device verify the identity of the first client by authenticating the credential, and activate the quantum secure communication capability for the first client, so that the first client can obtain the quantum key and conduct quantum secure communication, thereby improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0109] Figure 1 It is a schematic diagram of the structure of a quantum key distribution system in the related technology;

[0110] Figure 2 It is a schematic diagram of the structure of another quantum key distribution system in the related art;

[0111] Figure 3 This is a flow chart of the first quantum key distribution method according to an embodiment of the present application;

[0112] Figure 4 This is a flow chart of the second quantum key distribution method according to an embodiment of the present application;

[0113] Figure 5 This is a flow chart of the third quantum key distribution method according to an embodiment of the present application;

[0114] Figure 6 This is a flow chart of the fourth quantum key distribution method according to an embodiment of the present application;

[0115] Figure 7 This is a flow chart of the fifth quantum key distribution method according to an embodiment of the present application;

[0116] Figure 8 A schematic diagram of a quantum key proxy distribution system for multiple terminals is provided as an example for the application of this application;

[0117] Fig. 9 A flowchart of a quantum key proxy distribution method for multiple terminals is provided as an example of the application of this application;

[0118] Fig.10 This is a schematic diagram of the structure of the first quantum key distribution device according to an embodiment of the present application;

[0119] Fig.11This is a schematic diagram of the structure of the second quantum key distribution device according to an embodiment of the present application;

[0120] Fig.12 This is a schematic diagram of the structure of the third quantum key distribution device according to the embodiment of the present application;

[0121] Fig.13 This is a schematic diagram of the structure of the fourth quantum key distribution device according to an embodiment of the present application;

[0122] Fig.14 This is a schematic diagram of the first device structure of the embodiment of the present application;

[0123] Fig.15 This is a schematic diagram of the second device structure of the embodiment of the present application;

[0124] Fig.16 This is a schematic diagram of the client structure of an embodiment of the present application;

[0125] Fig.17 This is a schematic diagram of the server structure of an embodiment of the present application;

[0126] Fig.18 This is a schematic diagram of the structure of the quantum key distribution system according to an embodiment of the present application. DETAILED DESCRIPTION

[0127] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0128] Quantum secure communication (also known as quantum encryption communication) technology is a communication technology that uses the principles of quantum mechanics to achieve secure information transmission. In order to achieve quantum secure communication, it is necessary to distribute the same quantum key (also known as a security key or quantum security key) to the devices at both ends of the communication, so that the devices at both ends of the communication can obtain the same quantum key and use the obtained quantum key to encrypt and decrypt the communication information (hereinafter referred to as encryption and decryption), thereby ensuring the security of the communication. Here, the devices at both ends of the communication can also be referred to as clients, which can specifically include terminals and other devices.

[0129] In related technologies, quantum keys are usually distributed in the following two ways:

[0130] The first option: Figure 1As shown, assuming that terminal A and terminal B need to conduct quantum secure communication, terminal A located in metropolitan area network A is connected to the QKD-A device also located in metropolitan area network A (can also be understood as docking), and terminal B located in metropolitan area network B is connected to the QKD-B device also located in metropolitan area network B. The QKD-A device and the QKD-B device are connected through the QKD network, and the QKD-A device can generate the same quantum key together with the QKD-B device. When terminal A is the initiator of quantum secure communication and terminal B is the receiver of quantum secure communication, the process of terminal A and terminal B obtaining quantum keys includes: terminal A sends request information to QKD-A device, and the request information sent is used to request to obtain quantum keys; after receiving the request information, QKD-A device negotiates with QKD-B device through QKD network and determines (can also be understood as generating) a quantum key (can also be understood as generating the same quantum key in QKD-A device and QKD-B device respectively); QKD-A device returns (can also be understood as sending) the generated quantum key to terminal A; at the same time, QKD-B device pushes (can also be understood as sending) the same quantum key to terminal B; so that terminal A and terminal B obtain the same quantum key. In this way, when terminal A and terminal B communicate in a traditional communication network (such as a wide area network), the acquired quantum key can be used to encrypt and decrypt the communication information to realize quantum secure communication. The method of distributing quantum keys through this scheme can also be called classical quantum key distribution, and the method of realizing quantum secure communication through this scheme can also be called "one-time one-key".

[0131] The second option: Figure 2As shown, the QKD-A device located in metropolitan area network A is connected to the quantum key management platform A also located in metropolitan area network A, and the QKD-B device located in metropolitan area network B is connected to the quantum key management platform B also located in metropolitan area network B; the quantum keys generated by the QKD-A device and the QKD-B device through the quantum communication network can be stored in the corresponding quantum key management platform respectively, and at the same time, the quantum key management platform A communicates with the quantum key management platform through the established virtual private network (VPN, Virtual Private Network) channel to synchronously manage the quantum keys stored in the two quantum key management platforms (that is, to ensure that the quantum keys stored in the two quantum key management platforms are the same), and each quantum key management platform can be connected to one or more (one or more can also be understood as at least one) terminals, and distribute quantum keys to the connected terminals. Assume that terminal A is connected to quantum key management platform A, terminal B is connected to quantum key management platform B, and terminal A and terminal B need to perform quantum confidentiality communication. In the case where terminal A is the initiator of quantum secure communication and terminal B is the receiver of quantum secure communication, the process of terminal A and terminal B obtaining quantum keys includes: before obtaining the quantum key, terminal A needs to install an application (APP) corresponding to quantum key management platform A on terminal A, such as one or more of a software development kit (SDK), a browser plug-in, etc. (one or more may also be understood as at least one), and pre-charge a part of the quantum key in terminal A by offline charging (such as importing through a quantum key storage medium, etc.); in this way, when terminal A obtains the quantum key, it can use the installed APP to establish a quantum secure communication channel with quantum key management platform A through the offline charged quantum key; quantum key management platform A uses the established channel to authenticate terminal A (which can also be understood as identity verification); if the identity authentication is passed, quantum key management platform A charges quantum keys to terminal A online; at the same time, terminal B can obtain the same quantum key from quantum key management platform B in the same way, so that terminal A and terminal B obtain the same quantum key. In this way, when terminal A and terminal B communicate in a traditional communication network (such as a wide area network), they can use the acquired quantum key to encrypt and decrypt the communication information to achieve quantum secure communication. The method of distributing quantum keys through this scheme can also be called quantum key distribution through a quantum key management platform.

[0132] However, in actual applications, the quantum keys generated by QKD devices cannot be efficiently distributed to multiple clients with quantum secure communication needs.

[0133] Specifically, for the first solution mentioned above, when any two clients conduct quantum secure communication, it is necessary to deploy corresponding QKD devices for the two clients respectively, so as to distribute quantum keys to the clients through the QKD devices. At this time, in order to ensure the security of quantum keys during transmission, the QKD device needs to be deployed in the same local area network as the corresponding client. Therefore, when multiple terminals located in different local area networks need to conduct quantum secure communication, one or more QKD devices need to be deployed in each local area network, that is, a large number of QKD devices need to be deployed to achieve quantum secure communication. However, before the QKD device distributes quantum keys to the client, it is necessary to ensure that the quantum keys received by the two clients conducting quantum secure communication are consistent. When a large number of QKD devices are deployed, a large amount of time resources are required to synchronize quantum keys between multiple QKD devices, which will result in low efficiency in quantum key distribution. It is difficult for the client to obtain sufficient quantum keys in time for encryption and decryption of quantum secure communication, thereby affecting the efficiency of quantum secure communication.

[0134] For the second solution mentioned above, the QKD device stores the generated quantum key in the quantum key management platform, and then the quantum key management platform distributes the quantum key to the terminal. At this time, the quantum key management platform is directly connected to the client. In order to ensure the security of the quantum key during the transmission process, each client needs to first charge the quantum key offline and install the APP corresponding to the quantum key management platform, and then use the APP to establish a quantum secure communication channel between the client and the quantum key management platform through the offline charged quantum key, and then perform identity authentication through the established channel. Only when the authentication is passed, the client can access the corresponding quantum key management platform and obtain the quantum key from the accessed quantum key management platform. In actual application, after the client installs the APP corresponding to a quantum key management platform, it can only use the installed APP to access the quantum key management platform, but cannot access other quantum key management platforms. In other words, the quantum key management platform has low compatibility and applicability to the client, and can only provide quantum key distribution services for specific clients (which can also be understood as customized clients, such as clients with corresponding APPs installed), and has low flexibility. In this case, in order to ensure that the quantum keys received by the clients at both ends of the communication are consistent, the quantum key management platforms corresponding to the two clients need to synchronize the quantum keys through the established VPN channel. Since additional encryption and decryption processes are required when transmitting data in the VPN channel, the synchronization efficiency of the quantum keys between the quantum key management platforms will be low, which will lead to the reduction of the efficiency of the quantum key management platform in distributing quantum keys to the terminals, which will make it difficult for the terminals to obtain the quantum keys in a timely manner, affecting the communication efficiency of the terminals.

[0135] Based on this, in various embodiments of the present application, the second device for managing quantum keys distributes quantum keys to the client through the first device. In the scenario where the first client and the second client need to perform quantum secure communication, the first client and the second client correspond to a first device and a second device respectively, and can obtain the quantum key through the above process. At this time, since the first client is not directly connected to the second device, the first client can obtain the quantum key in the second device corresponding to the first client through the first device corresponding to the first client, and can also obtain the quantum key in the second device corresponding to the second client through the first device corresponding to the second client. In this way, when the second device corresponding to the first client distributes the quantum key to the first client, it does not need to synchronize with the second device corresponding to the second client, and can directly distribute the quantum key to the first client efficiently. Even if the quantum keys obtained by the first client and the second client are not exactly the same, the second client can also obtain the quantum key that has not been obtained through the first device and the second device corresponding to the first client when negotiating the quantum key for quantum secure communication with the first client. It can be seen that the solution provided in the embodiment of the present application can realize the efficient distribution of quantum keys to clients with quantum secure communication needs.

[0136] The present application embodiment provides a quantum key distribution method, which is applied to a first device, such as Figure 3 As shown, the method includes:

[0137] Step 301: receiving first information sent by a first client, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0138] Step 302: Sending the first information to a second device, where the second device is at least used to manage quantum keys;

[0139] Step 303: Receive second information sent by the second device, and forward the second information to the first client, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0140] Here, in actual application, the first client refers to: a device that needs to perform quantum secure communication (i.e., has a demand for quantum secure communication), which may specifically include a terminal, etc.; at the same time, the first client can be both the initiator and the receiver of quantum secure communication; the first client can also be called a client or a service client. The embodiment of the present application does not limit the name of the first client, as long as its function is realized.

[0141] In the case where the first client needs to perform quantum secure communication with other clients, the first client can obtain the quantum key stored in the second device through the first device, that is, the second device can distribute the quantum key to the first client through the first device. Wherein, the first device has established a connection with the second device before the first client requests to obtain the quantum key, and the second device stores multiple quantum keys. The first device can also be called a quantum key distribution agent, and the second device can also be called a quantum key management device or a quantum key management platform. The embodiments of this application do not limit the names of the first device and the second device, as long as their functions are realized.

[0142] In actual application, the process of establishing a connection between the first device and the second device may specifically include: the first device obtains part of the quantum key in advance through a quantum key storage medium (such as a universal serial bus (USB) key (Ukey, USB Key), etc.), and sends identity authentication information to the second device through the APP corresponding to the second device (such as one or more of SDK, plug-in, etc.); the second device authenticates the first device according to the received identity authentication information; if the authentication is successful, the first device establishes a quantum secure communication channel (i.e., establishes a connection) with the second device through the pre-acquired quantum key. Here, establishing a quantum secure communication channel through a quantum key means that the two communicating parties determine a quantum key through negotiation. When both parties obtain the quantum key, the side sending the information uses the quantum key to encrypt the communication information, and the side receiving the information uses the quantum key to decrypt the communication information. Since only the two communicating parties know the specific quantum key used, the security of the communication information can be effectively guaranteed.

[0143] The specific process of the second device acquiring multiple quantum keys may include: after one or more QKD devices generate quantum keys, and / or after one or more QRNG devices generate quantum random numbers, the generated quantum keys and / or quantum random numbers are sent to the second device through the quantum key access gateway, and the second device receives and stores these quantum keys and / or quantum random numbers. Among them, the second device can be connected to the quantum key access gateway, and the quantum key gateway can be connected to one or more QKD devices and / or one or more QRNG devices; the QRNG device refers to: a device that can generate quantum random numbers; the QKD device refers to: a device that can generate quantum keys; in actual application, the QKD devices are usually deployed in pairs; a pair of QKD devices can be deployed in different metropolitan area networks respectively, and are connected to the second devices corresponding to their respective metropolitan area networks through the quantum key access gateways in their respective metropolitan area networks; a pair of QKD devices can specifically communicate quantumly through optical fibers, and generate the same quantum keys in a pair of QKD devices through negotiation.

[0144] In actual application, the second device can obtain the identification information corresponding to each quantum key and / or quantum random number (which can also be understood as a quantum identification, specifically including a quantum ID (QID, Quantum ID)) while obtaining the quantum key and / or quantum random number; or, the second device can also generate the identification information corresponding to each quantum key and / or quantum random number based on a preset algorithm after obtaining the quantum key and / or quantum random number. In this way, when the second device distributes quantum keys to related devices (such as clients, etc.), it can simultaneously inform the related devices of the identification information corresponding to each quantum key, so that when the related devices communicate with other devices, the identification information of the quantum key can be used to refer to the corresponding quantum key, thereby avoiding the leakage of the quantum key caused by directly sending the quantum key.

