Quantum secure communication method and device with limited key quantity, equipment and medium

Abstract

The invention discloses a quantum security communication method and device with limited key quantity, equipment and a medium. The target encryption proportion is determined by calculating the product of the secret key supplement bandwidth proportion, the secret supplement service parallel rate and the current service communication bandwidth and according to the ratio of the product to the secret key supplement available bandwidth, so that the encryption proportion is reasonably, scientifically and dynamically adjusted according to the current own network state. Through the determined target encryption proportion, the true random number is expanded according to the pre-configured key expansion algorithm, and the quantum security communication of the service is supported through the expanded random number, so that the service communication quality is ensured, the key resource is utilized to the maximum extent, the continuity and stability of the quantum security communication are improved, and the service security communication efficiency is improved. The problem that stable and continuous quantum security communication cannot be ensured due to the fact that each piece of to-be-encrypted data cannot be allocated to a unique key when the communication bandwidth of the quantum security terminal is insufficient or the storage space is limited is solved.

Description

Technical Field

[0001] The present application relates to the technical field of information security and quantum encryption technology, and in particular to a quantum secure communication method, device, equipment and medium with limited key quantity. Background Art

[0002] With the rapid development of information technology, quantum secure communication, as an emerging communication method, has attracted much attention due to its theoretically unbreakable security features. In the process of quantum secure communication, the communicating parties usually use a 1:1 encryption ratio to perform quantum encryption on the data, thereby ensuring high security strength of the communication.

[0003] However, as quantum secure communication proceeds, the true random numbers stored in the quantum security terminal will be continuously consumed. In order to maintain the continuity and security of quantum secure communication, the quantum security terminal must be supplemented with keys. In the prior art, a common key supplement method is to use online key supplement. In this way, the quantum security terminal connects to the key center online, downloads the key from the key center to the local, and stores the key in the local storage device. Subsequently, during the business communication process, the quantum security terminal uses the stored true random numbers to perform quantum secure communication on the data.

[0004] However, quantum secure communication methods that rely on online key supplementation also face some challenges. First, since key supplementation is based on the device communication link, it will occupy the communication bandwidth of the quantum security terminal. This will have a certain impact on the communication capability of the quantum security terminal, especially when the device's surplus communication bandwidth is insufficient to support the available bandwidth for key supplementation, which may lead to a decrease in communication quality. In addition, when the quantum security terminal needs to perform quantum secure communication, if there are not enough true random numbers to use, it will further aggravate the deterioration of communication quality.

[0005] In addition to the communication bandwidth problem, some micro quantum security terminals have great limitations in network capacity and storage capacity. The network connection speed of these micro quantum security terminals is slow, and the storage space is limited, and the key space that can be stored is very limited. This results in these micro quantum security terminals being unable to store too many keys for encryption during quantum secure communication. Therefore, when performing quantum secure communication on these micro quantum security terminals, special consideration needs to be given to key management and usage strategies.

[0006] In other words, when the quantum security terminal communication bandwidth is insufficient or the storage space is limited, 1:1 true random number encryption communication cannot be achieved. This means that each piece of data to be encrypted cannot be assigned a unique key, and thus stable and continuous quantum security communication cannot be guaranteed. Summary of the invention

[0007] The present application provides a quantum secure communication method, apparatus, device and medium with limited key quantity, which is used to solve the problem that when the communication bandwidth of the quantum security terminal is insufficient or the storage space is limited, each data to be encrypted cannot be assigned a unique key, thereby failing to ensure stable and continuous quantum secure communication.

[0008] In a first aspect, the present application provides a quantum secure communication method with limited key quantity, the method comprising:

[0009] Obtain the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein, the key supplement and business parallel ratio is the degree of temporal overlap between key supplement and business communication in the time period between two adjacent key supplements; the key supplement available bandwidth is determined according to the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length;

[0010] Determine the product of the key supplement bandwidth ratio, the key supplement and service parallel ratio, and the current service communication bandwidth;

[0011] According to the ratio between the product and the key supplement available bandwidth, a target encryption ratio is determined, so that according to the target encryption ratio and a pre-configured key expansion algorithm, the true random number is expanded, and the quantum secure communication of the business is supported by the expanded random number.

