Communication method, communication system and electronic equipment

Abstract

The embodiment of the invention relates to the technical field of communication, and discloses a communication method, electronic equipment and a storage medium. When the method is applied to a first IPSec VPN node, the method comprises the following steps: negotiating with a second IPSec VPN node based on an identifier allocated by a quantum key distribution network through a quantum key distribution node to obtain a quantum key; and according to the quantum key and the identifier, initiating establishment of an IPSec VPN communication channel to a second IPSec VPN node through a satellite communication system so as to support the client to communicate with another client accessing the second IPSec VPN node through accessing the first IPSec VPN node based on the IPSec VPN communication channel. And the user experience of the client accessing the satellite communication system can be improved at least.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a communication method, a communication system and an electronic device. Background Art

[0002] Satellite communication is the communication between radio communication stations on the earth (including the ground and the lower atmosphere) using satellites as relays. The satellite communication system consists of two parts: satellites and earth stations. The characteristics of satellite communication are: large communication range; communication can be carried out from any two points as long as they are within the range covered by the radio waves emitted by the satellite; not easily affected by land disasters (high reliability); it can be opened as long as the earth station circuit is set up (circuit opening is fast); it can be received at multiple locations at the same time, and can economically realize broadcast and multi-address communication (multi-address characteristics); the circuit setting is very flexible, and the overly concentrated traffic can be dispersed at any time; the same channel can be used in different directions or different intervals (multiple access connection).

[0003] However, satellite terminal users in existing satellite communication systems can only access Internet-related resources unidirectionally through the satellite core network, and user experience needs to be improved. Summary of the invention

[0004] The embodiments of the present application provide a communication method, a communication system, and an electronic device, which are at least beneficial to improving the user experience of a client accessing a satellite communication system.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a communication method, which is applied to a first IPSec VPN node, wherein the first IPSec VPN node accesses a satellite communication system through a connection with a satellite terminal, and the first IPSec VPN node accesses a quantum key distribution network through a connection with a quantum key distribution node, the method comprising: through the quantum key distribution node, negotiating with a second IPSec VPN node to obtain a quantum key based on an identifier assigned by the quantum key distribution network, wherein the second IPSec VPN node accesses the satellite communication system through the Internet and a firewall of the satellite communication system, and the second IPSec VPN node accesses the quantum distribution network through another quantum key distribution node in the Internet; based on the quantum key and the identifier, initiating establishment of an IPSec VPN communication channel to the second IPSec VPN node through the satellite communication system, so as to support a client accessing the first IPSec VPN node and communicating with another client accessing the second IPSec VPN node based on the IPSecVPN communication channel.

[0006] According to some embodiments of the present application, a second aspect of the embodiments of the present application further provides a communication method, which is applied to a second IPSec VPN node, wherein the second IPSec VPN node accesses the satellite communication system through the Internet and the firewall of the satellite communication system, and the second IPSec VPN node accesses the quantum key distribution network through a connection with a quantum key distribution node. The method includes: through the quantum key distribution node, negotiating with the first IPSec VPN node to obtain a quantum key based on an identifier assigned by the quantum key distribution network, wherein the first IPSec VPN node accesses the satellite communication system through a connection with a satellite terminal, and the first IPSec VPN node accesses the quantum key distribution network through a connection with another quantum key distribution node; according to the quantum key and the identifier, through the satellite communication system, responding to the establishment of an IPSec VPN communication channel initiated by the first IPSec VPN node, so as to support a client accessing the first IPSec VPN node and another client accessing the second IPSec VPN node to communicate with each other based on the IPSec VPN communication channel.

[0007] According to some embodiments of the present application, a third aspect of the embodiments of the present application further provides a communication system, including: at least two clients, at least one first IPSec VPN node, a satellite communication system, at least one second IPSec VPN node, and a quantum key distribution network; wherein, at least one of the clients accesses the first IPSec VPN node, and at least one of the clients accesses the second IPSec VPN node; each of the first IPSec VPN nodes accesses the satellite communication system through a satellite terminal of the satellite communication system, and also accesses the quantum key distribution network through at least one quantum key distribution node in the quantum key distribution network; the second IPSec VPN node located in the Internet is connected to the satellite communication system through a firewall of the satellite communication system, and each of the second IPSec VPN node accesses the quantum key distribution network through at least one quantum key distribution node in the quantum key distribution network; the first IPSec VPN node and the second IPSec VPN node are respectively used to implement the communication method provided corresponding to the embodiments of the present application.