[0145] In order to ensure the security of communication between the first device and the first client, before step 301, a quantum secure communication channel may be established between the first device and the first client, so that the first device and the first client communicate through the established channel. That is, in one embodiment, the first device communicates with the first client through the established first channel, and the first channel is used for the first device and the first client to perform quantum secure communication. Here, the first channel may also be referred to as a quantum secure communication channel, and the embodiment of the present application does not limit the name of the first channel.

[0146] In actual application, the specific implementation of the first client establishing the first channel may include: the first client pre-acquires a part of the quantum key, and establishes the first channel with the first device through the acquired quantum key. Among them, the first client may pre-acquire one or more quantum keys from a quantum key storage medium by offline import, and the quantum key storage medium contains the quantum key copied from the second device. Here, the method of offline acquisition of quantum keys through quantum key storage media and the like may also be referred to as offline charging of quantum keys, referred to as offline charging.

[0147] However, in actual application, the number of clients that need to perform quantum secure communication may be large, and the second device needs to consume a large amount of resources to fill the corresponding quantum key for each first client offline, which is inefficient.

[0148] Based on this, the second device can charge quantum keys offline at the granularity of the server (also called the business server or business server), and the server refers to: a device that provides services to one or more (one or more can also be understood as at least one) clients when performing quantum secure communication services. That is to say, for each server, the second device charges the quantum keys used by one or more clients served by the server to establish the corresponding first channel to the server at one time offline; in this way, after the server obtains multiple quantum keys charged offline, it can send part of the quantum keys to each client connected to the server, so that each client can use the obtained quantum keys to establish the first channel. Among them, the one or more clients at least include the first client.

[0149] In actual application, the second device can first learn which server terminals have quantum secure communication services (which can also be understood as services for quantum secure communication through a wide area network), and then offline recharge quantum keys for the server terminals with quantum secure communication services.

[0150] Based on this, in one embodiment, the method may further include:

[0151] The first device receives eighth information sent by the server, where the eighth information is used to register the server on the first device;

[0152] Ninth information is sent to the second device, where the ninth information is used to request the second device to assign multiple fifth quantum keys to the server, so that the server and a client associated with the server can establish a channel for quantum secure communication, where the multiple fifth quantum keys include at least the first quantum key, the third quantum key and the fourth quantum key, the client associated with the server includes at least the first client, and the channel for quantum secure communication includes at least the first channel and the second channel.

[0153] Here, the server refers to a server with a quantum secure communication service, and the server sends the eighth information to the first device to inform the first device that the server has a quantum secure communication service and needs to be charged with a quantum key offline. The eighth information can also be understood as registration information, which can specifically include the identification information of the server, etc. The embodiment of the present application does not limit the name of the eighth information.

[0154] After receiving the eighth information, the first device may send the ninth information to the second device to instruct the second device to charge the server with quantum keys (i.e., the plurality of fifth quantum keys) offline. The ninth information may also be referred to as offline charging request information, and the embodiment of the present application does not limit the name of the ninth information.

[0155] In actual application, the second device can allocate multiple fifth quantum keys to the server through the aforementioned offline filling method; of course, the second device can also allocate multiple fifth quantum keys to the server through other methods (such as dedicated line confidential transmission, etc.), and this embodiment of the application is not limited to this.

[0156] After the server obtains multiple fifth quantum keys, it can use the quantum keys among the multiple fifth quantum keys to establish a channel for quantum secure communication with the first device, thereby ensuring the communication security between the server and the first device.

[0157] Based on this, in one embodiment, the method may further include:

[0158] receiving sixth information sent by the server, where the sixth information is used to request to establish a second channel, where the sixth information includes identification information of a fourth quantum key, and the second channel is used for quantum secure communication between the first device and the server;

[0159] Sending seventh information to the second device, where the seventh information is used to obtain the fourth quantum key, and the seventh information includes the sixth information;

[0160] Receiving the fourth quantum key sent by the second device;

[0161] The second channel is established using the fourth quantum key.

[0162] Here, the second channel can also be called a quantum secure communication channel, and the present embodiment of the application does not limit the name of the second channel. The fourth quantum key refers to: the quantum key used for quantum secure communication between the first device and the server, and the present embodiment of the application does not limit the specific name of the fourth quantum key. Among them, the multiple fifth keys at least include the fourth quantum key.

[0163] In actual application, in order to avoid leakage of the fourth quantum key, when the server informs the first device of the fourth quantum key, it may not directly send the fourth quantum key, but send the identification information corresponding to the fourth quantum key (i.e., the sixth information) to the first device; after the first device receives the identification information corresponding to the fourth quantum key, it sends the seventh information to the second device to request to obtain the specific quantum key corresponding to the identification information (i.e., obtain the fourth quantum key). After obtaining the fourth quantum key corresponding to the second channel, the first device can use the fourth quantum key for encryption and decryption when conducting quantum secure communication with the server. That is to say, in one embodiment, the first device communicates with the server through the established second channel.

[0164] In actual application, when the server provides services for at least the first client, after the server obtains multiple fifth information, it can distribute part of the quantum key to the first client.

[0165] Specifically, the first client can perform identity authentication with the network side through the server (specifically, it can include identity card authentication, biometric identification, mobile phone number dynamic password, etc.). When the identity authentication is passed, the server distributes one or more quantum keys to the first client in an encrypted manner (such as pre-configured public and private keys, quantum key storage media, etc.). In this way, after the first client obtains the quantum key, it can use the obtained quantum key to establish the first channel with the first device.

[0166] Based on this, in one embodiment, the method may further include:

[0167] receiving third information sent by the first client, where the third information is used to request to establish the first channel, and the third information includes identification information of a third quantum key;

[0168] Sending fourth information to the second device, where the fourth information is used to obtain the third quantum key, and the fourth information includes the third information;

[0169] Receiving the third quantum key sent by the second device;

[0170] The first channel is established using the third quantum key.

[0171] Here, the third quantum key refers to: the quantum key used for encryption and decryption when the first device and the first client perform quantum secure communication. The specific name of the third quantum key is not limited in this embodiment of the application. Among them, the multiple fifth keys at least include the third quantum key.

[0172] In actual application, the specific process of establishing the first channel between the first device and the first client can be understood by referring to the process of establishing the second channel between the first device and the server, which will not be repeated here.

[0173] In actual application, the first client can request to obtain a quantum key and perform quantum secure communication with other clients only after activating (or also being understood as having) the quantum secure communication capability. Based on this, after establishing the first channel, the first client can interact with the first device through the first channel, thereby activating the quantum secure communication capability.

[0174] Specifically, the first client can obtain a credential for activating the quantum secure communication capability through the first device and the server, and activate the quantum secure communication capability if the credential authentication passes.

[0175] Based on this, in one embodiment, the method may further include:

[0176] receiving fifth information sent by the first client, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client;

[0177] authenticating the first credential through a server, the server being at least used to provide business services to the first client;

[0178] If the first credential is authenticated successfully, sending a second credential to the first client, so that the first client can use the first credential and the second credential to activate the quantum secure communication capability, wherein the second credential represents authorization for the first client to activate the quantum secure communication capability;

[0179] Upon receiving an authentication request from the server for the second credential, the second credential is authenticated; and if the second credential is authenticated successfully, quantum secure communication capability is activated for the first client.

[0180] Here, in actual application, the first client sends the fifth information to the first device through the first channel to request to enable quantum secure communication capability for the first client; wherein the fifth information includes the first credential, which can also be called a user credential (also understood as a user token (expressed as Token in English)), and the first credential refers to: when the first client passes the identity authentication with the network side through the server, the credential sent by the server to the first client. The specific names of the first credential and the fifth information are not limited in this embodiment of the application.

[0181] After receiving the fifth information, the first device may send the first credential to the server through the second channel to request the server to authenticate the first credential, and receive the authentication result fed back by the server.

[0182] If the authentication result indicates that the first credential has passed the authentication, the first device may enable quantum secure communication capability for the first client and send a second credential to the first client to authorize the first client to activate the quantum secure communication capability. The second credential may also be referred to as an authorization credential, and the name of the second credential is not limited in this embodiment of the application.

[0183] After the first client receives the second certificate, the first client may send a request message to the server through the quantum secure communication channel between the first client and the server to request activation of the quantum secure communication capability. The request message may specifically include the first certificate and the second certificate.

[0184] After receiving the request information sent by the first client, the server may send the second credential to the first device to request the first device to authenticate the second credential; the first device authenticates the second credential to obtain an authentication result, and when the authentication result indicates that the authentication is passed, the first device activates the quantum secure communication capability for the first client. Specifically, the first device may send information related to activating the quantum secure communication capability to the first client.

[0185] After the first client activates the quantum secure communication capability, it can send the first information to the first device to request online acquisition of the quantum key (which can also be understood as requesting online filling of the quantum key); accordingly, in step 301, the first device receives the first information sent by the first client. Among them, the first information includes identification information of the first quantum key. The first quantum key refers to the quantum key used when the second device fills the quantum key for the first client. The first quantum key can also be called a protection key. The names of the first information and the first quantum key are not limited in this embodiment of the application; the multiple fifth keys at least include the first key. In actual application, since the first device does not know the specific content of the first quantum key, it is impossible to decrypt the quantum key distributed by the second device to the first client in the first device (which can also be understood as decryption and landing). In this way, the security of the quantum key transmission process can be further guaranteed.

[0186] After receiving the first information, in step 302, the first device may forward the first information to the second device so that the second device injects a quantum key for the first client.

[0187] After receiving the first information, the second device can select one or more second quantum keys from the stored multiple quantum keys (which can also be understood as a quantum key pool) according to a preset rule, and use the first quantum key to encrypt the selected second quantum key to obtain the second information, and send the second information to the first device. The second quantum key can also be called a quantum key to be filled or a quantum key to be distributed. The embodiment of the present application does not limit the name of the second quantum key. The preset rule can be set according to actual needs, and the embodiment of the present application does not limit this.

[0188] In step 303, after the first device receives the second information sent by the second device, the second information can be directly sent to the first client. After the first client receives the second information, it can use the first quantum key to decrypt the second information, obtain the one or more second quantum keys, and use the one or more second quantum keys to perform quantum secure communication with other clients.

[0189] In actual application, after the one or more second quantum keys are used up, the first client can send the first information to the first device again to request to continue to obtain more second quantum keys from the second device. At this time, since the second device has already known the first quantum key, the first information may no longer contain the identification information of the first quantum key. In this way, the first client can continuously obtain multiple quantum keys for quantum secure communication, which can also be understood as the first client having the ability to continuously charge quantum keys online.

[0190] In actual application, when the performance of the QKD device cannot meet the quantum key requirements (that is, the number of quantum keys generated by the QKD device is less than the number of quantum keys requested by the client), or when the QKD network fails (such as QKD device failure or QKD device-related network communication failure, etc.), the quantum keys stored in the second device are insufficient and cannot generate the corresponding second information after receiving the first information. At this time, the second device can inform the first device of the insufficient storage of quantum keys. In this way, after the first device receives the first information sent by the first client, it can send a request information to the second device to request the second device to distribute the stored quantum random numbers as quantum keys to the first client.

[0191] Based on this, in one embodiment, the method may further include:

[0192] Sending tenth information to the second device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by QRNG, and the sixth quantum keys are used for the first client to perform quantum secure communication;

[0193] Receive eleventh information sent by the second device, and forward the eleventh information to the first client, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

[0194] Here, the sixth quantum key may also be referred to as a quantum random number or a QRNG quantum key. The embodiment of the present application does not limit the name of the sixth quantum key.

[0195] In actual application, when the second quantum key stored in the second device is insufficient (i.e., when the second quantum key stored in the second device is insufficient), after receiving the first information, the first device may send the tenth information to the second device to request the second device to distribute a QRNG quantum key (i.e., one or more sixth quantum keys) with the same length as the quantum key requested in the first information. The embodiment of the present application does not limit the name of the tenth information.

[0196] After receiving the tenth information, the second device uses the first quantum key to encrypt the selected one or more sixth quantum keys to obtain the eleventh information, and forwards the eleventh information to the first client through the first device. In this way, after the first client uses the first quantum key to decrypt and obtain one or more sixth quantum keys, it can use the one or more sixth quantum keys to perform quantum secure communication with other clients. The embodiment of the present application does not limit the name of the eleventh information.

[0197] However, in actual application, since QRNG is not deployed in pairs, that is, only the first client can obtain the sixth quantum key generated by QRNG, the first client may not be able to directly use the sixth quantum key for quantum secure communication. For example, it is assumed that the first client performs quantum secure communication with the second client, and the first device corresponding to the first client is the first device A, the second device corresponding to the first client is the second device A, the first device corresponding to the second client is the first device B, and the second device corresponding to the second client is the second device B; at this time, when the first client wants to use a sixth quantum key to perform quantum secure communication with the second client, the first client sends the identification information of the sixth quantum key to the second client. If the identification information is found in the second client, the second client can directly perform quantum secure communication with the first client through the sixth quantum key; if the identification information cannot be found in the second client, the second client needs to send query information to the first device B to request the first device B to query whether the sixth quantum key corresponding to the identification information is stored in the second device B. If the query result indicates that the sixth quantum key corresponding to the identification information is stored in the second device B, the second device B can distribute the quantum key corresponding to the identification information to the second client through the first device B, so that the second client can perform quantum secure communication; if the query result indicates that the sixth quantum key corresponding to the identification information is not stored in the second device B, the second client B can obtain the sixth quantum key corresponding to the identification information in the following manner:

[0198] The second client B obtains the communication address of the first device A from the first device B, establishes a quantum secure communication channel with the first device A by using the obtained communication address, and requests the first device A to obtain the sixth quantum key corresponding to the identification information, thereby performing quantum secure communication with the first client through the sixth quantum key;

[0199] Based on this, in one embodiment, the method may further include:

[0200] receiving twelfth information sent by a second client, the twelfth information being used to request to obtain one or more sixth quantum keys of the one or more sixth quantum keys, wherein the second client includes a client performing quantum secure communication with the first client;

[0201] One or more sixth quantum keys are sent to the second client.