[0012] In a second aspect, the present application provides a quantum secure communication device with limited key quantity, the device comprising:

[0013] An acquisition unit is used to acquire the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein the key supplement and business parallel ratio is the degree of overlap between the key supplement and the business communication in time during the time period between two adjacent key supplements; the key supplement available bandwidth is determined according to the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length;

[0014] The processing unit is used to determine the key supplement bandwidth ratio, the product of the key supplement and business parallel rate and the current business communication bandwidth; determine the target encryption ratio according to the ratio between the product and the key supplement available bandwidth, so as to expand the true random number according to the target encryption ratio and a pre-configured key expansion algorithm, and support quantum secure communication of the business through the expanded random number.

[0015] In a third aspect, the present application also provides a quantum security terminal, which includes at least a processor and a memory, and the processor is used to implement the steps of the quantum security communication method with limited key amount as described in the first aspect above when executing a computer program stored in the memory.

[0016] In a fourth aspect, the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the quantum secure communication method with limited key quantity as described in the first aspect above.

[0017] In a fifth aspect, the present application also provides a computer program product, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the steps of the quantum secure communication method with limited key quantity as described in the first aspect above.

[0018] The beneficial effects of this application are as follows:

[0019] 1. By obtaining the total transmission bandwidth, the current business communication bandwidth, and the key supplement and business parallel ratio, it is possible to accurately calculate the bandwidth resources that key supplement can actually occupy under the existing network conditions, which is conducive to the rational planning of network bandwidth, avoiding bandwidth conflicts and improving network resource utilization.

[0020] 2. By calculating the product of the key supplement bandwidth ratio, the key supplement business parallel rate and the current business communication bandwidth, and determining the target encryption ratio based on the ratio between the product and the key supplement available bandwidth, the encryption ratio can be dynamically adjusted reasonably and scientifically according to the current network status.

[0021] 3. By determining the target encryption ratio and following the pre-configured key expansion algorithm, the true random numbers are expanded. The expanded random numbers support quantum secure communication for the business, thereby ensuring that while ensuring the quality of business communications, key resources are utilized to the maximum extent possible, improving the continuity and stability of quantum secure communications, and avoiding the problem that when the quantum secure terminal communication bandwidth is insufficient or the storage space is limited, each data to be encrypted cannot be assigned a unique key, thereby failing to ensure stable and continuous quantum secure communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 A schematic diagram of a process of quantum secure communication with limited key quantity provided in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of a specific quantum secure communication process with limited key quantity provided in an embodiment of the present application;

[0025] Figure 3 A schematic diagram of the structure of a quantum secure communication device with limited key quantity provided in this application;

[0026] Figure 4 A schematic diagram of the structure of a quantum security terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0028] In order to ensure that each data to be encrypted can still be assigned a unique key when the communication bandwidth of the quantum security terminal is insufficient or the storage space is limited, thereby ensuring stable and continuous quantum security communication, the present application provides a quantum security communication method, apparatus, device and medium with limited key quantity.

[0029] Embodiment 1:

[0030] Figure 1 A schematic diagram of a process of quantum secure communication with limited key quantity provided in an embodiment of the present application, the process comprising:

[0031] S101: Obtain the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein, the key supplement and business parallel ratio is the degree of temporal overlap between key supplement and business communication in the time period between two adjacent key supplements; the key supplement available bandwidth is determined based on the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length.

[0032] The quantum secure communication method with limited key quantity provided in the present application is applied to a quantum secure terminal, which may be a private computer, a quantum secure all-in-one machine, a micro quantum secure terminal with small communication bandwidth or limited storage space, etc.

[0033] For business data, if its traffic has occupied most of the bandwidth resources of the quantum security terminal, this will directly affect the immediacy of the quantum security online supplementary key, resulting in the inability to quickly provide the necessary key updates for business communications. Therefore, in this case, when executing quantum encryption to protect business data, it is not appropriate to use a 1:1 encryption ratio to consume true random numbers. This ratio means that true random numbers of each bit length are only used to encrypt an equal amount of data bits. If the encryption ratio of 1:1 is maintained, it will be difficult to ensure the continuity and efficiency of encryption operations under resource constraints. In order to ensure the continuity and stable operation of quantum security communication, in this application, if quantum security communication is to be continued, the current key consumption requirements can be met by using key expansion. Exemplarily, the quantum security terminal can dynamically adjust its own encryption ratio based on its own network conditions to expand the locally stored true random numbers according to the adjusted encryption ratio, thereby ensuring that the current quantum security communication can have enough keys for encryption. For example, an encryption ratio of 1:1 means that each bit length of the true random number can only encrypt 1 bit of data, while an encryption ratio of 1:2 means that each bit length of the true random number is sufficient to encrypt 2 bits of data, and so on. The choice of this ratio is directly related to the strength of encryption and resource consumption.

