Quantum key management method, electronic equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of quantum, and discloses a quantum key management method, electronic equipment and a storage medium. The quantum key management method is applied to a key management system, and the method comprises the steps: obtaining a quantum key from a quantum key distribution network according to a preset key production strategy, and storing the quantum key; according to a preset key distribution strategy, the quantum key is distributed to each managed device in a group bound with the key production strategy corresponding to the quantum key, each group comprises at least two managed devices, and each group is bound with a unique key production strategy. And stable management of the quantum key by a simple architecture is at least facilitated.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of quantum technology, and in particular to a quantum key management method, electronic device, and storage medium. Background Art

[0002] Quantum key distribution (QKD) is a typical application of quantum communication. It uses the basic principles of quantum mechanics to enable both communicating parties to share a random and secure key. QKD has been proven to be unconditionally secure, that is, it is secure no matter how powerful the computing power (including quantum computers) used by the attacker. However, with the continuous growth of network communication needs, point-to-point QKD systems have been unable to meet the communication security requirements in complex network environments. Therefore, the Quantum Key Distribution Network (QKDN) came into being. Based on the QKD system, QKDN uses QKD networking technology to build a key distribution network that supports complex network topologies, providing random, consistent and secure quantum keys to any two or more users accessing the network.

[0003] However, the various schemes for obtaining quantum keys based on quantum key distribution networks have not been very effective. Summary of the invention

[0004] The embodiments of the present application provide a quantum key management method, an electronic device, and a storage medium, which are at least conducive to the stable management of quantum keys with a simple architecture.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a quantum key management method, which is applied to a key management system, and the method includes: according to a preset key production strategy, obtaining and storing a quantum key from a quantum key distribution network; according to the preset key distribution strategy, distributing the quantum key to each managed device in a group bound to the key production policy corresponding to the quantum key, wherein each of the groups includes at least two managed devices, and each of the groups is bound to a unique key production policy.

[0006] In some embodiments, obtaining and storing quantum keys from a quantum key distribution network according to a preset key production strategy includes: continuously applying for quantum keys from the quantum key distribution network according to the preset key production strategy and storing the quantum keys returned by the quantum key distribution network until the locally stored quantum keys reach a preset threshold, and then stopping applying for quantum keys from the quantum key distribution network.

[0007] In some embodiments, the obtaining and storing of quantum keys from a quantum key distribution network according to a preset key production strategy includes: obtaining and storing quantum keys from the quantum key distribution network in a local standby key library according to the preset key production strategy; distributing quantum keys to each managed device in a group bound to the key production policy corresponding to the quantum key according to the preset key distribution strategy includes: migrating the quantum keys in the local standby key library to a local in-use key library according to the preset key distribution strategy, and sending the quantum keys migrated to the local in-use key library to each managed device in the group bound to the key production policy corresponding to the quantum key.

[0008] In some embodiments, the method further includes: checking the quantum keys stored in the local standby key library and / or the local in-use key library; if there is at least one quantum key that has expired in the local standby key library and / or the local in-use key library, migrating the at least one quantum key that has expired to the local historical key library, and sending a quantum key that has expired to each managed device in the group bound to the key production policy corresponding to the at least one quantum key that has expired.

[0009] In some embodiments, two managed devices having communication needs are in at least one of the groups; and / or one of the groups supports a managed device in another group to join.

[0010] In some embodiments, the communication between the key management system and the managed device is implemented through an agent of the key management system deployed on the managed device.

[0011] According to some embodiments of the present application, the second aspect of the embodiments of the present application further provides a quantum key management method, which is applied to a managed device, and the method includes: receiving and storing a quantum key sent by a key management system; when communication needs to be initiated, determining, from the stored quantum keys, the quantum key corresponding to the key production strategy bound to the group with the other end; and initiating communication to the other end based on the key identifier of the determined quantum key.

[0012] In some embodiments, the method further includes: when a response communication is required, querying the stored quantum key according to the key identifier of the quantum key sent by the other end when initiating communication; and performing encrypted communication with the other end according to the queried quantum key.

[0013] According to some embodiments of the present application, a third aspect of the embodiments of the present application further provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the quantum key management method as described in any one of the first aspects, or execute the quantum key management method as described in any one of the second aspects.