[0202] Here, in actual application, the second client may first establish a quantum secure communication channel with the first device using the quantum key injected offline, and send the twelfth information to the first device through the established quantum secure communication channel. The twelfth information may specifically include identification information of one or more sixth quantum keys and identification information of the seventh quantum key, and the seventh quantum key is used to encrypt the one or more sixth quantum keys. The embodiment of the present application does not limit the names of the twelfth information and the seventh quantum key.

[0203] After receiving the twelfth information, the first device may send a request message to the second device to request to obtain the one or more sixth quantum keys, wherein the request message may specifically include identification information of the one or more sixth quantum keys and identification information of the seventh quantum key. After receiving the request message, the second device may determine the seventh quantum key according to the identification information of the seventh quantum key, and determine the one or more sixth quantum keys according to the identification information of the one or more sixth quantum keys; the second device may then encrypt the one or more sixth quantum keys using the seventh quantum key, and forward it to the second client through the first device.

[0204] After receiving the one or more sixth quantum keys, the second client can perform quantum secure communication with the first client through the one or more sixth quantum keys.

[0205] Accordingly, an embodiment of the present application further provides a quantum key distribution method, which is applied to a second device, wherein the second device is at least used to manage quantum keys, such as Figure 4 As shown, the method includes:

[0206] Step 401: receiving first information sent by a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0207] Step 402: Send second information to the first device so that the first device forwards the second information to the first client, wherein the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0208] Here, in actual application, when the first client needs to conduct quantum secure communication with other clients, the first client sends the first information to the first device, and the first device then sends the first information to the second device to request the second device to distribute a quantum key to the first client.

[0209] In order to ensure the security of quantum key transmission during quantum key distribution, the first device can establish a first channel for quantum secure communication between the first device and the first client.

[0210] In actual application, the specific implementation of the first client establishing the first channel may include: the first client pre-acquires a part of the quantum key, and establishes the first channel with the first device through the acquired quantum key. The first client may pre-acquire one or more quantum keys from a quantum key storage medium by offline import, and the quantum key storage medium contains the quantum key copied from the second device.

[0211] However, in actual application, the number of clients that need to perform quantum secure communication may be large, and the second device needs to consume a large amount of resources to fill the corresponding quantum key for each first client offline, which is inefficient.

[0212] Based on this, the second device can charge quantum keys offline at the granularity of the server (also called the business server or business server), and the server refers to: a device that provides services to one or more (one or more can also be understood as at least one) clients when performing quantum secure communication services. That is to say, for each server, the second device charges the quantum keys used by one or more clients served by the server to establish the corresponding first channel to the server at one time offline; in this way, after the server obtains multiple quantum keys charged offline, it can send part of the quantum keys to each client connected to the server, so that each client can use the obtained quantum keys to establish the first channel. Among them, the one or more clients at least include the first client.

[0213] In practical applications, the second device can first learn which server terminals have quantum secure communication services (which can also be understood as services for quantum secure communication through a wide area network), and then offline charge quantum keys for the server terminals with quantum secure communication services.

[0214] Specifically, the server with quantum secure communication service can send registration information to the first device to inform the first device that the server has quantum secure communication service and needs to be charged with quantum key offline. The first device can then send request information to the second device to request offline key charging for the server.

[0215] Based on this, in one embodiment, the method may further include:

[0216] receiving ninth information sent by the first device, wherein the ninth information is used to request the second device to allocate a plurality of fifth quantum keys to the server, so that the server and a client associated with the server can establish a channel for quantum secure communication; the server is at least used to provide business services for the first client;

[0217] Allocate the plurality of fifth quantum keys to the server.

[0218] In actual application, the second device can allocate multiple fifth quantum keys to the server through the aforementioned offline filling method; of course, the second device can also allocate multiple fifth quantum keys to the server through other methods (such as dedicated line confidential transmission, etc.), and this embodiment of the application is not limited to this.

[0219] After the server obtains multiple fifth quantum keys, it can use the quantum keys among the multiple fifth quantum keys to establish a second channel for quantum secure communication with the first device, thereby ensuring the communication security between the server and the first device.

[0220] Specifically, the server can establish the second channel with the first device through the fourth quantum key. In actual application, in order to avoid the leakage of the fourth quantum key, when the server informs the first device of the fourth quantum key, it may not directly send the fourth quantum key, but send the identification information corresponding to the fourth quantum key to the first device; after the first device receives the identification information corresponding to the fourth quantum key, it sends a request message to the second device to request to obtain the specific quantum key corresponding to the identification information (that is, to obtain the fourth quantum key). After obtaining the fourth quantum key corresponding to the second channel, the first device can use the fourth quantum key for encryption and decryption when performing quantum secure communication with the server. Among them, the multiple fifth quantum keys at least include the fourth quantum key.

[0221] Based on this, in one embodiment, the method may further include:

[0222] receiving seventh information sent by the first device, where the seventh information includes sixth information, the sixth information includes identification information of a fourth quantum key, and the seventh information is used to obtain the fourth quantum key;

[0223] Sending the fourth quantum key to the first device; wherein the fourth quantum key is used for the first device to establish a second channel, the second channel is used for the first device to perform quantum secure communication with a server, and the server is at least used to provide business services for the first client.

[0224] In actual application, when the server provides services for at least the first client, after the server obtains multiple fifth information, it can distribute part of the quantum key to the first client.

[0225] Specifically, the first client can perform identity authentication with the network side through the server (specifically, it can include identity card authentication, biometric identification, mobile phone number dynamic password, etc.). When the identity authentication is passed, the server distributes one or more quantum keys to the first client in an encrypted manner (such as pre-configured public and private keys, quantum key storage media, etc.). In this way, after the first client obtains the quantum key, it can use the obtained quantum key to establish the first channel with the first device.

[0226] Specifically, the first client can establish the first channel with the first device through the third quantum key. In actual application, in order to avoid leakage of the third quantum key, the first client can send the identification information corresponding to the third quantum key (i.e., the sixth information) to the first device; after the first device receives the identification information corresponding to the third quantum key, it sends a request information to the second device to request to obtain the specific quantum key corresponding to the identification information (i.e., to obtain the third quantum key). Among them, the multiple fifth keys at least include the third quantum key.

[0227] Based on this, in one embodiment, the method may further include:

[0228] receiving fourth information sent by the first device, where the fourth information includes third information, the third information includes identification information of a third quantum key, and the fourth information is used to obtain the third quantum key;

[0229] The third quantum key is sent to the first device; wherein the third quantum key is used for the first device to establish a first channel, and the first channel is used for the first device to perform quantum secure communication with a first client.

[0230] After establishing the first channel and the second channel, the first client can activate the quantum secure communication capability through the first device and the server. After the first client activates the quantum secure communication capability, it can send the first information to the first device to request online acquisition of the quantum key (which can also be understood as requesting online filling of the quantum key). The first device can forward the first information to the second device so that the second device fills the quantum key for the first client. Correspondingly, in step 401, the second device receives the first information sent by the first device. Among them, the first information includes identification information of the first quantum key, and the first quantum key refers to: when the second device fills the quantum key for the first client, the quantum key used to encrypt the quantum key; the multiple fifth keys at least include the first key.

[0231] After receiving the first information, in step 402, the second device can select the one or more second quantum keys from the stored multiple quantum keys (which can also be understood as a quantum key pool) according to a preset rule, and use the first quantum key to encrypt the selected second quantum key to obtain the second information, and send the second information to the first device; wherein the preset rules can be set according to actual needs, and this embodiment of the present application is not limited to this.

[0232] In actual application, after the one or more second quantum keys are used up, the first client may send the first information to the first device again to request to continue to obtain more second quantum keys from the second device. At this time, since the second device has already known the first quantum key, the first information may no longer contain the identification information of the first quantum key. In this way, the second device can continuously allocate quantum keys for quantum secure communication to the first client.

[0233] In actual application, when the performance of the QKD device cannot meet the quantum key requirements (that is, the number of quantum keys generated by the QKD device is less than the number of quantum keys requested by the client), or when the QKD network fails, the quantum keys stored in the second device are insufficient and cannot generate the corresponding second information after receiving the first information. At this time, the second device can inform the first device of the insufficient storage of quantum keys. In this way, after receiving the first information sent by the first client, the first device can send a request information to the second device to request the second device to distribute the stored quantum random numbers as quantum keys to the first client.

[0234] Based on this, in one embodiment, the method may further include:

[0235] receiving tenth information sent by the first device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a QRNG, and where the sixth quantum keys are used by the first client to perform quantum secure communication;

[0236] Sending eleventh information to the first device, so that the first device forwards the eleventh information to the first client, wherein the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

[0237] In actual application, when the second device stores insufficient second quantum keys, after receiving the first information, the first device can send the tenth information to the second device to request the second device to distribute a QRNG quantum key (i.e., one or more sixth quantum keys) with the same length as the quantum key requested in the first information.

[0238] After receiving the tenth information, the second device uses the first quantum key to encrypt the selected one or more sixth quantum keys to obtain the eleventh information, and forwards the eleventh information to the first client through the first device. In this way, after the first client uses the first quantum key to decrypt and obtain one or more sixth quantum keys, it can use the one or more sixth quantum keys to perform quantum secure communication with other clients.

[0239] In actual application, the second client that performs quantum secure communication with the first client may need to obtain one or more sixth quantum keys from the first device. At this time, the second client can first establish a quantum secure communication channel with the first device using the quantum key injected offline, and send the twelfth information to the first device through the established quantum secure communication channel. The twelfth information may specifically include identification information of one or more sixth quantum keys and identification information of the seventh quantum key, and the seventh quantum key is used to encrypt the one or more sixth quantum keys.

[0240] After receiving the twelfth information, the first device may send a request message to the second device to request to obtain the one or more sixth quantum keys, wherein the request message may specifically include identification information of the one or more sixth quantum keys and identification information of the seventh quantum key. After receiving the request message, the second device may determine the seventh quantum key according to the identification information of the seventh quantum key, and determine the one or more sixth quantum keys according to the identification information of the one or more sixth quantum keys; the second device may then encrypt the one or more sixth quantum keys using the seventh quantum key, and forward it to the second client through the first device.

[0241] Accordingly, the embodiment of the present application also provides a quantum key distribution method, which is applied to a first client, such as Figure 5 As shown, the method includes:

[0242] Step 501: Sending first information to a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0243] Step 502: Receive second information forwarded by the first device from the second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

[0244] Here, in actual application, when the first client needs to conduct quantum secure communication with other clients, the first client sends the first information to the first device, and the first device then sends the first information to the second device to request the second device to distribute a quantum key to the first client.

[0245] In order to ensure the security of quantum key transmission during the quantum key distribution process, a first channel for quantum secure communication can be established between the first device and the first client.

[0246] In actual application, the specific implementation of the first client establishing the first channel may include: the first client pre-acquires a part of the quantum key, and establishes the first channel with the first device through the acquired quantum key. The first client may pre-acquire one or more quantum keys from a quantum key storage medium by offline import, and the quantum key storage medium contains the quantum key copied from the second device.

[0247] However, in actual application, the number of clients that need to perform quantum secure communication may be large, and the second device needs to consume a large amount of resources to fill the corresponding quantum key for each first client offline, which is inefficient.

[0248] Based on this, the second device can charge quantum keys offline at the granularity of the server (also called the business server or business server), and the server refers to: a device that provides services to one or more (one or more can also be understood as at least one) clients when performing quantum secure communication services. That is to say, for each server, the second device charges the quantum keys used by one or more clients served by the server to establish the corresponding first channel to the server at one time offline; in this way, after the server obtains multiple quantum keys charged offline, it can send part of the quantum keys to each client connected to the server, so that each client can use the obtained quantum keys to establish the first channel. Among them, the one or more clients at least include the first client.

[0249] Based on this, in one embodiment, the method may further include:

[0250] A plurality of fifth quantum keys and the first certificate are obtained from the server, wherein the plurality of fifth quantum keys at least include the first quantum key and a third quantum key, the third quantum key is used to establish a first channel, and the first channel is used to perform quantum secure communication with the first device.

[0251] After obtaining the quantum key, the first client may establish the first channel with the first device using the obtained quantum key.

[0252] Specifically, in one embodiment, the method may further include:

[0253] Sending third information to the first device, where the third information is used to request to establish a first channel, and the third information includes identification information of the third quantum key.

[0254] In actual application, the first client can request to obtain a quantum key and perform quantum secure communication with other clients only after activating (or also being understood as having) the quantum secure communication capability. Based on this, after establishing the first channel, the first client can interact with the first device through the first channel, thereby activating the quantum secure communication capability.