[0034] To achieve this goal, the quantum security terminal will first collect a series of key parameters, including total transmission bandwidth, current business communication bandwidth, key supplement business parallel rate, key supplement available bandwidth, and key supplement bandwidth ratio when the encryption ratio is 1:1. These key parameters together form the basis for evaluating the current communication environment and resource allocation. Among them, the total transmission bandwidth reflects the total communication capacity of the quantum security terminal, that is, the total bandwidth resources available for business and key supplement. The current business communication bandwidth indicates the amount of bandwidth currently occupied by business communication. The key supplement available bandwidth refers to the remaining bandwidth available for key supplement operations under the current network environment, which can be determined by the difference between the total transmission bandwidth and the current business communication bandwidth. The key supplement business parallel rate refers to the degree of overlap between key supplement and business communication in time during the time period between two adjacent key supplements, that is, the ratio of the time duration of key supplement and business communication parallel operation in this time period to the time duration of business communication in this time period. The key supplement bandwidth ratio when the encryption ratio is 1:1 provides a benchmark for evaluating how bandwidth resources should be reasonably allocated to business and key supplement tasks when the encryption ratio is 1:1.

[0035] In a possible implementation, the key supplement bandwidth ratio is determined based on the ratio of the average key supplement bandwidth to the average business communication bandwidth, and the ratio of the time it takes to consume a key file to the time it takes to download a key file when the encryption ratio is 1:1; wherein the average key supplement bandwidth is determined based on the difference between the total transmission bandwidth and the average business communication bandwidth.

[0036] Since the data downloaded during the key supplement process is not only pure key data, but also accompanied by the transmission of communication protocols, such as encryption headers, the average bandwidth of key supplementation includes not only the average bandwidth of pure key downloading, but also the average bandwidth of communication protocol transmission. Therefore, when allocating bandwidth, the average bandwidth of pure key downloading needs to be greater than the average bandwidth of business communication to ensure the continuity and stability of quantum secure communication. Among them, the average bandwidth of pure key downloading can be determined by the proportion of key supplement bandwidth and the average bandwidth of key supplementation. The proportion of key supplement bandwidth represents the ratio of the average bandwidth of key supplementation to the average bandwidth of key downloading when the encryption ratio is 1:1. The average bandwidth of key downloading is determined based on the difference between the total transmission bandwidth and the average bandwidth of business communication.

[0037] Assuming that the total transmission bandwidth of the quantum security terminal is m bps and the average bandwidth of business communication is n bps under the encryption ratio of 1:1, the average bandwidth of key supplementation used for key supplementation is d = (mn) bps. When d>n, it means that the bandwidth resources of the quantum security terminal can support online key supplementation, and the larger d is, the better. If the actual ratio between the average bandwidth of key supplementation and the average bandwidth of key download is x, then the average bandwidth of pure key download is d / x. In order to ensure the stability and continuity of quantum security communication, the bandwidth of pure key download needs to be greater than the average bandwidth of business communication, that is, d / x>n. According to the relationship of d / x>n, it can be obtained that d / n>x. According to the above conditions, the larger d is, the more it can meet the requirements of online key supplementation bandwidth. It can be inferred that the larger the value of d / n is, the easier it is to meet the needs of rapid key supplementation. Therefore, when determining the proportion of key supplementation bandwidth according to the ratio of the average bandwidth of key supplementation to the average bandwidth of business communication, the actual ratio x between the average bandwidth of key supplementation and the average bandwidth of key download can be magnified to a certain extent.