[0014] According to some embodiments of the present application, a fourth aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the method for managing a quantum key as described in any one of the first aspects is implemented, or the method for managing a quantum key as described in any one of the second aspects is implemented.

[0015] The technical solution provided in the embodiment of the present application has at least the following advantages:

[0016] Introducing a key management system as a quantum key distribution intermediary between the quantum key distribution network and the managed devices decouples the key distribution of the quantum key distribution network and the acquisition of quantum keys by the managed devices into two processes, namely, obtaining and storing quantum keys from the quantum key distribution network according to the preset key production strategy; and distributing quantum keys to each managed device in the group bound to the key production strategy corresponding to the quantum key according to the preset key distribution strategy. This makes it unnecessary for the managed devices to interact with the quantum key distribution network in real time to obtain quantum keys, thereby avoiding interference from the unstable factors of the quantum key distribution network to the quantum key-related services of the managed devices, and ensuring the stability of the managed devices in obtaining quantum keys. At the same time, when distributing quantum keys to managed devices, they are distributed in groups consisting of devices. Each managed device in the group will be distributed with the quantum key corresponding to the key production strategy bound to the group, so that each managed device in the group can be distributed with the same quantum key to support quantum key-related services. There is no need for the key management system to adopt a central distributed architecture to achieve quantum key consistency of each sub-module through the center to ensure that different clients can obtain the same quantum key to support communication and other business needs. The key management architecture is simplified from a central distributed architecture to a single-layer architecture, which reduces the difficulty of implementation and ultimately achieves stable management of quantum keys with a simple architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0018] Figure 1 This is the process of the quantum key management method provided in the embodiment of this application Figure 1 ;

[0019] Figure 2 This is the process of the quantum key management method provided in the embodiment of this application Figure 2 ;

[0020] Figure 3 This is the process of the quantum key management method provided in the embodiment of this application Figure 3 ;

[0021] Figure 4 This is the process of the quantum key management method provided in the embodiment of this application Figure 4 ;

[0022] Figure 5 Schematic diagram of an application scenario of the quantum key management method provided in an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] As can be seen from the background technology, various solutions for obtaining quantum keys based on quantum key distribution networks currently have the problem of poor application effects.

[0025] After analysis, it is found that the reason for the above problems is at least that there are two main ideas for obtaining quantum keys based on quantum key distribution networks. One is: a symmetric key management system with a hierarchical architecture. The system consists of a symmetric key management service master module, a symmetric key management service sub-module, an application service proxy module and a key source infrastructure. The key is uniformly distributed from the key source infrastructure to the symmetric key management service master module, the service master module issues key management policies to the service sub-module, and the service sub-module distributes symmetric keys to the managed devices through the proxy module. The other is: deploying IPSecVPN equipment, which can flexibly manage network resources through the SDN architecture, realize dynamic configuration and optimization; directly register with the quantum key distribution network to obtain quantum keys for negotiation communication between IPSec VPNs. However, in the first idea, the hierarchical architecture makes the key management business between sub-modules uniformly handled by the master module, and the business processing performance is reduced; the master module and the sub-modules need to communicate synchronously, which may cause communication problems and collaboration problems, increasing the network link overhead on the user side. In the second idea, the device directly applies for keys from QKDN, and the business logic of key acquisition is deeply bound to QKDN, which increases the difficulty of business development and is not conducive to the promotion and expansion of the quantum key application system; once the number of devices connected to QKDN increases, the devices need to interact with QKDN in real time, and the business pressure of a single QKDN node also increases, resulting in unstable key output of QKDN.

[0026] In other words, the existing solutions for obtaining quantum keys based on quantum key distribution networks cannot balance stability and architectural simplicity.

[0027] Based on this, the embodiments of the present application provide a quantum key management method, an electronic device and a storage medium. By introducing a single-layer key management system as an intermediary between the managed device and the quantum key distribution network, on the one hand, the acquisition of quantum keys by the managed device and the distribution of quantum keys by the quantum key distribution network are decoupled and become two independent processes. In this way, they are no longer restricted by the real-time status of the quantum key distribution network and are more stable. On the other hand, the distribution of quantum keys in groups through the key management system ensures that the managed devices in the group will use the same quantum key consistency, without the need for central management and control to maintain consistency between sub-modules, simplifying the originally complex structure into a single-layer structure, reducing the difficulty of implementation.