[0255] Specifically, the first client can obtain a credential for activating the quantum secure communication capability through the first device and the server, and activate the quantum secure communication capability if the credential authentication passes.

[0256] Based on this, in one embodiment, the method may further include:

[0257] Sending fifth information to the first device, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client;

[0258] Receiving a second credential sent by the first device, where the second credential represents authorization for the first client to activate quantum secure communication capability;

[0259] Sending thirteenth information to the server, where the thirteenth information is used to request activation of quantum secure communication capability, the thirteenth information includes the first certificate and the second certificate, and the server is at least used to provide business services for the first client;

[0260] Receive information related to activating quantum secure communication capability sent by the first device.

[0261] Here, in actual application, the first client sends the fifth information to the first device through the first channel to request to enable quantum secure communication capability for the first client, wherein the fifth information includes the first credential, which can also be called a user credential (can also be understood as a user token (expressed as Token in English)), and the first credential refers to: when the first client passes the identity authentication with the network side through the server, the server sends the credential to the first client.

[0262] After receiving the fifth information, the first device may send the first credential to the server through the second channel to request the server to authenticate the first credential, and receive the authentication result fed back by the server.

[0263] If the authentication result indicates that the first credential has passed the authentication, the first device may enable quantum secure communication capability for the first client and send a second credential to the first client to authorize the first client to activate the quantum secure communication capability. The second credential may also be referred to as an authorization credential.

[0264] After the first client receives the second credential, the first client may send the thirteenth information to the server through the quantum secure communication channel between the first client and the server to request activation of the quantum secure communication capability. The thirteenth information may specifically include the first credential and the second credential, and the thirteenth information may also be referred to as activation information. The embodiment of the present application does not limit the name of the thirteenth information.

[0265] After receiving the thirteenth information sent by the first client, the server can send the second credential to the first device to request the first device to authenticate the second credential; the first device authenticates the second credential to obtain an authentication result, and when the authentication result indicates that the authentication is passed, the first device activates the quantum secure communication capability for the first client, that is, the first device sends information related to activating the quantum secure communication capability to the first client.

[0266] After activating the quantum secure communication capability, in step 501, the first client can send the first information to the first device to request online acquisition of the quantum key (which can also be understood as requesting online injection of the quantum key); accordingly, after receiving the first information, the first device forwards the first information to the second device, so that the second device injects the quantum key for the first client.

[0267] After receiving the first information, the second device can select one or more second quantum keys from the stored multiple quantum keys (which can also be understood as a quantum key pool) according to a preset rule, and use the first quantum key to encrypt the selected second quantum key to obtain the second information, and send the second information to the first device. The preset rules can be set according to actual needs, and the embodiment of the present application is not limited to this.

[0268] After the first device receives the second information sent by the second device, the second information can be directly sent to the first client. After the first client receives the second information, it can use the first quantum key to decrypt the second information, obtain the one or more second quantum keys, and use the one or more second quantum keys to perform quantum secure communication with other clients.

[0269] In actual application, after the one or more second quantum keys are used up, the first client can send the first information to the first device again to request to continue to obtain more second quantum keys from the second device. At this time, since the second device has already known the first quantum key, the first information may no longer contain the identification information of the first quantum key. In this way, the first client can continuously obtain multiple quantum keys for quantum secure communication, which can also be understood as the first client having the ability to continuously charge quantum keys online.

[0270] In actual application, when the performance of the QKD device cannot meet the quantum key requirements (that is, the number of quantum keys generated by the QKD device is less than the number of quantum keys requested by the client), or when the QKD network fails, the quantum keys stored in the second device are insufficient and cannot generate the corresponding second information after receiving the first information. At this time, the second device can inform the first device of the insufficient storage of quantum keys. In this way, after receiving the first information sent by the first client, the first device can send a request information to the second device to request the second device to distribute the stored quantum random numbers as quantum keys to the first client.

[0271] Based on this, in one embodiment, the method may further include:

[0272] Receive eleventh information sent by the first device, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key, where the sixth quantum key is generated by a QRNG, and where the sixth quantum key is used for the first client to perform quantum secure communication.

[0273] In actual application, when the second device does not store enough second quantum keys, after receiving the first information, the first device can send a request message to the second device to request the second device to distribute a QRNG quantum key (i.e., one or more sixth quantum keys) with the same length as the quantum key requested by the first information. After receiving the request message, the second device uses the first quantum key to encrypt the selected one or more sixth quantum keys to obtain the eleventh information, and forwards the eleventh information to the first client through the first device. In this way, after the first client uses the first quantum key to decrypt and obtain one or more sixth quantum keys, it can use the one or more sixth quantum keys to perform quantum secure communication with other clients.

[0274] However, in actual application, since QRNG does not generate the sixth quantum key in pairs, the first client may not be able to directly use the sixth quantum key for quantum secure communication.

[0275] Exemplarily, after the second client that performs quantum secure communication with the first client obtains one or more sixth quantum keys, the second client informs the first client of the identification information corresponding to the one or more sixth quantum keys. The first client needs to first obtain the same one or more sixth quantum keys before it can perform quantum secure communication with the second client.

[0276] In actual application, the first client may send a request message to the first device corresponding to the second client to request to obtain the one or more sixth quantum keys.

[0277] Based on this, in one embodiment, the method may further include:

[0278] Sending fourteenth information to a first device corresponding to a second client, where the fourteenth information is used to request to obtain one or more sixth quantum keys, and the second client includes a client that performs quantum secure communication with the first client;

[0279] Receive the one or more sixth quantum keys sent by the first device corresponding to the second client.

[0280] Here, in actual application, the first client can first use the offline charged quantum key to establish a quantum secure communication channel with the first device corresponding to the second client, and send the fourteenth information to the first device corresponding to the second client through the established quantum secure communication channel. Among them, the fourteenth information can specifically include identification information of one or more sixth quantum keys, and identification information of the eighth quantum key. The eighth quantum key is used to encrypt the one or more sixth quantum keys. The embodiment of this application does not limit the names of the fourteenth information and the eighth quantum key. The multiple fifth quantum keys at least include the eighth quantum key.

[0281] After receiving the fourteenth information, the first device corresponding to the second client may send a request message to the second device corresponding to the second client to request to obtain the one or more sixth quantum keys, wherein the request message may specifically include identification information of the one or more sixth quantum keys and identification information of the eighth quantum key. After receiving the request message, the second device corresponding to the second client may determine the eighth quantum key according to the identification information of the eighth quantum key, and determine the one or more sixth quantum keys according to the identification information of the one or more sixth quantum keys; the second device corresponding to the second client may then encrypt the one or more sixth quantum keys using the eighth quantum key, and forward it to the first client through the first device corresponding to the second client.

[0282] After receiving the one or more sixth quantum keys, the first client can perform quantum secure communication with the second client through the one or more sixth quantum keys.

[0283] Accordingly, the embodiment of the present application also provides a quantum key distribution method, which is applied to a server, and the server is at least used to provide business services to the first client, such as Figure 6 As shown, the method includes:

[0284] Step 601: upon receiving an authentication request for a first credential from a first device, authenticating the first credential; the first credential represents the identity of the first client;

[0285] Step 602: Upon receiving the thirteenth information sent by the first client, the second credential is authenticated by the first device, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated. The thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

[0286] Here, in actual application, when the first client needs to perform quantum secure communication with other clients, the first client can request the second device to obtain the quantum key through the first device.

[0287] In order to ensure the security of quantum key transmission during the quantum key distribution process, a first channel for quantum secure communication can be established between the first device and the first client.

[0288] In actual application, the specific implementation of the first client establishing the first channel may include: the first client pre-acquires a part of the quantum key, and establishes the first channel with the first device through the acquired quantum key. The first client may pre-acquire one or more quantum keys from a quantum key storage medium by offline import, and the quantum key storage medium contains the quantum key copied from the second device.

[0289] However, in actual application, the number of clients that need to perform quantum secure communication may be large, and the second device needs to consume a large amount of resources to fill the corresponding quantum key for each first client offline, which is inefficient.

[0290] Based on this, the second device can charge quantum keys offline at the server end (also called a business server end or a business server) as the granularity. That is, for each server end, the second device charges the quantum keys used by one or more clients served by the server end to establish the first channel to the server end at one time offline; in this way, after the server end obtains multiple quantum keys charged offline, it can send some quantum keys to each client connected to the server end, so that the client can use the obtained quantum keys to establish the first channel.

[0291] In actual application, the second device can first learn which server terminals have quantum secure communication services (which can also be understood as services for quantum secure communication through a wide area network), and then offline recharge quantum keys for the server terminals with quantum secure communication services.

[0292] Based on this, in one embodiment, the method may further include:

[0293] Sending eighth information to the first device, where the eighth information is used to register the server on the first device;

[0294] Acquire a plurality of fifth quantum keys allocated to the server from the second device, wherein the plurality of fifth quantum keys at least include a third quantum key and a fourth quantum key; the third quantum key is used to establish a first channel, and the first channel is used for the first client to perform quantum secure communication with the first device; the fourth quantum key is used to establish a second channel, and the second channel is used for the server to perform quantum secure communication with the first device;

[0295] The second channel is established using the fourth quantum key, and the third quantum key is sent to the first client so that the first client can establish the first channel with the first device.

[0296] Specifically, the server with quantum secure communication service can send the eighth information to the first device to inform the first device that the server has quantum secure communication service and needs to be charged with quantum key offline. The first device can then send request information to the second device to request offline key charging for the server.

[0297] In actual application, the second device can allocate multiple fifth quantum keys to the server through the aforementioned offline filling method; of course, the second device can also allocate multiple fifth quantum keys to the server through other methods (such as dedicated line confidential transmission, etc.), and this embodiment of the application is not limited to this.

[0298] After obtaining multiple fifth quantum keys, the server can use the quantum keys among the multiple fifth quantum keys to establish a second channel for quantum secure communication with the first device, thereby ensuring the communication security between the server and the first device.

[0299] Based on this, in one embodiment, the establishing the second channel by using the fourth quantum key includes:

[0300] Sending sixth information to the first device, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of the fourth quantum key.

[0301] Specifically, the server can establish the second channel with the first device through the fourth quantum key. In order to avoid leakage of the fourth quantum key, when the server informs the first device of the fourth quantum key, it may not directly send the fourth quantum key, but send the identification information corresponding to the fourth quantum key to the first device; after the first device receives the identification information corresponding to the fourth quantum key, it sends a request message to the second device to request to obtain the specific quantum key corresponding to the identification information (that is, to obtain the fourth quantum key). After obtaining the fourth quantum key corresponding to the second channel, the first device can use the fourth quantum key for encryption and decryption when performing quantum secure communication with the server.

[0302] In actual application, when the server provides services for at least the first client, after the server obtains multiple fifth information, it can distribute part of the quantum key to the first client.

[0303] Specifically, in one embodiment, sending the third quantum key to the first client includes:

[0304] receiving identity authentication information of the first client;

[0305] In a case where the identity authentication of the first client is passed, a third quantum key and a first certificate are provided to the first client, where the first certificate represents the identity of the first client.

[0306] In actual application, the first client can perform identity authentication with the network side through the server (specifically, it can include identity card authentication, biometric identification, mobile phone number dynamic password, etc.). When the identity authentication is passed, the server distributes the third quantum key and the first quantum key to the first client through encryption (such as pre-configured public and private keys, quantum key storage medium, etc.). In this way, after the first client obtains the third quantum key, it can use the obtained third quantum key to establish the first channel with the first device.

[0307] In actual application, the first client can request to obtain a quantum key and perform quantum secure communication with other clients only after activating (or also being understood as having) the quantum secure communication capability. Based on this, after establishing the first channel, the first client can interact with the first device through the first channel, thereby activating the quantum secure communication capability.

[0308] Specifically, the first client can obtain a credential for activating the quantum secure communication capability through the first device and the server, and activate the quantum secure communication capability if the credential authentication passes.

[0309] In actual application, the specific process of the first client activating the quantum secure communication capability may include: the first client performs identity authentication with the network side through the server; when the identity authentication is passed, the server sends a first credential (which can also be understood as a user credential) to the first client; after the first client obtains the first credential, it sends a request message to the first device to request the activation of the quantum secure communication capability, and the request message includes the first credential; the first device requests the server to authenticate the first credential; the server authenticates the first credential and feeds back the authentication result to the first device; when the authentication result indicates that the first credential is authenticated, the first device sends a second credential (which can also be understood as an authorization credential) to the first client; the first client can then use the first credential and the second credential to send a request message to the server to request the activation of the quantum secure communication capability.

[0310] Based on this, in one embodiment, the method may further include:

[0311] Upon receiving an authentication request from a first device for a first credential, authenticating the first credential; the first credential represents the identity of the first client;

[0312] When the thirteenth information sent by the first client is received, the second credential is authenticated by the first device so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated. The thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

[0313] Here, in actual application, after receiving the thirteenth information sent by the first client, the server may send the second credential to the first device to request the first device to authenticate the second credential; if the first device authenticates the second credential, the first device activates the quantum secure communication capability for the first client. Specifically, the first device may send information related to activating the quantum secure communication capability to the first client.

[0314] Accordingly, the present application also provides a quantum key distribution method, such as Figure 7 As shown, the method includes:

[0315] Step 701: a first client sends first information to a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0316] Step 702: The first device receives first information sent by the first client;

[0317] Step 703: The first device sends the first information to a second device, where the second device is at least used to manage quantum keys;

[0318] Step 704: The second device receives the first information sent by the first device;

[0319] Step 705: The second device sends second information to the first device, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication;

[0320] Step 706: The first device receives the second information sent by the second device, and forwards the second information to the first client;

[0321] Step 707: The first client receives the second information forwarded by the first device from the second device.