[0008] According to some embodiments of the present application, a fourth aspect of the embodiments of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute a communication method as described in any one of the first aspects, or execute a communication method as described in any one of the second aspects.

[0009] The technical solution provided in the embodiment of the present application has at least the following advantages:

[0010] The first IPSec VPN node and the second IPSec VPN node obtain the assigned identifier from the quantum key distribution network through the connected quantum key distribution node, so that the second IPSec VPN node side can communicate and access with the first IPSec VPN node side based on the identifier, and at the same time of obtaining the identifier, the quantum key is also obtained, so that on the basis of forming a communication link of the satellite communication system based on the access relationship between each of them and the satellite communication system, the first IPSec VPN node can actively initiate the establishment of an IPSec VPN communication channel to the second IPSec VPN node on the communication link, so that a bidirectional IPSec VPN communication channel from the first IPSec VPN node to the second IPSec VPN node is established based on the communication link of the satellite communication system, so that the client accessing the first IPSec VPN node and the second IPSec VPN node can realize secure bidirectional communication based on the IPSec VPN communication channel, and on the premise of ensuring security, the bidirectional communication between the client on one side of the satellite communication system and the outside is supported, thereby improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0012] Figure 1 is a schematic diagram of the structure of a communication system provided in an embodiment of the present application;

[0013] Figure 2 It is a schematic diagram of the brief architecture of the communication system provided in the embodiments of the present application;

[0014] Figure 3 This is the process of the communication method provided in the embodiment of the present application Figure 1 ;

[0015] Figure 4This is the process of the communication method provided in the embodiment of the present application Figure 2 ;

[0016] Figure 5 This is the process of the communication method provided in the embodiment of the present application Figure 3 ;

[0017] Figure 6 This is the process of the communication method provided in the embodiment of the present application Figure 4 ;

[0018] Figure 7 This is the process of the communication method provided in the embodiment of the present application Figure 5 ;

[0019] Figure 8 This is the process of the communication method provided in the embodiment of the present application Figure 6 ;

[0020] Fig. 9 This is the process of the communication method provided in the embodiment of the present application Figure 7 ;

[0021] Fig.10 This is the process of the communication method provided in the embodiment of the present application Figure 8 ;

[0022] Fig.11 is a schematic diagram of a process of establishing a satellite communication link involved in the communication method provided in an embodiment of the present application;

[0023] Fig.12 It is a flowchart of quantum key distribution network authentication and key distribution involved in the communication method provided in the embodiment of the present application;

[0024] Fig.13 It is a schematic diagram of the process of establishing an IPSec VPN communication channel in the related art;

[0025] Fig.14 It is a flow chart of establishing an IPSec VPN communication channel involved in the communication method provided in the embodiment of the present application;

[0026] Fig.15 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] As known from the background technology, the current satellite communication system only allows the connected client to perform one-way communication with the outside.

[0028] After analysis, it was found that the reason for the above problems is at least that: after satellite users access the satellite network through terminals, they generally do not have a fixed public IP on the Internet. In this way, Internet users cannot directly access the relevant services on the satellite user side and can only communicate with the outside world in a one-way manner, that is, only clients are allowed to access Internet devices, and Internet devices are not supported to access satellite users' terminals. In addition, the data on the satellite communication link of existing commercial satellites is generally transmitted in plain text, and the encryption of the two communicating parties is implemented by the application layer. That is, the data on the satellite communication link is transmitted in plain text, which poses a risk of being eavesdropped. Therefore, in order to ensure the security of the satellite communication system, the Internet's access to the satellite communication system is usually not opened to avoid security risks caused by information leakage due to eavesdropping.