[0028] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0029] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0030] The first aspect of the embodiment of the present application provides a quantum key management method, which is applied to a key management system. The key management system is a symmetric key management system. In order to better provide quantum key management services for managed devices in different regions, it can adopt a distributed architecture, in which no center is required. For ease of understanding, the following will be combined with Figures 1 to 4 The flowchart shown illustrates a method for managing a quantum key applied to a key management system provided in an embodiment of the present application.

[0031] In some embodiments, Figure 1 As shown, the process of the quantum key management method applied to the key management system may include the following steps:

[0032] Step 101, according to a preset key production strategy, obtain and store the quantum key from the quantum key distribution network.

[0033] Step 102: according to a preset key distribution strategy, the quantum key is distributed to each managed device in a group bound to a key production strategy corresponding to the quantum key, wherein each group includes at least two managed devices, and each group is bound to a unique key production strategy.

[0034] In this way, a key management system is introduced between the quantum key distribution network and the managed devices as a quantum key distribution intermediary, so that the key distribution of the quantum key distribution network and the acquisition of quantum keys by the managed devices are decoupled into two processes, namely, obtaining and storing quantum keys from the quantum key distribution network according to the preset key production strategy; and distributing quantum keys to each managed device in the group bound to the key production strategy corresponding to the quantum key according to the preset key distribution strategy. It makes it so that the managed devices no longer need to interact with the quantum key distribution network in real time to obtain quantum keys, thereby avoiding the interference of quantum key-related services of the managed devices by unstable factors of the quantum key distribution network, and ensuring the stability of the managed devices in obtaining quantum keys. At the same time, when distributing quantum keys to managed devices, they are distributed in groups consisting of devices. Each managed device in the group will be distributed with the quantum key corresponding to the key production strategy bound to the group, so that each managed device in the group can be distributed with the same quantum key to support quantum key-related services. There is no need for the key management system to adopt a central distributed architecture to achieve quantum key consistency of each sub-module through the center to ensure that different clients can obtain the same quantum key to support communication and other business needs. The key management architecture is simplified from a central distributed architecture to a single-layer architecture, which reduces the difficulty of implementation and ultimately achieves stable management of quantum keys with a simple architecture.

[0035] To facilitate better understanding of those skilled in the art Figure 1 The embodiment shown, the steps of which will be explained below.

[0036] In step 101, according to the preset key production strategy, the quantum key is obtained and stored from the quantum key distribution network. Among them, the embodiment of the present application does not limit the preset key production strategy, which can be set according to different business needs, scenario requirements, equipment performance, etc. For example, the preset key production strategy may include periodically obtaining quantum keys from the quantum key distribution network. For another example, the preset key production strategy may include a process of triggering the acquisition of quantum keys from the quantum key distribution network after a batch of quantum keys are issued. For another example, the preset key production strategy may include a process of triggering the acquisition of quantum keys from the quantum key distribution network after the number of quantum keys stored based on the current preset key production strategy in the key management system is reduced to a certain number. Of course, the above is only an example description provided for the preset key production strategy. In some embodiments, the preset key production strategy may also include any other strategy indicating the acquisition of quantum keys from the quantum key distribution network, which will not be listed one by one here.

[0037] In the process of obtaining the key, a threshold can be set as a condition for stopping obtaining the quantum key. That is, in some embodiments, according to the preset key production strategy, the quantum key is obtained and stored from the quantum key distribution network, which can be achieved in the following way: according to the preset key production strategy, the quantum key is continuously applied to the quantum key distribution network and the quantum key returned by the quantum key distribution network is stored until the locally stored quantum key reaches the preset threshold, and the application of the quantum key to the quantum key distribution network is stopped.

[0038] Taking periodic acquisition as the preset key production strategy as an example, the above embodiment periodically requests quantum keys from the quantum key distribution network, and in each process of requesting quantum keys, the key management system will continuously apply for quantum keys from the quantum key distribution network and store the quantum keys returned by the quantum key distribution network until the locally stored quantum keys reach a preset threshold, stop applying for quantum keys from the quantum key distribution network, complete the quantum key acquisition for this time (or cost cycle), and repeat the above operation when the next cycle arrives.