[0038] For example, if the average packet length of a key data packet is 800 bytes, the length of the communication protocol in the key data packet is 50 bytes, the average bandwidth of business communication is n bps, and the average bandwidth of key supplement is d bps, then the communication protocol occupies an average of 1 / 16 of the key data packet, and the pure key data occupies 15 / 16 of the key data packet. In other words, 1 / 16 of the bandwidth in the average bandwidth of key supplement is used to transmit the communication protocol, and 15 / 16 of the bandwidth is used to transmit pure key data, that is, 1 / 16d is the average bandwidth of communication protocol transmission, and 15 / 16d is the average bandwidth of pure key download. If you want 15 / 16d>n, then d / n>16 / 15, you can amplify this 16 / 15 to a certain extent, and determine the amplified value as the key supplement bandwidth ratio, for example, 1.5.

[0039] At the same time, since key supplementation is based on file granularity download, it is not that a frame of key can be used after downloading a frame of key, but after a key file is downloaded, the paired parties can complete the integrity check and consistency check of the supplemented key file before the key file can be used. Similarly, when the key is used, the loading of the key file is also loaded at the file granularity, that is, after the key file is loaded, there can be no more download operations and verification and consistency operations for the key file, and it is already a final reliable key file. When the average bandwidth of pure key download is greater than the average bandwidth of business communication, this only means that in theory, the quantum security terminal has sufficient network capacity to quickly download key data without being limited by the bandwidth of business communication. However, the speed of key file supplementation involves multiple links such as key file transmission and verification, and is a comprehensive indicator. If the speed of key file supplementation cannot keep up with the consumption speed of business communication, then even if the bandwidth of pure key download is large, it may lead to insufficient key supply. Therefore, in order to make the keys used for business communication available continuously, in this application, when determining the proportion of key supplement bandwidth, in addition to considering that the average bandwidth of pure key download is greater than the average bandwidth of business communication, it is also necessary to consider that the time to consume a key file is longer than the time to download a key file.

[0040] Suppose the size of a key file is f Byte, the download rate of a key file is v1 bps, and the consumption rate of a key file is v2 bps. Then the duration t1 for downloading a key file is 8f / v1, and the duration t2 for consuming a key file is 8f / v2. To ensure a continuous supply of keys for service encryption, it is necessary to satisfy t1 < t2, that is, 8f / v1 < 8f / v2. In other words, if it is desired that the duration of consuming a key file in service communication is longer than the duration of replenishing a key file, then the download rate of a key file needs to be greater than the consumption rate of a key file. For example, if the average bandwidth of service communication is n bps and the average bandwidth of key replenishment is d bps, and d / x is the average bandwidth for pure key download, in the extreme case, v1 can be maximally represented by the average bandwidth for pure key download, and v2 can be maximally represented by the average bandwidth of service communication. Therefore, the proportion of this key replenishment bandwidth needs to satisfy the following (1) and (2):

[0041] (1) d / n > x;

[0042] (2) v1 = d / x > v2 = n;

[0043] That is to say, it is required that the proportion of this key replenishment bandwidth satisfies the bandwidth requirement in (1) and also satisfies the rate requirement in (2). Suppose x is 16 / 15, then by magnifying this x, the proportion of this key replenishment bandwidth can be taken as 1.5, and this proportion of key replenishment bandwidth satisfies the above (1) and (2).

[0044] It should be noted that the proportion of this key replenishment bandwidth can be manually configured into the quantum security terminal or automatically determined by the quantum security terminal based on the above embodiments. The quantum security terminal can fixedly save the proportion of key replenishment bandwidth after determining it, or update the proportion of key replenishment bandwidth in real time according to its own network status.

[0045] In one example, for service encryption, to ensure that a key file is always available, the timing of key replenishment is not to replenish after the key file is used up, but to start in advance. Since it operates at the key file granularity, key replenishment is also triggered at the file granularity. To ensure service reliability, when key replenishment is to be triggered, the service encryption is using a key file. It is possible that the key replenishment has not been completed yet, and the service needs to switch to the next file. And there is a consistency check during the download process to have a redundant file in case the check fails. Therefore, the condition for triggering key replenishment is that there are at least three key files. Based on this, a file threshold for unused key files can be preset, and this preset file threshold is an integer greater than or equal to 3. For example, when the quantum security terminal determines that there are three remaining key files, key replenishment can be triggered.