[0029] Based on this, the embodiment of the present application provides a communication method, an electronic device and a storage medium. On the one hand, the allocated identifier is obtained through the quantum key distribution network to replace the IP address lacking in the client on the satellite communication system side, so that the two-way communication between the client on the satellite communication system side and the client on the Internet is supported through the identifier. On the other hand, the quantum key is also obtained based on the quantum key distribution network, and based on the quantum key and the identifier, an IPSec VPN communication channel is constructed based on the first IPSecVPN (Internet Protocol Security Virtual Private Network, a virtual private network based on the Internet security protocol) node, the satellite communication system, the Internet, and the second IPSec VPN node, so that a secure connection based on the satellite communication system is realized, security is guaranteed, and secure two-way communication between the client on the satellite communication system side and the outside is supported, thereby improving user experience.

[0030] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0031] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0032] In order to facilitate those skilled in the art to better understand the communication method provided in the embodiment of the present application, the communication system provided in the embodiment of the present application will be described below. Figure 1As shown, the communication system provided in an embodiment of the present application includes: at least two clients, at least one first IPSec VPN node, a satellite communication system, at least one second IPSec VPN node, and a quantum key distribution network (Quantum Key Distribution Network, QKDN).

[0033] Among them, at least one client accesses the first IPSec VPN node, and at least one client accesses the second IPSec VPN node; each first IPSec VPN node accesses the satellite communication system through a satellite terminal of the satellite communication system, and also accesses the quantum key distribution network through at least one quantum key distribution node (Quantum Key Distribution, QKD) in the quantum key distribution network; the second IPSec VPN node located in the Internet is connected to the satellite communication system through a firewall of the satellite communication system, and each second IPSec VPN node accesses the quantum key distribution network through at least one quantum key distribution node in the quantum key distribution network.

[0034] That is to say, Figure 2 As shown, the main components of the system provided by the embodiment of the present application can be divided into three parts: 1. Satellite communication system; 2. IPSec VPN node; 3. Quantum key distribution network. Among them, the satellite communication link provides a basic communication environment for establishing channels between IPSec VPNs, and IPSec VPN nodes establish a secure IPSec VPN channel through negotiation and authentication, and provide encrypted transmission services for the data of the protected intranet resources. The quantum key distribution network securely distributes symmetric quantum keys to users through quantum key distribution technology, and the quantum key is integrated into the key system of the existing IPSec VPN to enhance its security.

[0035] For the satellite communication system in the communication system provided in the embodiment of the present application, Figure 1 and Figure 2As shown in the figure, for example, the satellite communication system may include: satellite terminal, communication satellite, satellite ground station, satellite core network and firewall. In the satellite communication system, the satellite terminal device may initiate a satellite communication link, and establish a link with the satellite core network through the communication satellite and satellite ground station, and access Internet related resources through the firewall exit. Among them, the satellite terminal is a user segment communication terminal in the satellite communication system that accesses the satellite communication network through the ground segment to communicate, and can provide network access function for the client device; the satellite ground station is a ground device used in pair with the satellite and can communicate with the quantum satellite; the role of the satellite core network is to ensure the interconnection and interoperability of the entire satellite communication system, realize the efficient scheduling and management of satellite resources, and seamlessly connect with the ground network to provide users with high-quality communication services. The satellite core network is the key infrastructure for the reliable operation of the satellite communication system. In this way, a satellite communication link is formed through the satellite terminal, communication satellite, satellite ground station, satellite core network and firewall. The satellite communication link also involves an uplink from a transmitting earth station to a satellite transponder, and a downlink from a satellite transponder to another receiving earth station. This uplink and downlink are both a kind of infinite link.

[0036] It should be noted that Figure 1 and Figure 2 The structure of the satellite communication system shown is only an example. The embodiment of the present application does not limit the structural composition of the satellite communication system. It can be any communication system implemented based on satellite communication technology, which will not be listed one by one here.

[0037] For the IPSec VPN nodes (including the first IPSec VPN node and the second IPSec VPN node) in the communication system provided in the embodiment of the present application, it can provide security services such as authentication or encryption based on the security protocol. Generally, cryptographic algorithms such as national secrets can be used to improve security and efficiency. In the embodiment of the present application, the IPSec VPN node can be integrated with the quantum key capability provided by the quantum key distribution network, mainly by integrating the quantum key into the key management module of the IPSec VPN node, and then through data encryption and decryption and data packet encapsulation / decomposition, on the basis of the original security mechanism of IPSec VPN, the ability to resist quantum computing attacks is given.