[0322] Here, it should be noted that the specific processing procedures of the first device, the second device, and the first client have been described in detail above and will not be repeated here.

[0323] The quantum key distribution method provided in the embodiment of the present application is that the first client sends a first message to the first device, the first message is used to request a quantum key for quantum secure communication, and the first message includes identification information of the first quantum key; the first device receives the first message sent by the first client, and the first device sends the first message to the second device, the second device is at least used to manage quantum keys; the second device receives the first message sent by the first device; the second device sends a second message to the first device, the second message includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for quantum secure communication for the first client; the first device receives the second message sent by the second device, and forwards the second message to the first client; the first client receives the second message forwarded by the first device from the second device. The solution provided in the embodiment of the present application is that the second device for managing quantum keys distributes quantum keys to the client through the first device. In the scenario where the first client and the second client need to perform quantum secure communication, the first client and the second client correspond to a first device and a second device respectively, and can obtain quantum keys through the above process. At this time, since the first client is not directly connected to the second device, the first client can obtain the quantum key in the second device corresponding to the first client through the first device corresponding to the first client, and can also obtain the quantum key in the second device corresponding to the second client through the first device corresponding to the second client. In this way, when the second device corresponding to the first client distributes the quantum key to the first client, it does not need to synchronize with the second device corresponding to the second client, and can directly distribute the quantum key to the first client efficiently. Even if the quantum keys obtained by the first client and the second client are not exactly the same, the second client can obtain the unobtained quantum key through the first device and the second device corresponding to the first client when negotiating with the first client the quantum key for quantum secure communication. It can be seen that the solution provided by the embodiment of the present application can realize the efficient distribution of quantum keys to clients with quantum secure communication requirements.

[0324] At the same time, upon receiving an authentication request from the first device for the first credential, the server authenticates the first credential; the first credential represents the identity of the first client; upon receiving the thirteenth information sent by the first client, the server authenticates the second credential through the first device, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated, and the thirteenth information contains the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability. In the solution provided in the embodiment of the present application, the server and the first device verify the identity of the first client by authenticating the credential, and activate the quantum secure communication capability for the first client, so that the first client can obtain the quantum key and conduct quantum secure communication, thereby improving security.

[0325] The present application is described in further detail below in conjunction with application examples.

[0326] In related technologies, QKD methods generally include classical QKD and QKD through a quantum key management platform.

[0327] However, in classical QKD, in order to establish a quantum secure communication channel between two terminals, at least one pair of corresponding QKD devices needs to be deployed. That is to say, when quantum secure communication is required between multiple terminals, the number of deployed QKD devices needs to be increased to effectively implement QKD, resulting in reduced routing efficiency and key synchronization efficiency between QKD devices, affecting the communication rate. At the same time, in order to ensure the security of quantum keys during transmission, QKD devices and terminals need to be deployed in the same local area network. That is to say, if the QKD device is not deployed in the local area network corresponding to the terminal, it is difficult for the terminal to perform quantum secure communication, that is, the application scenarios of quantum secure communication are limited.

[0328] At the same time, when performing QKD through the quantum key management platform, the terminal needs to be deeply customized according to the quantum key management platform (such as installing corresponding APPs, plug-ins, etc.) before it can interact with the quantum key management platform. In other words, the quantum key management platform has low compatibility and applicability to terminals and can only provide QKD services for specific terminals, with low flexibility. At the same time, before the quantum key management platform performs QKD on the terminal, it is necessary to synchronize the quantum keys first. In other words, the quantum key management platforms deployed in different metropolitan area networks need to synchronize the quantum keys generated by each QKD device. In actual applications, quantum key management platforms usually transmit synchronization messages through the established VPN channels. Since the synchronization messages require additional encryption and decryption steps when transmitted through the VPN channels, the synchronization efficiency of the quantum keys will be low, which will lead to a decrease in the efficiency of the quantum key management platform in distributing quantum keys to the terminal, and then cause interruptions to obtain quantum keys in a timely manner, affecting the communication efficiency of the terminal.

[0329] In order to solve the above problems, this application example proposes a quantum key proxy distribution system for multiple terminals, such as Figure 8 As shown, the system includes a QKD device, a QRNG device, a quantum key access gateway, a quantum key management device (i.e., the second device mentioned above), a quantum key distribution agent (i.e., the first device mentioned above), a service end (i.e., the service end), and a service client (i.e., the first client and the second client mentioned above). Among them, the QKD device and the QRNG device are connected to the quantum key management through the quantum key access gateway, the QRNG device refers to: a device capable of generating quantum random numbers, the QKD device refers to: a device capable of generating quantum keys, and the QKD device is usually deployed in pairs; a pair of QKD devices can be deployed in different metropolitan area networks respectively, and are connected to the quantum key management devices corresponding to their respective metropolitan area networks through the quantum key access gateways in their respective metropolitan area networks; a pair of QKD devices can specifically communicate quantumly through optical fibers, and jointly generate a pair of identical quantum keys through negotiation; the quantum key distribution agent is connected to the quantum key management device, and the quantum key management device and the quantum key distribution agent gateway are placed in the same trust domain; the quantum key distribution agent, the service client, and the service server are connected through a wide area network, and the service server is used to provide services for one or more service clients.

[0330] Based on the above system, the application example of this application also provides a quantum key proxy distribution method for multiple terminals, such as Fig. 9 As shown, the following steps are included:

[0331] Step 901: The quantum key management device obtains and stores and manages the QKD quantum key (i.e., the quantum key generated by the QKD device) and the QRNG quantum random number (i.e., the quantum random number generated by the QRNG device) from the QKD device and the QRNG device through the quantum key access gateway;

[0332] Among them, each quantum key and quantum random number corresponds to unique identification information (such as QID) in the entire network. The identification information can be generated according to a preset algorithm, and the preset algorithm can be set according to actual needs.

[0333] Step 902: The service server that has quantum secure communication requirements registers with the nearest quantum key distribution agent;

[0334] Here, in actual application, the network side can configure a quantum key distribution agent with the closest communication distance for the business server, so that the business server can determine which quantum key distribution agent to register with.

[0335] Step 903: The quantum key distribution agent requests the quantum key management device to preset the quantum key distribution to the business service end through an offline charging method;

[0336] Here, in actual application, the offline charging method includes: using quantum key storage media such as UKey to import one or more quantum keys for the service server, so that the quantum key distribution terminal (including the service client A and the service server) and the quantum key distribution agent establish a quantum secure communication channel through the imported quantum key. The quantum secure communication channel is used to transmit the following two types of data:

[0337] The quantum key management device obtains the quantum key online from the quantum key distribution agent;

[0338] The interactive information between the quantum key distribution agent and the business server when the business client A account is activated, verified and bound to the quantum secure communication capability.

[0339] Specifically, one or more of the APP, SDK, browser plug-in, etc. in the quantum key distribution terminal can decrypt the quantum key distributed offline to the business service end through the quantum key storage medium, select the quantum key to encrypt the session, and send the quantum key QID and encrypted session data to the quantum key distribution agent to establish a quantum secure communication channel.

[0340] Step 904: Business client A opens a business account through the business process, and activates (can also be understood as subscribing) quantum secure communication capabilities for business client A through the business server and quantum key distribution agent;

[0341] Specifically, the specific implementation of business client A activating quantum secure communication capability may include the following process:

[0342] Business client A performs strong identity authentication with the business server and the network side;

[0343] Here, in actual application, the strong identity authentication may specifically include one or more of the following: identity document authentication, biometric recognition, mobile phone number dynamic password, etc.

[0344] When the strong identity authentication is passed, the business service end establishes a quantum secure communication channel with the business client A, and further distributes the quantum key charged by the business service end to the business client A; and sends (can also be understood as issuing) a user certificate (i.e., the above-mentioned first certificate) to the business client A;

[0345] Here, in actual application, the business server distributes the quantum key to the business client A in the following three ways:

[0346] The first method is to apply for a quantum certification authority (CA) certificate for the business server and business client A in advance so that the business server and business client A have certificate authentication. The business server can distribute the quantum key to the business client A through the public and private keys corresponding to the certificate;

[0347] The second method: the business service end charges the quantum key for the business client A offline; specifically, when the business client A is a personal computer (PC), a quantum key storage device such as Ukey can be used to copy the quantum key from the business service end to the business client A; when the business client A is a mobile phone and / or a smart terminal, a user identity module (SIM) card or a flash memory (TF) card can be used as a secure medium for offline quantum key charging.

[0348] The third method: Encrypted communication is established between the business service end and the business client A through the classical secure communication network, and the business service end distributes a quantum key to the business client A once. The distributed quantum key includes the quantum key used to establish a quantum secure communication channel between the business client A and the quantum key distribution agent, and the first online injection protection key between the business client A and the quantum key distribution agent (the quantum key used to encrypt and decrypt the online injection, that is, the above-mentioned first quantum key). The business client A uses the quantum key to inject the quantum key from the quantum key distribution agent.

[0349] The service server and the service client A respectively establish a quantum secure communication channel (i.e., the first channel and the second channel mentioned above) through the offline injected quantum key and the quantum key distribution agent;

[0350] Business client A sends request information (i.e., the fifth information) to the quantum key distribution agent through the quantum secure communication channel to request the activation of quantum secure communication capability; wherein, the request information includes user credentials.

[0351] The quantum key distribution agent requests the service server to authenticate (also known as verify) the user credentials of the service client A. If the authentication is successful, the quantum key distribution agent sends an authorization credential (i.e., the second credential mentioned above) to the service client A.

[0352] Business client A sends application information (i.e. the thirteenth information mentioned above) to the business server through the quantum secure communication channel to apply for the activation of (also understood as activation of) quantum secure communication capabilities; wherein the application information includes authorization credentials and user credentials.

[0353] The business service end requests the quantum key distribution agent for an authentication authorization certificate. If the authentication is successful, the quantum key distribution agent enables the business client A to use quantum secure communication capabilities.

[0354] Step 905: The service client A determines a protection key (i.e., the first quantum key) from the quantum key distribution agent; the protection key is used to encrypt the quantum key to be injected;

[0355] Here, in actual application, the service client A can send notification information (i.e., the first information mentioned above) to the quantum key distribution agent to notify the quantum key distribution agent of the identifier (such as QID) of the key to be protected.

[0356] Step 906: The quantum key distribution agent sends the identifier of the protection key to the quantum key management device;

[0357] Step 907: the quantum key management device takes a certain number of quantum keys from the key pool as quantum keys to be distributed (i.e., the second quantum keys mentioned above), encrypts the quantum keys to be distributed using the protection key, and distributes the encrypted quantum keys to the service client A through the quantum key distribution agent;

[0358] Here, in actual application, the quantum key management device can obtain the protection key according to the identification query of the protection key.

[0359] Step 908: Business client A sends the identifier of the quantum key obtained from the quantum key distribution agent to business client B (i.e., the second client mentioned above) (i.e., synchronized with business client B). After that, business client A uses the quantum key to perform quantum secure communication with business client B (i.e., uses the quantum key to encrypt and decrypt the interactive business data).

[0360] Among them, the business client B also performs the above steps 901 to 907 to obtain the corresponding quantum key. At the same time, the business client A, the business client B and the business server use the obtained quantum key to perform quantum secure communication; and the business client A and the business client B respectively perform quantum secure communication with the corresponding quantum key distribution agent, and continuously obtain quantum key online charging (it can also be understood that the quantum key distribution agent continuously distributes quantum keys).

[0361] In actual application, when the QKD network fails, or the performance of the QKD device cannot meet the business layer requirements, for example, when the business client A requests the quantum key distribution agent A to distribute the QKD quantum key, but the key pool of the quantum key management device A no longer has the QKD quantum key (that is, the sixth quantum key mentioned above), Figure 8 As shown, quantum key distribution agent A can request a QRNG quantum key of the same length from quantum key management device A. When business client A synchronizes the identifier of the quantum key to business client B, business client B requests the configured quantum key distribution agent B to obtain the QRNG quantum key of the same identifier. If quantum key distribution agent B cannot query the QRNG quantum key corresponding to the identifier, the way in which business client B obtains the QRNG quantum key corresponding to the identifier may specifically include: quantum key distribution agent B obtains the address information of quantum key distribution agent A (such as uniform resource locator (URL) information), establishes a quantum secure communication channel with quantum key distribution agent A through the offline charged quantum key, and obtains the QRNG quantum key corresponding to the identifier through the established channel.

[0362] The solution provided in the application example of this application distributes the quantum key in the quantum key management device to the business server and business client through the quantum key distribution agent, which has the following advantages:

[0363] By setting up a quantum key distribution agent at the boundary between the wide area network and the trusted network domain, the quantum key management device is prevented from being exposed to the wide area network, and the security protection of quantum key production and storage management devices is achieved, reducing the risk of quantum key attacks and leaks;

[0364] The quantum key distribution agent manages the establishment of a communication channel from the business client to the quantum key management device by issuing authorization certificates, so that the business client can obtain the quantum key through the quantum key distribution agent (that is, the quantum key distribution agent continuously and securely distributes quantum keys to the business client and the business server). At the same time, the quantum key obtained cannot be understood and implemented by the quantum key distribution agent, which expands the application scope of quantum key distribution while being safe and reliable.