[0046] In one example, the quantum security terminal can determine the target encryption ratio in real time, or determine the encryption ratio when the available bandwidth for key supplementation of the quantum security terminal is insufficient. Exemplarily, the quantum security terminal can monitor whether the ratio between the available bandwidth for key supplementation and the current business communication bandwidth is less than the saved key supplement bandwidth ratio. In this way, the situation of bandwidth resource shortage can be identified in advance, and an important basis for the subsequent determination of the target encryption ratio can be provided. If it is determined that the ratio between the available bandwidth for key supplementation and the business communication bandwidth is less than the key supplement bandwidth ratio, it means that the current network resources are relatively tight and a more cautious and efficient encryption strategy needs to be adopted. The quantum security terminal can intelligently adjust the encryption ratio according to its own network status, for example, from 1:1 to 1:N (N>1), so as to reduce the consumption of true random numbers and extend the key life cycle accordingly. If it is determined that the ratio between the available bandwidth for key supplementation and the business communication bandwidth is not less than the key supplement bandwidth ratio, it means that the current network resources are relatively abundant and the encryption ratio does not need to be adjusted. Then, it continues to monitor whether the ratio between the available bandwidth for key supplementation and the current business communication bandwidth is less than the saved key supplement bandwidth ratio.

[0047] S102: Determine the product of the key supplement bandwidth ratio, the key supplement and service parallel ratio, and the current service communication bandwidth.

[0048] S103: Determine a target encryption ratio according to a ratio between the product and the key supplement available bandwidth, and expand the true random number according to the target encryption ratio and a pre-configured key expansion algorithm, so as to support quantum secure communication of the service through the expanded random number.

[0049] After obtaining the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the encryption ratio is saved to 1:1 based on the above embodiment, the key supplement bandwidth ratio, the product of the key supplement and business parallel ratio and the current business communication bandwidth can be determined first. Then, based on the ratio between the product and the key supplement available bandwidth, the target encryption ratio is determined.

[0050] The derivation process for determining the target encryption ratio is as follows:

[0051] Assume that the current encryption ratio is 1:a, the key replenishment and business parallel rate is y, the total transmission bandwidth is mbps, the current business communication bandwidth is n bps, the key replenishment bandwidth ratio is e, the business communication duration between two adjacent key replenishments is v, and the amount of keys consumed by business communication is z. Then the required amount of keys is z / a, the rate of downloading pure key data is d'=(z / a) / (v / y)=yz / av, and the rate at which the business consumes key data is n=z / v.

[0052] According to d'=yz / av, the encryption ratio a=zy / vd' can be deduced.

[0053] Because n=z / v, then a=zy / vd′=yn / d′=yn / (d / e)=eyn / d.

[0054] Since d=mn, then a=eyn / d=eyn / (mn).

[0055] In a possible implementation, after determining the ratio between the product and the available bandwidth for key supplementation based on the above embodiment, the ratio can be determined as the minimum encryption ratio, and then the minimum encryption ratio can be rounded up, and the rounded value can be determined as the target encryption ratio.

[0056] After determining the target encryption ratio, the quantum security terminal can expand the true random number according to the target encryption ratio in combination with a pre-configured key expansion algorithm to support quantum secure communication of the business through the expanded random number.

[0057] In a possible application scenario, the global quantum security network can support secure and efficient quantum communication between any quantum security terminals connected to the global quantum security network, regardless of their geographical location. A core of the global quantum security network is to use the quantum security access base station as a communication hub to connect the quantum security terminal to the global quantum security network, and to achieve key relay between terminals connected to the quantum security network. In order to achieve secure key relay, the quantum security access base station stores true random numbers paired with the connected quantum security terminals. During the key relay process, the sender will send the key information of the key to the quantum security access base station that is connected. The quantum security access base station determines the corresponding key from the stored paired true random number based on the key information, and relays the key to the quantum security access base station of the decryption end through the quantum security network. The quantum security access base station of the decryption end then forwards the key to the decryption end, thereby ensuring that a symmetric quantum security key is formed between the sender and the decryption end, and encryption and decryption communication can be achieved. Based on this, the quantum security terminal can expand the true random number in the locally stored key pool based on the target encryption ratio to obtain the expanded random number, and then send the target encryption ratio to the connected quantum security access base station. After receiving the target encryption ratio, the quantum security access base station can expand the locally stored paired true random number based on the target encryption ratio to obtain the expanded random number, so that the expanded random number is consistent with the expanded random number in the quantum security terminal.