[0039] It should be noted that the above is only an example description of the implementation method of step 101, and does not mean that step 101 can only be implemented in the above manner. In some embodiments, the preset key production policy may be that the number of quantum keys acquired and stored on the key management system based on the policy and not distributed to the managed devices is a preset value. At this time, step 101 can periodically detect the number of quantum keys stored and not distributed to the managed devices corresponding to the policy through the key management system. Once it is detected that the number is less than the preset value, the quantum key is requested from the quantum key distribution network until the number of quantum keys corresponding to the policy that are not distributed to the managed devices is the preset value. I will not list them one by one here.

[0040] Step 102, according to the preset key distribution strategy, the quantum key is distributed to each managed device in the group bound to the key production strategy corresponding to the quantum key, wherein each group includes at least two managed devices, and each group is bound to a unique key production strategy. Among them, the embodiment of the present application does not limit the preset key distribution strategy. It can be understood that it can be set according to different business needs, scenario requirements, device performance, etc. For example, the preset key distribution strategy may include periodic transmission. For example, the preset key distribution strategy may include triggering key transmission based on the request of the managed device. For example, the preset key distribution strategy may include triggering the transmission of the quantum key after the key management system detects that the number of quantum keys distributed to the corresponding managed device that have not exceeded the validity period has dropped to a certain value. Of course, the above is only an example description of the preset key distribution strategy. In some embodiments, other strategies for sending quantum keys can also be used, which will not be repeated here.

[0041] Furthermore, the number and / or relationship of managed devices in a group are not limited in the embodiments of the present application. It is understandable that if two managed devices with communication needs are in at least one group, communication between the managed devices based on quantum keys can be guaranteed. In some embodiments, in order to facilitate flexible grouping, one group can also support the joining of managed devices in another group.

[0042] Based on the above constraints, the key management system can group managed devices in a variety of ways. For example, when all other managed devices that have communication needs with the managed device are in the same group, the managed device is added to the same group as all other managed devices that have communication needs with the managed device. In this way, the number of groups can be reduced and the maintenance burden of the key management system can be reduced. For another example, when all other managed devices that have communication needs with the managed device are not in the same group, a new group is created for the managed device and all other managed devices that have communication needs with the managed device, that is, a new group is constructed based on the managed device and all other managed devices that have communication needs with the managed device. In this way, the number of managed devices in the group can be minimized and the maintenance difficulty of a single group can be reduced. For another example, when all other managed devices that have communication needs with the managed device are not in the same group, the managed devices are added to the groups where all other managed devices that have communication needs with the managed device are located, ensuring that each other managed device that has communication needs with the managed device is in at least one group with the managed device. In this way, the number of groups can be reduced and the maintenance burden of the key management system can be reduced. For another example, when all other managed devices that have communication needs with the managed device are in the same group, the managed device is added to each group that all other managed devices that have communication needs with the managed device are in, and at the same time, a new group is created for the managed device and all other managed devices that have communication needs with the managed device, so that the high availability of the communication connection between the managed device and other managed devices can be maintained to the greatest extent. Of course, in some embodiments, other strategies can be used for grouping in the above grouping processing examples, which will not be listed here one by one.

[0043] In addition, it can also be understood that in some embodiments, in order to further improve the security of quantum keys and improve the security of the key management system, the communication between the key management system and the managed device can be set to be implemented through an agent of the key management system deployed on the managed device.

[0044] In some embodiments, some measures can also be taken to facilitate the maintenance of locally stored quantum keys. For example, by providing maintenance space for quantum keys in different states. Figure 2 As shown, the process of the quantum key management method applied to the key management system may include the following steps:

[0045] Step 201: According to a preset key production strategy, a quantum key is obtained from a quantum key distribution network and stored in a local backup key library.

[0046] Step 202: According to a preset key distribution strategy, the quantum key in the local standby key library is migrated to the local in-use key library, and the quantum key migrated to the local in-use key library is sent to each managed device in the group bound to the key production strategy corresponding to the quantum key.

[0047] In this way, on the basis of the above-mentioned embodiments, by introducing different key libraries to maintain quantum keys in different states, it is beneficial to achieve more efficient and accurate management of quantum keys.