[0365] The activation of quantum secure communication service capabilities for business clients requires the following conditions to be met simultaneously: the quantum key distribution agent issues a quantum secure communication capability authorization certificate to it; the business server issues a business user certificate to it. In this way, the quantum key distribution agent is used to continuously recharge quantum keys for business clients, and the business server is used to provide business communication services for business clients. The quantum key distribution agent and the business server have low functional coupling and clear boundaries. The business server and business client in the actual application scenario only need to undergo lightweight transformation to implement quantum secure communication services through the solution of the application example of this application;

[0366] By offline charging the wide area network service end with a preset quantum key, a quantum secure communication channel is established between the service end and the quantum key distribution agent, and then the service end initially distributes the quantum key to the service client. After the initial quantum key distribution is completed, a quantum secure communication channel is established between the service client and the quantum key distribution agent, and the quantum key distribution agent can then continuously distribute the quantum key to the service client and the service end online through the established channel. At the same time, it should be understood that in the case where the quantum key distribution terminal includes devices other than the service client and the service end, the solution provided in the application example of this application is still applicable;

[0367] By integrating the distribution of QKD keys and QRNG keys through quantum key distribution agents, and using QRNG quantum keys as an emergency backup for QKD quantum keys, the stability and reliability of quantum key distribution can be greatly improved.

[0368] In order to implement the method provided by the first device side of the embodiment of the present application, the embodiment of the present application also provides a quantum key distribution device, which is arranged on the first device, such as Fig.10 As shown, the device comprises:

[0369] The first receiving unit 1001 is configured to receive first information sent by a first client, the first information being used to request a quantum key for quantum secure communication, and the first information comprising identification information of the first quantum key; and receive second information sent by a second device, the second information comprising one or more second quantum keys encrypted using the first quantum key, the second quantum key being used for the first client to perform quantum secure communication, and the second device being at least used to manage quantum keys;

[0370] The first sending unit 1002 is configured to send the first information to the second device, and forward the second information to the first client.

[0371] In one embodiment, the first receiving unit 1001 and the first sending unit 1002 are specifically used to:

[0372] Communicate with the first client through an established first channel, where the first channel is used for quantum secure communication between the first device and the first client.

[0373] In one embodiment, the first receiving unit 1001 is further configured to:

[0374] receiving third information sent by the first client, the third information being used to request establishment of the first channel, the third information comprising identification information of a third quantum key; and receiving the third quantum key sent by the second device;

[0375] The first sending unit 1002 is further configured to:

[0376] Sending fourth information to the second device, where the fourth information is used to obtain the third quantum key, and the fourth information includes the third information;

[0377] The first sending unit 1002 is further configured to:

[0378] The first channel is established using the third quantum key.

[0379] In one embodiment, the first receiving unit 1001 is further configured to:

[0380] receiving fifth information sent by the first client, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client;

[0381] The first sending unit 1002 is further configured to:

[0382] authenticating the first credential through a server, the server being at least used to provide business services to the first client;

[0383] The first sending unit 1002 is further configured to:

[0384] If the first credential is authenticated successfully, sending a second credential to the first client, so that the first client can use the first credential and the second credential to activate the quantum secure communication capability, wherein the second credential represents authorization for the first client to activate the quantum secure communication capability;

[0385] The device may also include:

[0386] The third authentication unit is used to authenticate the second credential when receiving an authentication request for the second credential from the server; and activate quantum secure communication capability for the first client when the second credential authentication passes.

[0387] In one embodiment, the first receiving unit 1001 and the first sending unit 1002 are specifically configured to:

[0388] Communicate with the server through the established second channel, where the second channel is used for quantum secure communication between the first device and the server.

[0389] In one embodiment, the first receiving unit 1001 is further configured to:

[0390] receiving sixth information sent by the server, the sixth information being used to request establishment of the second channel, the sixth information comprising identification information of a fourth quantum key; and receiving the fourth quantum key sent by the second device;

[0391] The first sending unit 1002 is further configured to:

[0392] Sending seventh information to the second device, where the seventh information is used to obtain the fourth quantum key, and the seventh information includes the sixth information;

[0393] The first sending unit 1002 is further configured to:

[0394] The second channel is established using the fourth quantum key.

[0395] In one embodiment, the first receiving unit 1001 is further configured to:

[0396] receiving eighth information sent by the server, where the eighth information is used to register the server on the first device;

[0397] The first sending unit 1002 is further configured to:

[0398] Ninth information is sent to the second device, where the ninth information is used to request the second device to assign multiple fifth quantum keys to the server, so that the server and a client associated with the server can establish a channel for quantum secure communication, where the multiple fifth quantum keys include at least the first quantum key, the third quantum key and the fourth quantum key, the client associated with the server includes at least the first client, and the channel for quantum secure communication includes at least the first channel and the second channel.

[0399] In one embodiment, the first sending unit 1002 is further configured to:

[0400] sending tenth information to the second device, the tenth information being used to request to obtain one or more sixth quantum keys, the sixth quantum keys being generated by a QRNG, the sixth quantum keys being used for quantum secure communication by the first client; and forwarding eleventh information to the first client, the eleventh information comprising one or more sixth quantum keys encrypted using the first quantum key;

[0401] The first receiving unit 1001 is further configured to:

[0402] Receive the eleventh information sent by the second device.

[0403] In one embodiment, the first receiving unit 1001 is further configured to:

[0404] receiving twelfth information sent by a second client, the twelfth information being used to request to obtain one or more sixth quantum keys of the one or more sixth quantum keys, wherein the second client includes a client performing quantum secure communication with the first client;

[0405] The first sending unit 1002 is further configured to:

[0406] One or more sixth quantum keys are sent to the second client.

[0407] In actual application, the first receiving unit 1001 and the first sending unit 1002 can be implemented by a processor in the quantum key distribution device in combination with a communication interface, and the third authentication unit can be implemented by a processor in the quantum key distribution device.

[0408] In order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a quantum key distribution device, which is arranged on the second device, and the second device is at least used to manage the quantum key, such as Fig.11 As shown, the device comprises:

[0409] The second receiving unit 1101 is used to receive first information sent by the first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0410] The second sending unit 1102 is used to send second information to the first device, so that the first device forwards the second information to the first client, the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0411] In one embodiment, the second receiving unit 1101 is further configured to:

[0412] receiving tenth information sent by the first device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a QRNG, and where the sixth quantum keys are used by the first client to perform quantum secure communication;

[0413] The second sending unit 1102 is further configured to:

[0414] Sending eleventh information to the first device, so that the first device forwards the eleventh information to the first client, wherein the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

[0415] In one embodiment, the second receiving unit 1101 is further configured to:

[0416] receiving fourth information sent by the first device, where the fourth information includes third information, the third information includes identification information of a third quantum key, and the fourth information is used to obtain the third quantum key;

[0417] The second sending unit 1102 is further configured to:

[0418] The third quantum key is sent to the first device; wherein the third quantum key is used for the first device to establish a first channel, and the first channel is used for the first device to perform quantum secure communication with a first client.

[0419] In one embodiment, the second receiving unit 1101 is further configured to:

[0420] receiving seventh information sent by the first device, where the seventh information includes sixth information, the sixth information includes identification information of a fourth quantum key, and the seventh information is used to obtain the fourth quantum key;

[0421] The second sending unit 1102 is further configured to:

[0422] Sending the fourth quantum key to the first device; wherein the fourth quantum key is used for the first device to establish a second channel, the second channel is used for the first device to perform quantum secure communication with a server, and the server is at least used to provide business services for the first client.

[0423] In one embodiment, the second receiving unit 1101 is further configured to:

[0424] Receive ninth information sent by the first device, where the ninth information is used to request the second device to allocate multiple fifth quantum keys to the server, so that the server and the client associated with the server can establish a channel for quantum secure communication; wherein the multiple fifth quantum keys at least include the first quantum key, the third quantum key and the fourth quantum key; the third quantum key is used to establish a first channel, where the first channel is used for the first device to perform quantum secure communication with the first client; the fourth quantum key is used to establish a second channel, where the second channel is used for the first device to perform quantum secure communication with the server; the server is at least used to provide business services for the first client, and the channel for quantum secure communication includes at least the first channel and the second channel;

[0425] The second sending unit 1102 is further configured to:

[0426] Allocate the plurality of fifth quantum keys to the server.

[0427] In actual application, the second receiving unit 1101 and the second sending unit 1102 can be implemented by a processor in the quantum key distribution device combined with a communication interface.

[0428] In order to implement the method on the first client side of the embodiment of the present application, the embodiment of the present application also provides a quantum key distribution device, which is arranged on the first client, such as Fig.12 As shown, the device comprises:

[0429] The third sending unit 1201 is used to send first information to the first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key;

[0430] The third receiving unit 1202 is used to receive second information forwarded by the first device from the second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, where the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

[0431] In one embodiment, the third sending unit 1201 is further used for:

[0432] Sending fifth information to the first device, the fifth information being used to request activation of quantum secure communication capability, the fifth information comprising a first credential, the first credential representing the identity of the first client; and sending thirteenth information to the server, the thirteenth information being used to request activation of quantum secure communication capability, the thirteenth information comprising the first credential and the second credential, the server being at least used to provide business services for the first client;

[0433] The third receiving unit 1202 is further configured to:

[0434] Receive a second credential sent by the first device, where the second credential represents authorization for the first client to activate quantum secure communication capability; and receive information related to activating quantum secure communication capability sent by the first device.

[0435] In one embodiment, the third receiving unit 1202 is further configured to:

[0436] A plurality of fifth quantum keys and the first certificate are obtained from the server, wherein the plurality of fifth quantum keys at least include the first quantum key and a third quantum key, the third quantum key is used to establish a first channel, and the first channel is used to perform quantum secure communication with the first device.

[0437] In one embodiment, the third sending unit 1201 is further configured to:

[0438] Sending third information to the first device, where the third information is used to request to establish a first channel, and the third information includes identification information of the third quantum key.

[0439] In one embodiment, the third receiving unit 1202 is further configured to:

[0440] Receive eleventh information sent by the first device, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key, where the sixth quantum key is generated by a QRNG, and where the sixth quantum key is used for the first client to perform quantum secure communication.

[0441] In one embodiment, the third sending unit 1201 is further configured to:

[0442] Sending fourteenth information to a first device corresponding to a second client, where the fourteenth information is used to request to obtain one or more sixth quantum keys, and the second client includes a client that performs quantum secure communication with the first client;

[0443] The third receiving unit 1202 is further configured to:

[0444] Receive the one or more sixth quantum keys sent by the first device corresponding to the second client.

[0445] In actual application, the third sending unit 1201 and the third receiving unit 1202 can be implemented by a processor in the quantum key distribution device combined with a communication interface.

[0446] In order to implement the method on the server side of the embodiment of the present application, the embodiment of the present application also provides a quantum key distribution device, which is arranged on the server, and the server is at least used to provide business services for the first client, such as Fig.13 As shown, the device comprises:

[0447] The first authentication unit 1301 is configured to authenticate the first credential upon receiving an authentication request for the first credential from the first device; the first credential represents the identity of the first client;

[0448] The second authentication unit 1302 is used to authenticate the second credential through the first device when receiving the thirteenth information sent by the first client, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated. The thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

[0449] In one embodiment, the device may further include:

[0450] The fourth sending unit is configured to send eighth information to the first device, where the eighth information is used to register the server in the first device; and to establish the second channel using the fourth quantum key, and to send the third quantum key to the first client, so that the first client can establish the first channel with the first device;

[0451] The fourth receiving unit is used to obtain multiple fifth quantum keys allocated to the server from the second device, and the multiple fifth quantum keys include at least a third quantum key and a fourth quantum key; the third quantum key is used to establish a first channel, and the first channel is used for the first client to perform quantum secure communication with the first device; the fourth quantum key is used to establish a second channel, and the second channel is used for the server to perform quantum secure communication with the first device.

[0452] In one embodiment, the fourth receiving unit is further used for:

[0453] receiving identity authentication information of the first client;

[0454] The fourth sending unit is further used for:

[0455] In a case where the identity authentication of the first client is passed, a third quantum key and a first certificate are provided to the first client, where the first certificate represents the identity of the first client.

[0456] In one embodiment, the fourth sending unit is specifically configured to:

[0457] Sending sixth information to the first device, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of the fourth quantum key.

[0458] In actual application, the first authentication unit 1301, the second authentication unit 1302, the fourth sending unit, and the fourth receiving unit can be implemented by a processor in the quantum key distribution device combined with a communication interface.

[0459] It should be noted that: the quantum key distribution device provided in the above embodiment only uses the division of the above program units as an example when performing quantum key distribution. In practical applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device is divided into different program units to complete all or part of the above-described processing. In addition, the quantum key distribution device provided in the above embodiment and the quantum key distribution method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0460] Based on the hardware implementation of the above program module, and in order to implement the method on the first device side of the embodiment of the present application, the embodiment of the present application also provides a first device, such as Fig.14 As shown, the first device 1400 includes:

[0461] The first communication interface 1401 is capable of exchanging information with other devices;

[0462] A first processor 1402 is connected to the first communication interface 1401 to implement information interaction with other devices, and is used to execute the method provided by one or more technical solutions on the first device side when running a computer program;

[0463] A first memory 1403 , on which the computer program is stored.