[0058] In another possible application scenario, a pairing true random number is stored between the quantum security terminal and the peer device for its point-to-point communication. Among them, for the quantum security terminal in the global quantum security network, the peer device can be an accessed quantum security access base station, or it can be a peer quantum security terminal with a point-to-point communication demand. For the quantum security terminal in the traditional quantum security network, the peer device is only a peer quantum security terminal with a point-to-point communication demand. After obtaining the target encryption ratio based on the above embodiment, the quantum security terminal can cache the target encryption ratio. When the quantum security terminal obtains the service data to be sent, the target key length is determined according to the target data length of the data to be sent and the target encryption ratio of the cache. For example, if the target data length is 600Byte and the cached target encryption ratio is 1:10, then according to the target data length and the target encryption ratio, the target key length is determined to be 600 / 10=60Byte. Then the true random number of the target key length is obtained from the locally saved key pool. The acquired true random number is expanded based on the target encryption ratio through a pre-configured key expansion algorithm to obtain an expanded random number. The length of the expanded random number is the target data length. Then, according to the expanded random number, the service data to be sent is quantum encrypted according to the pre-configured quantum encryption algorithm to obtain the ciphertext data. The ciphertext data carrying the target encryption ratio is sent to the receiving end. The receiving end can then expand the paired true random number according to the target encryption ratio to obtain the decryption key corresponding to the ciphertext data, and then decrypt the ciphertext data based on the decryption key.

[0059] Among them, the key expansion algorithm can be an AES encryption function, a DES encryption function, etc. The specific process of expanding the acquired true random number based on the target encryption ratio through a pre-configured key expansion algorithm to obtain the expanded random number can refer to the technical solution in CN202211155962.5, which will not be described in detail here.

[0060] The beneficial effects of this application are as follows:

[0061] 1. By obtaining the total transmission bandwidth, the current business communication bandwidth, and the key supplement and business parallel ratio, it is possible to accurately calculate the bandwidth resources that key supplement can actually occupy under the existing network conditions, which is conducive to the rational planning of network bandwidth, avoiding bandwidth conflicts and improving network resource utilization.

[0062] 2. By calculating the product of the key supplement bandwidth ratio, the key supplement business parallel rate and the current business communication bandwidth, and determining the target encryption ratio based on the ratio between the product and the key supplement available bandwidth, the encryption ratio can be dynamically adjusted reasonably and scientifically according to the current network status.

[0063] 3. By determining the target encryption ratio and following the pre-configured key expansion algorithm, the true random numbers are expanded. The expanded random numbers support quantum secure communication for the business, thereby ensuring that while ensuring the quality of business communications, key resources are utilized to the maximum extent possible, improving the continuity and stability of quantum secure communications, and avoiding the problem that when the quantum secure terminal communication bandwidth is insufficient or the storage space is limited, each data to be encrypted cannot be assigned a unique key, thereby failing to ensure stable and continuous quantum secure communications.

[0064] Embodiment 2:

[0065] The quantum secure communication method with limited key quantity provided by the present application is described below through specific embodiments. Figure 2 A schematic diagram of a specific quantum secure communication process with limited key quantity provided in an embodiment of the present application, the process includes:

[0066] S201: The quantum security terminal obtains the current total transmission bandwidth and the current business communication bandwidth.

[0067] S202: The quantum security terminal determines the key supplement available bandwidth based on the difference between the total transmission bandwidth and the current service bandwidth.

[0068] S203: The quantum security terminal determines whether the ratio between the available bandwidth for key supplementation and the current business communication bandwidth is less than the key supplementation bandwidth ratio. If so, execute S204; otherwise, execute S201.

[0069] S204: The key supplement bandwidth ratio when the quantum security terminal obtains key supplement and business parallelism ratio and the saved encryption ratio is 1:1.

[0070] In a possible implementation, the key supplement bandwidth ratio is determined based on the ratio of the average key supplement bandwidth to the average business communication bandwidth, and the ratio of the time it takes to consume a key file to the time it takes to download a key file, when the encryption ratio is 1:1; wherein the average key supplement bandwidth is determined based on the difference between the total transmission bandwidth and the average business communication bandwidth.