[0048] Depend on Figure 2 It can be seen that its actual meaning is, Figure 1 The steps in the illustrated embodiment are to obtain and store quantum keys from a quantum key distribution network according to a preset key production strategy, and are implemented in the following manner: according to a preset key production strategy, obtain quantum keys from a quantum key distribution network and store them in a local backup key library. Accordingly, Figure 1 The steps in the illustrated embodiment distribute the quantum key to each managed device in the group bound to the key production policy corresponding to the quantum key according to the preset key distribution strategy, which can be achieved in the following manner: according to the preset key distribution strategy, the quantum key in the local standby key library is migrated to the local in-use key library, and the quantum key migrated to the local in-use key library is sent to each managed device in the group bound to the key production policy corresponding to the quantum key.

[0049] Right now Figure 2 The embodiment shown is Figure 1 Based on the embodiment shown, different key libraries are introduced: local standby key library and local in-use key library to maintain the quantum key obtained by the key management system. The rest of the content is the same as Figure 1 The embodiments shown are substantially the same, and will not be described in detail here.

[0050] It is also understandable that, in order to ensure the security of quantum keys, a validity period is usually set for the quantum keys, so that they can be managed through the validity period. At this time, in order to facilitate the management of the validity period of the quantum keys, additional space can also be set to manage the quantum keys that have exceeded the validity period. That is, in some embodiments, such as Figure 3 As shown, the process of the quantum key management method applied to the key management system may include the following steps:

[0051] Step 301: According to a preset key production strategy, a quantum key is obtained from a quantum key distribution network and stored in a local backup key library.

[0052] Step 302: According to a preset key distribution strategy, the quantum key in the local standby key library is migrated to the local in-use key library, and the quantum key migrated to the local in-use key library is sent to each managed device in the group bound to the key production strategy corresponding to the quantum key.

[0053] Step 303: Check the quantum key stored in the local backup key library and / or the local in-use key library.

[0054] Step 304: When there is at least one quantum key that has expired in the local standby key library and / or the local key library in use, the at least one quantum key that has expired is migrated to the local historical key library, and the quantum key corresponding to each managed device in the group bound to the key production policy corresponding to the at least one quantum key that has expired is sent to the local historical key library.

[0055] In this way, on the basis of the above-mentioned embodiment, the validity period of the quantum key is managed through the local historical key library, so that the security of the quantum key can be guaranteed at a lower cost and in a more efficient and reliable management manner.

[0056] It should be noted that Figure 3 Steps 301 to 302 in the embodiment shown are similar to those described above. Figure 2 Steps 201 and 202 in the embodiment shown are substantially the same, the difference being that Figure 3 In the illustrated embodiment, after step 302, steps 303 and 304 are further executed, and steps 301 and 302 are not described in detail here. Figure 3 The execution order of the steps in the illustrated embodiment is only an example. In some embodiments, step 301 and step 303 may be executed simultaneously, step 301 may be executed after step 304, etc., which will not be listed one by one here.

[0057] It should also be noted that Figure 3 The illustrated embodiment is only an example of a key management system managing quantum keys. In some embodiments, the key management system can also manage quantum keys in terms of key recovery, key destruction, and key archiving. The key management system can refer to the classical symmetric key management system for quantum keys, that is, refer to the requirements of the GM / T0051 standard, which will not be described in detail here.

[0058] Accordingly, another aspect of the embodiment of the present application further provides a quantum key management method, which is applied to a managed device. The device can be any electronic device with quantum key-related services, wherein the quantum key-related services include encrypted communication services, etc.

[0059] In some embodiments, Figure 4 As shown, the process of the quantum key management method applied to the managed device may include the following steps:

[0060] Step 401, receiving and storing the quantum key sent by the key management system.

[0061] Step 402: When communication needs to be initiated, the quantum key corresponding to the key production strategy of the group binding with the other end is determined from the stored quantum keys.

[0062] Step 403: Initiate communication to the other end according to the determined key identifier of the quantum key.

[0063] In this way, after receiving the quantum key sent by the key management system in groups, the managed devices can communicate based on the fact that the managed devices in the group are distributed with the same quantum key in the same batch, thereby ensuring communication between the managed devices.

[0064] It is understandable that the managed device will have different communication needs in different situations. Sometimes the managed device will act as a communication initiator, and sometimes the managed device will act as a communication responder. When acting as a communication responder, in some embodiments, the quantum key management method applied to the managed device may also include: when a communication response is required, querying the stored quantum key according to the key identifier of the quantum key sent by the other end when the communication is initiated; and performing encrypted communication with the other end according to the queried quantum key. That is, obtaining the quantum key consistent with the communication initiator through the key identifier to complete encrypted communication, etc.