[0464] Specifically, the first communication interface 1401 is used to:

[0465] Receive first information sent by a first client, the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; send the first information to a second device, the second device is at least used to manage quantum keys; and receive second information sent by the second device, and forward the second information to the first client, the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0466] In one embodiment, the first processor 1402 is configured to:

[0467] The first device communicates with the first client through the first communication interface 1401 through the established first channel, and the first channel is used for the first device to perform quantum secure communication with the first client.

[0468] In one embodiment, the first communication interface 1401 is further used for:

[0469] receiving third information sent by the first client, where the third information is used to request to establish the first channel, and the third information includes identification information of a third quantum key;

[0470] Sending fourth information to the second device, where the fourth information is used to obtain the third quantum key, and the fourth information includes the third information;

[0471] Receiving the third quantum key sent by the second device;

[0472] The first channel is established using the third quantum key.

[0473] In one embodiment, the first communication interface 1401 is further used for:

[0474] receiving fifth information sent by the first client, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client;

[0475] The first processor 1402 is further configured to:

[0476] Authenticating the first credential with a server through the first communication interface 1401, the server being at least used to provide business services to the first client;

[0477] If the first credential is authenticated successfully, sending a second credential to the first client, so that the first client can use the first credential and the second credential to activate the quantum secure communication capability, wherein the second credential represents authorization for the first client to activate the quantum secure communication capability;

[0478] Upon receiving an authentication request from the server for the second credential, the second credential is authenticated; and if the second credential is authenticated successfully, quantum secure communication capability is activated for the first client.

[0479] In one embodiment, the first processor 1402 is further configured to:

[0480] The first device communicates with the server through the first communication interface 1401 through the established second channel, and the second channel is used for quantum secure communication between the first device and the server.

[0481] In one embodiment, the first communication interface 1401 is further used for:

[0482] receiving sixth information sent by the server, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of a fourth quantum key;

[0483] Sending seventh information to the second device, where the seventh information is used to obtain the fourth quantum key, and the seventh information includes the sixth information;

[0484] Receiving the fourth quantum key sent by the second device;

[0485] The second channel is established using the fourth quantum key.

[0486] In one embodiment, the first communication interface 1401 is further used for:

[0487] receiving eighth information sent by the server, where the eighth information is used to register the server on the first device;

[0488] Ninth information is sent to the second device, where the ninth information is used to request the second device to assign multiple fifth quantum keys to the server, so that the server and a client associated with the server can establish a channel for quantum secure communication, where the multiple fifth quantum keys include at least the first quantum key, the third quantum key and the fourth quantum key, the client associated with the server includes at least the first client, and the channel for quantum secure communication includes at least the first channel and the second channel.

[0489] In one embodiment, the first communication interface 1401 is further used for:

[0490] Sending tenth information to the second device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a quantum random number generator QRNG, and where the sixth quantum keys are used for the first client to perform quantum secure communication;

[0491] Receive eleventh information sent by the second device, and forward the eleventh information to the first client, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

[0492] In one embodiment, the first communication interface 1401 is further used for:

[0493] receiving twelfth information sent by a second client, the twelfth information being used to request to obtain one or more sixth quantum keys of the one or more sixth quantum keys, wherein the second client includes a client performing quantum secure communication with the first client;

[0494] One or more sixth quantum keys are sent to the second client.

[0495] It should be noted that the specific processing process of the first processor 1402 and the first communication interface 1401 can be understood by referring to the above method.

[0496] Of course, in actual application, the various components in the first device 1400 are coupled together through the bus system 1404. It can be understood that the bus system 1404 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1404 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.14 Various buses are labeled as bus system 1404.

[0497] The first memory 1403 in the embodiment of the present application is used to store various types of data to support the operation of the first device 1400. Examples of such data include: any computer program used to operate on the first device 1400.

[0498] The method disclosed in the above embodiment of the present application can be applied to the first processor 1402, or implemented by the first processor 1402. The first processor 1402 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the first processor 1402 or an instruction in the form of software. The above-mentioned first processor 1402 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 1402 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the first memory 1403, and the first processor 1402 reads the information in the first memory 1403, and completes the steps of the above method in combination with its hardware.

[0499] In an exemplary embodiment, the first device 1400 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0500] Based on the hardware implementation of the above program module, and in order to implement the method on the second device side of the embodiment of the present application, the embodiment of the present application also provides a second device, which is at least used to manage quantum keys, such as Fig.15 As shown, the second device 1500 includes:

[0501] The second communication interface 1501 is capable of exchanging information with other devices;

[0502] The second processor 1502 is connected to the second communication interface 1501 to implement information interaction with other devices, and is used to execute the method provided by one or more technical solutions on the second device side when running a computer program;

[0503] A second memory 1503 , on which the computer program is stored.

[0504] Specifically, the second communication interface 1501 is used to:

[0505] Receive first information sent by a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and send second information to the first device so that the first device forwards the second information to a first client, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

[0506] In one embodiment, the second communication interface 1501 is further used for:

[0507] receiving tenth information sent by the first device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a QRNG, and where the sixth quantum keys are used by the first client to perform quantum secure communication;

[0508] Sending eleventh information to the first device, so that the first device forwards the eleventh information to the first client, wherein the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

[0509] In one embodiment, the second communication interface 1501 is further used for:

[0510] receiving fourth information sent by the first device, where the fourth information includes third information, the third information includes identification information of a third quantum key, and the fourth information is used to obtain the third quantum key;

[0511] The third quantum key is sent to the first device; wherein the third quantum key is used for the first device to establish a first channel, and the first channel is used for the first device to perform quantum secure communication with a first client.

[0512] In one embodiment, the second communication interface 1501 is further used for:

[0513] receiving seventh information sent by the first device, where the seventh information includes sixth information, the sixth information includes identification information of a fourth quantum key, and the seventh information is used to obtain the fourth quantum key;

[0514] Sending the fourth quantum key to the first device; wherein the fourth quantum key is used for the first device to establish a second channel, the second channel is used for the first device to perform quantum secure communication with a server, and the server is at least used to provide business services for the first client.

[0515] In one embodiment, the second communication interface 1501 is further used for:

[0516] Receive ninth information sent by the first device, where the ninth information is used to request the second device to allocate multiple fifth quantum keys to the server, so that the server and the client associated with the server can establish a channel for quantum secure communication; wherein the multiple fifth quantum keys at least include the first quantum key, the third quantum key and the fourth quantum key; the third quantum key is used to establish a first channel, where the first channel is used for the first device to perform quantum secure communication with the first client; the fourth quantum key is used to establish a second channel, where the second channel is used for the first device to perform quantum secure communication with the server; the server is at least used to provide business services for the first client, and the channel for quantum secure communication includes at least the first channel and the second channel;

[0517] The second processor 1502 is configured to:

[0518] The plurality of fifth quantum keys are distributed to the server through the second communication interface 1501.

[0519] It should be noted that the specific processing process of the second processor 1502 and the second communication interface 1501 can be understood by referring to the above method.

[0520] Of course, in actual application, the various components in the second device 1500 are coupled together through the bus system 1504. It can be understood that the bus system 1504 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1504 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.15 Various buses are labeled as bus system 1504.

[0521] The second memory 1503 in the embodiment of the present application is used to store various types of data to support the operation of the second device 1500. Examples of such data include: any computer program used to operate on the second device 1500.

[0522] The method disclosed in the above embodiment of the present application can be applied to the second processor 1502, or implemented by the second processor 1502. The second processor 1502 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the second processor 1502. The above-mentioned second processor 1502 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 1502 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the second memory 1503, and the second processor 1502 reads the information in the second memory 1503 and completes the steps of the above method in combination with its hardware.

[0523] In an exemplary embodiment, the second device 1500 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0524] Based on the hardware implementation of the above program modules, and in order to implement the method of the first client side of the embodiment of the present application, the embodiment of the present application also provides a client, such as Fig.16 As shown, the client 1600 includes:

[0525] The third communication interface 1601 is capable of exchanging information with other devices;

[0526] A third processor 1602 is connected to the third communication interface 1601 to implement information interaction with other devices, and is used to execute the method provided by one or more technical solutions of the first client side when running a computer program;

[0527] The third memory 1603 , on which the computer program is stored.

[0528] Specifically, the third communication interface 1601 is used to:

[0529] Sending first information to a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and receiving second information forwarded by the first device from a second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

[0530] In one embodiment, the third communication interface 1601 is further used for:

[0531] Sending fifth information to the first device, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client;

[0532] Receiving a second credential sent by the first device, where the second credential represents authorization for the first client to activate quantum secure communication capability;

[0533] Sending thirteenth information to the server, where the thirteenth information is used to request activation of quantum secure communication capability, the thirteenth information includes the first certificate and the second certificate, and the server is at least used to provide business services for the first client;

[0534] Receive information related to activating quantum secure communication capability sent by the first device.

[0535] In one embodiment, the third processor 1602 is configured to:

[0536] A plurality of fifth quantum keys and the first certificate are obtained from the server through the third communication interface 1601, wherein the plurality of fifth quantum keys at least include the first quantum key and a third quantum key, the third quantum key is used to establish a first channel, and the first channel is used to perform quantum secure communication with the first device.

[0537] In one embodiment, the third communication interface 1601 is further used for:

[0538] Sending third information to the first device, where the third information is used to request to establish a first channel, and the third information includes identification information of the third quantum key.

[0539] In one embodiment, the third communication interface 1601 is further used for:

[0540] Receive eleventh information sent by the first device, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key, where the sixth quantum key is generated by a QRNG, and where the sixth quantum key is used for the first client to perform quantum secure communication.

[0541] In one embodiment, the third communication interface 1601 is further used for:

[0542] Sending fourteenth information to a first device corresponding to a second client, where the fourteenth information is used to request to obtain one or more sixth quantum keys, and the second client includes a client that performs quantum secure communication with the first client;

[0543] Receive the one or more sixth quantum keys sent by the first device corresponding to the second client.

[0544] It should be noted that the specific processing process of the third processor 1602 and the third communication interface 1601 can be understood by referring to the above method.

[0545] Of course, in actual application, the various components in the client 1600 are coupled together through the bus system 1604. It can be understood that the bus system 1604 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1604 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.16 Various buses are labeled as bus system 1604.

[0546] The third memory 1603 in the embodiment of the present application is used to store various types of data to support the operation of the client 1600. Examples of such data include: any computer program used to operate on the client 1600.

[0547] The method disclosed in the above embodiment of the present application can be applied to the third processor 1602, or implemented by the third processor 1602. The third processor 1602 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the third processor 1602. The above-mentioned third processor 1602 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The third processor 1602 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the third memory 1603, and the third processor 1602 reads the information in the third memory 1603 and completes the steps of the above method in combination with its hardware.

[0548] In an exemplary embodiment, the client 1600 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0549] Based on the hardware implementation of the above program modules, and in order to implement the method on the server side of the embodiment of the present application, the embodiment of the present application also provides a server, which is at least used to provide business services to the first client, such as Fig.17 As shown, the server 1700 includes:

[0550] The fourth communication interface 1701 is capable of exchanging information with other devices;

[0551] A fourth processor 1702, connected to the fourth communication interface 1701 to implement information interaction with other devices, and configured to execute the method provided by one or more technical solutions on the server side when running a computer program;

[0552] A fourth memory 1703 , on which the computer program is stored.

[0553] Specifically, the fourth processor 1702 is configured to:

[0554] In the case where an authentication request for a first credential is received from a first device through the fourth communication interface 1701, the first credential is authenticated; the first credential represents the identity of the first client; and in the case where a thirteenth message sent by the first client is received through the fourth communication interface 1701, the second credential is authenticated by the first device, so that the first device activates the quantum secure communication capability for the first client if the second credential is authenticated, the thirteenth message includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

[0555] In one embodiment, the fourth communication interface 1701 is further used for:

[0556] Sending eighth information to the first device, where the eighth information is used to register the server on the first device;

[0557] Acquire a plurality of fifth quantum keys allocated to the server from the second device, wherein the plurality of fifth quantum keys at least include a third quantum key and a fourth quantum key; the third quantum key is used to establish a first channel, and the first channel is used for the first client to perform quantum secure communication with the first device; the fourth quantum key is used to establish a second channel, and the second channel is used for the server to perform quantum secure communication with the first device;

[0558] The second channel is established using the fourth quantum key, and the third quantum key is sent to the first client so that the first client can establish the first channel with the first device.

[0559] In one embodiment, the fourth communication interface 1701 is specifically used for:

[0560] receiving identity authentication information of the first client;

[0561] In a case where the first client identity authentication passes, the fourth processor 1702 is configured to:

[0562] A third quantum key and a first certificate are provided to the first client through the fourth communication interface 1701, where the first certificate represents the identity of the first client.

[0563] In one embodiment, the fourth communication interface 1701 is specifically used for:

[0564] Sending sixth information to the first device, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of the fourth quantum key.

[0565] It should be noted that the specific processing process of the fourth processor 1702 and the fourth communication interface 1701 can be understood by referring to the above method.

[0566] Of course, in actual application, the various components in the server 1700 are coupled together through the bus system 1704. It can be understood that the bus system 1704 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1704 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Fig.17 Various buses are labeled as bus system 1704.

[0567] The fourth memory 1703 in the embodiment of the present application is used to store various types of data to support the operation of the server 1700. Examples of such data include: any computer program used to operate on the server 1700.