[0071] S205: The quantum security terminal determines the key supplement bandwidth ratio, the product of the key supplement and business parallel ratio and the current business communication bandwidth.

[0072] S206: The quantum security terminal determines the ratio between the product and the available bandwidth for key supplementation as the minimum encryption ratio, rounds up the minimum encryption ratio, and determines the rounded value as the target encryption ratio.

[0073] S207: The quantum security terminal determines the target key length based on the target data length of the business data to be sent and the target encryption ratio.

[0074] S208: The quantum security terminal obtains a true random number of the target key length from the locally stored key pool.

[0075] S209: The quantum security terminal expands the true random number through a key expansion algorithm based on a target encryption ratio to obtain an expanded random number; wherein the length of the expanded random number is the target data length.

[0076] S210: The quantum security terminal performs quantum encryption on the service data to be sent according to the expanded random number and a pre-configured quantum encryption algorithm to obtain ciphertext data.

[0077] S211: The quantum security terminal sends the ciphertext data with the target encryption ratio to the receiving end.

[0078] In a possible implementation, the triggering condition for key supplementation is that the number of local unused key files is not greater than a preset file threshold; wherein the preset file threshold is an integer greater than or equal to 3.

[0079] Embodiment 3:

[0080] Based on the same inventive concept, the present application also provides a quantum secure communication device with limited key quantity. Figure 3 A schematic diagram of the structure of a quantum secure communication device with limited key quantity provided in this application, the device comprising:

[0081] The acquisition unit 31 is used to acquire the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein the key supplement and business parallel ratio is the degree of overlap between the key supplement and the business communication in time during the time period between two adjacent key supplements; the key supplement available bandwidth is determined according to the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length;

[0082] The processing unit 32 is used to determine the key supplement bandwidth ratio, the product of the key supplement and business parallel rate and the current business communication bandwidth; determine the target encryption ratio according to the ratio between the product and the key supplement available bandwidth, and expand the true random number according to the target encryption ratio and a pre-configured key expansion algorithm, and support quantum secure communication of the business through the expanded random number.

[0083] It should be noted that the principle of solving the technical problem of the quantum secure communication device with limited key amount provided in this embodiment is the same as the principle of solving the technical problem in the above method embodiment, and the repeated parts will not be repeated.

[0084] Embodiment 4:

[0085] Based on the above embodiments, the present application also provides a quantum security terminal. Figure 4 A schematic diagram of the structure of a quantum security terminal provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, it includes: a processor 41, a communication interface 42, a memory 43 and a communication bus 44, wherein the processor 41, the communication interface 42, and the memory 43 communicate with each other through the communication bus 44;

[0086] The memory 43 stores a computer program. When the program is executed by the processor 41, the processor 41 performs the following steps:

[0087] Obtain the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein, the key supplement and business parallel ratio is the degree of temporal overlap between key supplement and business communication in the time period between two adjacent key supplements; the key supplement available bandwidth is determined according to the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length;

[0088] Determine the product of the key supplement bandwidth ratio, the key supplement and service parallel ratio, and the current service communication bandwidth;

[0089] According to the ratio between the product and the key supplement available bandwidth, a target encryption ratio is determined, so that according to the target encryption ratio and a pre-configured key expansion algorithm, the true random number is expanded, and the quantum secure communication of the business is supported by the expanded random number.

[0090] Since the principle of solving the problem by the above-mentioned quantum security terminal is similar to the quantum security communication method with limited key quantity, the implementation of the above-mentioned quantum security terminal can refer to the embodiment of the method, and the repeated parts will not be repeated.

[0091] Embodiment 5:

[0092] On the basis of the above embodiments, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program runs on the processor, the processor implements the following steps when executing:

[0093] Obtain the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein, the key supplement and business parallel ratio is the degree of temporal overlap between key supplement and business communication in the time period between two adjacent key supplements; the key supplement available bandwidth is determined according to the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length;

[0094] Determine the product of the key supplement bandwidth ratio, the key supplement and service parallel ratio, and the current service communication bandwidth;

[0095] According to the ratio between the product and the key supplement available bandwidth, a target encryption ratio is determined, so that according to the target encryption ratio and a pre-configured key expansion algorithm, the true random number is expanded, and the quantum secure communication of the business is supported by the expanded random number.