[0065] It is not difficult to find that this embodiment is a method embodiment corresponding to the aforementioned method embodiment applied to the key management system, and this embodiment can be implemented in conjunction with the aforementioned method embodiment. The relevant technical details mentioned in the aforementioned method embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the aforementioned method embodiment.

[0066] In order to facilitate those skilled in the art to better understand the quantum key management method provided in the embodiments of the present application, the following will be combined with Figure 5 The application scenario shown is used as an example.

[0067] like Figure 5As shown, the quantum key distribution network supports access to different key management systems, and each key management system supports at least one group. Figure 5 For ease of understanding, it is simply shown that the key management system 1 maintains the group 1 represented by the dashed box, and the key management system 2 maintains the group 2 represented by the dotted box. For the managed devices of the maintained groups, the key management system interacts through the agent of the key management system deployed on the managed devices (hereinafter referred to as "management agent").

[0068] As for the specific application process, first, the managed device registers and accesses the key management system through the management agent. The managed device needs to provide basic device information such as name and type, as well as the signature certificate and encryption certificate obtained from the third-party certificate center (CA). The key management system returns the registration result to the managed device, which contains the parameters required for the key management system to establish a secure encryption channel with the management agent. A secure channel is established between the management agent and the key management system, and the management protocol and quantum key are transmitted through the secure encryption channel. At the same time, the key management system adds the managed device to the group and / or creates a group for the managed device based on the information that the managed device wants to communicate, such as the IP address. When grouping, it can be implemented according to the principle that multiple devices are allowed in one device group, and one device is allowed to exist in multiple device groups. This is mainly because the IP address that the managed device wants to communicate must be in the IP group of the device group, otherwise the other party cannot obtain a consistent quantum key. The device group is uniquely bound to a key production policy so that the quantum key can be obtained based on the key production policy in the future.

[0069] That is, after the managed device is connected, the key management system registers and applies for quantum keys to the quantum key distribution network through the key production strategy bound to the group where the managed device is located. The obtained quantum keys are encapsulated and stored in the local standby key library of the key management system. The key management system regularly checks the keys in the local standby key library and other key libraries. Quantum keys that exceed the key validity period will be transferred to the historical key library and will no longer be used. The key management system periodically applies for quantum keys to the quantum key distribution network. When the quantum keys in the local standby key library (and / or the local in-use key library) reach the threshold, the connection between the key management system and the quantum key distribution network is disconnected, and quantum keys are no longer applied to the quantum key distribution network. The key management system regularly distributes quantum keys to the management agent according to the key distribution strategy to ensure that the managed device can obtain secure quantum keys. Among them, the distribution process is specifically: the quantum key is transferred from the standby key library to the in-use key library according to the configuration information in the key production strategy, and is sent to the management agent of the managed device in the group according to the key distribution strategy.

[0070] After the management agent receives the quantum key distributed by the key management system through a secure channel, it calls the cryptographic module of the local device to encrypt and store the quantum key. The managed device calls the key management interface of the management agent to obtain the quantum key. In the subsequent use process, if the managed device acts as the communication initiator, it is necessary to specify the other party's IP address when calling the key management interface. After calling the interface, a key in a custom format will be returned. The key format includes the key identifier, key length, key value, key version and IP group. If the managed device acts as the communication responder, the key management interface needs to specify the key identifier obtained by the initiator. Calling the interface will return a quantum key that is in the same format and consistent with the initiator.

[0071] It can be seen that through Figure 5 The single-layer, flat key management system architecture shown in the figure does not require communication and key synchronization protocols between different key management systems. The synchronization and distribution of quantum keys are completed by the quantum key distribution network. The quantum key distribution network can enable any application device connected to the network to obtain secure and consistent quantum keys and realize key synchronization of any node. At the same time, the key management system is used to manage the quantum keys obtained from the quantum key distribution network throughout the life cycle and manage the managed devices. The managed devices uniformly obtain quantum keys by accessing the key management system with a single-layer architecture, which greatly reduces the user management business pressure of the quantum key distribution network, decouples the cryptographic devices from the quantum key distribution network, and the cryptographic application devices access the quantum key distribution network through the key management system, which reduces the coupling degree of the business code to the quantum key distribution network, simplifies the process of cryptographic devices using quantum keys, improves the scalability and flexibility of the quantum cryptographic application system, and is conducive to the promotion and expansion of the quantum key application system. The quantum keys are uniformly applied for by the key management system and cached in the key library, which can smooth the access peaks of the cryptographic devices to the quantum keys, achieve the effect of peak shaving and valley filling, reduce the business pressure risk of the quantum key distribution network, and improve the stability of the quantum key distribution network. Compared with the traditional hierarchical architecture, the flat architecture design simplifies the architecture logic, reduces development costs, eliminates network communication and coordination issues, reduces network link overhead on the user side, and improves the scalability of the overall architecture.