[0568] The method disclosed in the above embodiment of the present application can be applied to the fourth processor 1702, or implemented by the fourth processor 1702. The fourth processor 1702 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the fourth processor 1702 or an instruction in the form of software. The above-mentioned fourth processor 1702 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The fourth processor 1702 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the fourth memory 1703, and the fourth processor 1702 reads the information in the fourth memory 1703 and completes the steps of the above method in combination with its hardware.

[0569] In an exemplary embodiment, the server 1700 can be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, Microprocessors, or other electronic components to execute the aforementioned methods.

[0570] It can be understood that the memory (first memory 1403, second memory 1503, third memory 1603, fourth memory 1703) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache.By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

[0571] In an exemplary embodiment, the embodiment of the present application further provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, including a first memory 1403 storing a computer program, the computer program can be executed by the first processor 1402 of the first device 1400 to complete the steps of the first device side method, for example, including a second memory 1503 storing a computer program, the computer program can be executed by the second processor 1502 of the second device 1500 to complete the steps of the second device side method, for example, including a third memory 1603 storing a computer program, the computer program can be executed by the third processor 1602 of the client 1600 to complete the steps of the first client side method, for example, including a fourth memory 1703 storing a computer program, the computer program can be executed by the fourth processor 1702 of the server 1700 to complete the steps of the server side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

[0572] In an exemplary embodiment, the embodiment of the present application also provides a computer program product, including a computer program, which can be executed by the first processor 1402 of the first device 1400 to complete the steps of the aforementioned first device-side method, or, the computer program can be executed by the second processor 1502 of the second device 1500 to complete the steps of the aforementioned second device-side method, or, the computer program can be executed by the third processor 1602 of the client 1600 to complete the steps of the aforementioned first client-side method, or, the computer program can be executed by the fourth processor 1702 of the server 1700 to complete the steps of the aforementioned server-side method.

[0573] In order to implement the method provided in the embodiment of the present application, the embodiment of the present application also provides a quantum key distribution system, such as Fig.18 As shown, the system includes: a first device 1801, a second device 1802, a client 1803, and a server 1804.

[0574] Here, it should be noted that the specific processing procedures of the first device 1801, the second device 1802, the client 1803, and the server 1804 have been described in detail above and will not be repeated here.

[0575] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0576] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0577] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A quantum key distribution method, characterized in that: Applied to a first device, the method includes: Receiving first information sent by a first client, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; Sending the first information to a second device, where the second device is at least used to manage quantum keys; Receive second information sent by the second device, and forward the second information to the first client, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

2. The method according to claim 1, characterized in that Communicate with the first client through an established first channel, where the first channel is used for quantum secure communication between the first device and the first client.

3. The method according to claim 2, characterized in that The method further comprises: receiving third information sent by the first client, where the third information is used to request to establish the first channel, and the third information includes identification information of a third quantum key; Sending fourth information to the second device, where the fourth information is used to obtain the third quantum key, and the fourth information includes the third information; Receiving the third quantum key sent by the second device; The first channel is established using the third quantum key.

4. The method according to claim 2, characterized in that: The method further comprises: receiving fifth information sent by the first client, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client; authenticating the first credential through a server, the server being at least used to provide business services to the first client; If the first credential is authenticated successfully, sending a second credential to the first client, so that the first client can use the first credential and the second credential to activate the quantum secure communication capability, wherein the second credential represents authorization for the first client to activate the quantum secure communication capability; Upon receiving an authentication request from the server for the second credential, the second credential is authenticated; and if the second credential is authenticated successfully, quantum secure communication capability is activated for the first client.

5. The method according to claim 4, characterized in that Communicate with the server through the established second channel, where the second channel is used for quantum secure communication between the first device and the server.

6. The method according to claim 5, characterized in that The method further comprises: receiving sixth information sent by the server, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of a fourth quantum key; Sending seventh information to the second device, where the seventh information is used to obtain the fourth quantum key, and the seventh information includes the sixth information; Receiving the fourth quantum key sent by the second device; The second channel is established using the fourth quantum key.

7. The method according to claim 5, characterized in that The method further comprises: receiving eighth information sent by the server, where the eighth information is used to register the server on the first device; Ninth information is sent to the second device, where the ninth information is used to request the second device to assign multiple fifth quantum keys to the server, so that the server and a client associated with the server can establish a channel for quantum secure communication, where the multiple fifth quantum keys include at least the first quantum key, the third quantum key and the fourth quantum key, the client associated with the server includes at least the first client, and the channel for quantum secure communication includes at least the first channel and the second channel.

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: Sending tenth information to the second device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a quantum random number generator QRNG, and where the sixth quantum keys are used for the first client to perform quantum secure communication; Receive eleventh information sent by the second device, and forward the eleventh information to the first client, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

9. The method according to claim 8, characterized in that The method further comprises: receiving twelfth information sent by a second client, the twelfth information being used to request to obtain one or more sixth quantum keys of the one or more sixth quantum keys, wherein the second client includes a client performing quantum secure communication with the first client; One or more sixth quantum keys are sent to the second client.

10. A quantum key distribution method, characterized in that: Applied to a second device, the second device being at least used for managing a quantum key, the method comprising: receiving first information sent by a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; Sending second information to the first device so that the first device forwards the second information to the first client, wherein the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

11. The method according to claim 10, characterized in that The method further comprises: receiving tenth information sent by the first device, where the tenth information is used to request to obtain one or more sixth quantum keys, where the sixth quantum keys are generated by a QRNG, and where the sixth quantum keys are used by the first client to perform quantum secure communication; Sending eleventh information to the first device, so that the first device forwards the eleventh information to the first client, wherein the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key.

12. The method according to claim 10, characterized in that The method further comprises: receiving fourth information sent by the first device, where the fourth information includes third information, the third information includes identification information of a third quantum key, and the fourth information is used to obtain the third quantum key; The third quantum key is sent to the first device; wherein the third quantum key is used for the first device to establish a first channel, and the first channel is used for the first device to perform quantum secure communication with a first client.

13. The method according to claim 10, characterized in that The method further comprises: receiving seventh information sent by the first device, where the seventh information includes sixth information, the sixth information includes identification information of a fourth quantum key, and the seventh information is used to obtain the fourth quantum key; Sending the fourth quantum key to the first device; wherein the fourth quantum key is used for the first device to establish a second channel, the second channel is used for the first device to perform quantum secure communication with a server, and the server is at least used to provide business services for the first client.

14. The method according to claim 10, characterized in that The method further comprises: Receive ninth information sent by the first device, where the ninth information is used to request the second device to allocate multiple fifth quantum keys to the server, so that the server and the client associated with the server can establish a channel for quantum secure communication; wherein the multiple fifth quantum keys at least include the first quantum key, the third quantum key and the fourth quantum key; the third quantum key is used to establish a first channel, where the first channel is used for the first device to perform quantum secure communication with the first client; the fourth quantum key is used to establish a second channel, where the second channel is used for the first device to perform quantum secure communication with the server; the server is at least used to provide business services for the first client, and the channel for quantum secure communication includes at least the first channel and the second channel; Allocate the plurality of fifth quantum keys to the server.

15. A quantum key distribution method, characterized in that: Applied to a first client, the method includes: Sending first information to a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; Receive second information forwarded by the first device from a second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

16. The method according to claim 15, characterized in that The method further comprises: Sending fifth information to the first device, where the fifth information is used to request activation of quantum secure communication capability, and the fifth information includes a first credential, where the first credential represents the identity of the first client; Receiving a second credential sent by the first device, where the second credential represents authorization for the first client to activate quantum secure communication capability; Sending thirteenth information to the server, where the thirteenth information is used to request activation of quantum secure communication capability, the thirteenth information includes the first certificate and the second certificate, and the server is at least used to provide business services for the first client; Receive information related to activating quantum secure communication capability sent by the first device.

17. The method according to claim 16, characterized in that The method further comprises: A plurality of fifth quantum keys and the first certificate are obtained from the server, wherein the plurality of fifth quantum keys at least include the first quantum key and a third quantum key, the third quantum key is used to establish a first channel, and the first channel is used to perform quantum secure communication with the first device.

18. The method according to claim 17, characterized in that The method further comprises: Sending third information to the first device, where the third information is used to request to establish a first channel, and the third information includes identification information of the third quantum key.

19. The method according to claim 15, characterized in that The method further comprises: Receive eleventh information sent by the first device, where the eleventh information includes one or more sixth quantum keys encrypted using the first quantum key, where the sixth quantum key is generated by a QRNG, and where the sixth quantum key is used for the first client to perform quantum secure communication.

20. A quantum key distribution method, characterized in that: Applied to a server, the server is at least used to provide business services for a first client, the method comprising: Upon receiving an authentication request from a first device for a first credential, authenticating the first credential; the first credential represents the identity of the first client; When the thirteenth information sent by the first client is received, the second credential is authenticated by the first device so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated. The thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

21. The method according to claim 20, characterized in that The method further comprises: Sending eighth information to the first device, where the eighth information is used to register the server on the first device; Acquire a plurality of fifth quantum keys allocated to the server from the second device, wherein the plurality of fifth quantum keys at least include a third quantum key and a fourth quantum key; the third quantum key is used to establish a first channel, and the first channel is used for the first client to perform quantum secure communication with the first device; the fourth quantum key is used to establish a second channel, and the second channel is used for the server to perform quantum secure communication with the first device; The second channel is established using the fourth quantum key, and the third quantum key is sent to the first client so that the first client can establish the first channel with the first device.

22. The method according to claim 21, characterized in that The sending the third quantum key to the first client includes: receiving identity authentication information of the first client; In a case where the identity authentication of the first client is passed, a third quantum key and a first certificate are provided to the first client, where the first certificate represents the identity of the first client.

23. The method according to claim 21, characterized in that The establishing the second channel by using the fourth quantum key comprises: Sending sixth information to the first device, where the sixth information is used to request to establish the second channel, and the sixth information includes identification information of the fourth quantum key.

24. A quantum key distribution device, characterized in that: include: A first receiving unit, configured to receive first information sent by a first client, wherein the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and receiving second information sent by a second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, where the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys; The first sending unit is used to send the first information to the second device, and forward the second information to the first client.

25. A quantum key distribution device, characterized in that: include: A second receiving unit is used to receive first information sent by the first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; The second sending unit is used to send second information to the first device, so that the first device forwards the second information to the first client, the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

26. A quantum key distribution device, characterized in that: The settings on the first client include: A third sending unit is used to send first information to the first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; The third receiving unit is used to receive second information forwarded by the first device from the second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, the second quantum key is used for the first client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

27. A quantum key distribution device, characterized in that: The server is configured to provide a business service to the first client, including: A first authentication unit, configured to authenticate a first credential upon receiving an authentication request for a first credential from a first device; the first credential represents an identity of the first client; The second authentication unit is used to authenticate the second credential through the first device when receiving the thirteenth information sent by the first client, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated. The thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

28. A first device, characterized in that: include: A first processor and a first communication interface; wherein, The first communication interface is used to receive first information sent by a first client, the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; send the first information to a second device, the second device is at least used to manage quantum keys; and receive second information sent by the second device and forward the second information to the first client, the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

29. A second device, characterized in that: The second device is at least used for managing quantum keys, including: a second processor and a second communication interface; wherein, The second communication interface is used to receive first information sent by a first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and to send second information to the first device so that the first device forwards the second information to a first client, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the first client to perform quantum secure communication.

30. A client, characterized in that: include: A third processor and a third communication interface; wherein, The third communication interface is used to send first information to the first device, where the first information is used to request a quantum key for quantum secure communication, and the first information includes identification information of the first quantum key; and receive second information forwarded by the first device from the second device, where the second information includes one or more second quantum keys encrypted using the first quantum key, and the second quantum key is used for the client to perform quantum secure communication, and the second device is at least used to manage quantum keys.

31. A server, characterized in that: The server is at least used to provide business services for the first client, including: a fourth processor and a fourth communication interface; wherein, The fourth processor is configured to authenticate the first credential when an authentication request for a first credential is received from the first device through the fourth communication interface; the first credential represents the identity of the first client; and when thirteenth information sent by the first client is received through the fourth communication interface, authenticate the second credential through the first device, so that the first device activates the quantum secure communication capability for the first client when the second credential is authenticated, the thirteenth information includes the first credential and the second credential, and the second credential represents the authorization for the first client to activate the quantum secure communication capability.

32. A first device, characterized in that: include: a first processor and a first memory for storing a computer program executable on the processor, Wherein, when the first processor is used to run the computer program, the steps of the method described in any one of claims 1 to 9 are executed.

33. A second device, characterized in that: include: a second processor and a second memory for storing a computer program executable on the processor, Wherein, when the second processor is used to run the computer program, the steps of the method described in any one of claims 10 to 14 are executed.

34. A first client, characterized in that: include: a third processor and a third memory for storing a computer program executable on the processor, Wherein, when the third processor is used to run the computer program, it executes the steps of the method described in any one of claims 15 to 19.

35. A server, characterized in that: include: a fourth processor and a fourth memory for storing a computer program executable on the processor, Wherein, the fourth processor is used to execute the steps of the method described in any one of claims 20 to 23 when running the computer program.

36. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 9, or implements the steps of the method described in any one of claims 10 to 14, or implements the steps of the method described in any one of claims 15 to 19, or implements the steps of the method described in any one of claims 20 to 23.

37. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 9, or implements the steps of the method described in any one of claims 10 to 14, or implements the steps of the method described in any one of claims 15 to 19, or implements the steps of the method described in any one of claims 20 to 23.

Images