[0096] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is similar to the quantum secure communication method with limited key quantity, the implementation of the above-mentioned computer-readable storage medium can refer to the embodiment of the method, and the repeated parts will not be repeated.

Claims

1. A quantum secure communication method with limited key quantity, characterized in that: The method comprises: Obtain the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein, the key supplement and business parallel ratio is the degree of temporal overlap between key supplement and business communication in the time period between two adjacent key supplements; the key supplement available bandwidth is determined according to the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length; Determine the product of the key supplement bandwidth ratio, the key supplement and service parallel ratio, and the current service communication bandwidth; According to the ratio between the product and the key supplement available bandwidth, a target encryption ratio is determined, so that according to the target encryption ratio and a pre-configured key expansion algorithm, the true random number is expanded, and the quantum secure communication of the business is supported by the expanded random number.

2. The method according to claim 1, characterized in that Before obtaining the current total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the stored encryption ratio is 1:1, the method further includes: It is determined that the ratio of the key supplement available bandwidth to the current service communication bandwidth is less than the key supplement bandwidth ratio.

3. The method according to claim 1, characterized in that The key supplement bandwidth ratio is determined based on the ratio of the average key supplement bandwidth to the average business communication bandwidth, and the ratio of the time it takes to consume a key file to the time it takes to download a key file when the encryption ratio is 1:1; wherein the key supplement average bandwidth is determined based on the difference between the total transmission bandwidth and the average business communication bandwidth.

4. The method according to claim 1, characterized in that The step of determining a target encryption ratio according to a ratio between the product and the key supplement available bandwidth comprises: Determining the ratio as a minimum encryption ratio; The minimum encryption ratio is rounded up, and the rounded value is determined as the target encryption ratio.

5. The method according to claim 1, characterized in that The method of expanding the true random number according to the target encryption ratio and the pre-configured key expansion algorithm, and supporting quantum secure communication of the service through the expanded true random number, includes: Determining a target key length based on a target data length of the service data to be sent and the target encryption ratio; Obtaining a true random number of the target key length from a locally stored key pool; By using the key expansion algorithm, based on the target encryption ratio, the true random number is expanded to obtain an expanded random number; wherein the length of the expanded random number is the target data length; According to the expanded random number, according to a pre-configured quantum encryption algorithm, the service data to be sent is quantum encrypted to obtain ciphertext data; The ciphertext data carrying the target encryption ratio is sent to the receiving end.

6. The method according to claim 1, characterized in that The method further comprises: The target encryption ratio is sent to the connected quantum security base station, so that the quantum security base station expands the stored pairing true random number according to the target encryption ratio.

7. The method according to claim 1, characterized in that The trigger condition for key supplementation is that the number of local unused key files is not greater than a preset file threshold; wherein the preset file threshold is an integer greater than or equal to 3.

8. A quantum secure communication device with limited key quantity, characterized in that: The device comprises: An acquisition unit is used to acquire the total transmission bandwidth, the current business communication bandwidth, the key supplement and business parallel ratio, the key supplement available bandwidth and the key supplement bandwidth ratio when the saved encryption ratio is 1:1; wherein the key supplement and business parallel ratio is the degree of overlap between the key supplement and the business communication in time during the time period between two adjacent key supplements; the key supplement available bandwidth is determined according to the difference between the total transmission bandwidth and the current business bandwidth; the encryption ratio represents the bit length of data that can be encrypted by a true random number of each bit length; The processing unit is used to determine the key supplement bandwidth ratio, the product of the key supplement and business parallel rate and the current business communication bandwidth; determine the target encryption ratio according to the ratio between the product and the key supplement available bandwidth, so as to expand the true random number according to the target encryption ratio and a pre-configured key expansion algorithm, and support quantum secure communication of the business through the expanded random number.

9. A quantum security terminal, characterized in that: The quantum security terminal comprises at least a processor and a memory, and the processor is used to implement the steps of the quantum security communication method with limited key amount as claimed in any one of claims 1 to 7 when executing a computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the steps of the quantum secure communication method with limited key quantity as claimed in any one of claims 1 to 7.

Images