[0072] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0073] Another aspect of the present application embodiment further provides an electronic device, such as Figure 6As shown, it includes: at least one processor 601; and a memory 602 that is communicatively connected to the at least one processor 601; wherein the memory 602 stores instructions that can be executed by the at least one processor 601, and the instructions are executed by the at least one processor 601 so that the at least one processor 601 can execute the method described in any of the above method embodiments.

[0074] The memory 602 and the processor 601 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 601 and the memory 602 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 601 is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor 601.

[0075] The processor 601 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 602 can be used to store data used by the processor 601 when performing operations.

[0076] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0077] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0078] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A method for managing quantum keys, characterized in that: Applied to a key management system, the method comprises: According to the preset key production strategy, the quantum key is obtained from the quantum key distribution network and stored; According to a preset key distribution strategy, the quantum key is distributed to each managed device in a group bound to the key production strategy corresponding to the quantum key, wherein each of the groups includes at least two managed devices, and each of the groups is bound to a unique key production strategy.

2. The method for managing quantum keys according to claim 1, characterized in that: The step of obtaining and storing a quantum key from a quantum key distribution network according to a preset key generation strategy includes: According to the preset key production strategy, the quantum key is continuously applied to the quantum key distribution network and the quantum key returned by the quantum key distribution network is stored until the locally stored quantum key reaches a preset threshold, and the application of quantum key to the quantum key distribution network is stopped.

3. The method for managing quantum keys according to claim 1, characterized in that: The step of obtaining and storing a quantum key from a quantum key distribution network according to a preset key generation strategy includes: According to the preset key production strategy, obtaining the quantum key from the quantum key distribution network and storing it in the local backup key library; The method of distributing the quantum key to each managed device in the group bound to the key production strategy corresponding to the quantum key according to the preset key distribution strategy includes: According to the preset key distribution strategy, the quantum key in the local standby key library is migrated to the local in-use key library, and the quantum key migrated to the local in-use key library is sent to each managed device in the group bound to the key production policy corresponding to the quantum key.

4. The method for managing quantum keys according to claim 3, characterized in that: The method further comprises: Checking the quantum key stored in the local backup key library and / or the local in-use key library; In the case that there is at least one quantum key that has expired in the local standby key library and / or the local in-use key library, the at least one quantum key that has expired is migrated to the local historical key library, and the quantum key corresponding to each managed device in the group bound to the key production policy corresponding to the at least one quantum key that has expired is expired.

5. The method for managing a quantum key according to any one of claims 1 to 4, characterized in that: Two managed devices with communication needs are in at least one of the groups; and / or one of the groups supports the managed device in another group to join.

6. The method for managing a quantum key according to any one of claims 1 to 4, characterized in that: The communication between the key management system and the managed device is achieved through an agent of the key management system deployed on the managed device.

7. A method for managing quantum keys, characterized in that: Applied to a managed device, the method comprises: Receive and store the quantum key sent by the key management system; When communication needs to be initiated, determining, from the stored quantum keys, the quantum key corresponding to the key production strategy bound to the group present at the other end; Communication is initiated to the other end based on the determined key identifier of the quantum key.

8. The method for managing quantum keys according to claim 7, characterized in that: The method further comprises: When a response communication is required, the stored quantum key is queried according to the key identifier of the quantum key sent by the other end when the communication is initiated; Based on the queried quantum key, encrypted communication is carried out with the other party.

9. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the quantum key management method as described in any one of claims 1 to 6, or execute the quantum key management method as described in claim 7 or 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, it implements the quantum key management method according to any one of claims 1 to 6, or implements the quantum key management method according to claim 7 or 8.

Images