[0038] by Figure 2 As shown in the example, in order to provide the service of establishing IPSec VPN communication channel, the IPSec VPN node also adaptively provides services such as system management, key management, identity authentication, data encryption and decryption, and data packet processing, so as to provide higher quality services.

[0039] certainly, Figure 2This is only an example of the service for the IPSec VPN node. The services and functions of the IPSec VPN node can be flexibly configured according to requirements or resource performance, and will not be listed here one by one.

[0040] It should be noted that in the communication system provided in the embodiment of the present application, the first IPSec VPN node and the second IPSec VPN node are mainly different in their connection relationship in the communication system. Specifically, when the IPSec VPN node is set on one side of the satellite communication system and accesses the satellite communication system through a satellite terminal, it is the first IPSec VPN node. When the IPSec VPN node is set in the Internet and accesses the satellite communication system through the firewall of the satellite communication system, it is the second IPSec VPN node. In addition, for the second IPSec VPN node in the Internet, a corresponding firewall will also be set, that is, Figure 1 The firewall shown is located between the Internet and the second IPSec VPN node to provide security for the external interaction process of the second IPSec VPN node.

[0041] It should also be noted that the embodiments of the present application do not refer to IPSec VPN nodes, which can be any node that can provide IPSec VPN communication channel establishment services. The node can be composed of one or more of terminals, servers, devices or equipment clusters, etc., which will not be described one by one here.

[0042] The quantum key distribution network provided in the embodiments of the present application may be a quantum key distribution network established by the BB84 protocol, which can provide symmetric quantum keys between any two connected user nodes. The quantum key distribution network includes several quantum key distribution nodes, and long-distance key distribution needs to be achieved through quantum key relays. In the quantum key distribution network, the access users are also managed uniformly, and there is a special network management system to manage equipment, routing, key scheduling, etc. Figure 2 As shown, the quantum key distribution network provides services such as quantum key distribution, quantum key relay, user management and quantum network management in order to provide higher quality services.

[0043] certainly, Figure 2 This is only a schematic diagram of the service architecture of the quantum key distribution network. The services and functions of the quantum key distribution network can be flexibly configured according to demand or resource performance, and will not be listed here one by one.

[0044] In this way, the communication system provided by the embodiment of the present application, by combining the communication method provided by the embodiment of the present application, can enable the satellite terminal to access the satellite core network through the satellite communication link, and can be connected to the Internet through the firewall exit. The first IPSec VPN node finally communicates with the second IPSec VPN node through the satellite terminal, and the two parties negotiate a quantum key with the quantum network and use it to establish a secure tunnel. In this way, secure network resource mutual access can be achieved between the local area networks where the clients are located.

[0045] Further, based on the communication system provided in the above embodiment, the present application embodiment also provides a communication method, which is applied to the above first IPSec VPN node. Figures 3 to 9 The method flow shown is described.

[0046] In some embodiments, Figure 3 As shown, the communication method applied to the first IPSec VPN node may include the following steps:

[0047] Step 101: Through the quantum key distribution node, negotiate with the second IPSec VPN node to obtain the quantum key based on the identifier assigned by the quantum key distribution network.

[0048] Step 102, based on the quantum key and the identifier, initiate establishment of an IPSec VPN communication channel to the second IPSec VPN node through the satellite communication system to support the client accessing the first IPSec VPN node and another client accessing the second IPSec VPN node to communicate with each other based on the IPSec VPN communication channel.

[0049] In this way, the first IPSec VPN node and the second IPSec VPN node obtain the assigned identifier from the quantum key distribution network through the connected quantum key distribution node, so that the second IPSec VPN node side can communicate and access with the first IPSec VPN node side based on the identifier, and obtain the quantum key while obtaining the identifier, so that on the basis of forming a communication link of the satellite communication system based on their respective access relationships with the satellite communication system, the first IPSec VPN node can actively initiate the establishment of an IPSec VPN communication channel to the second IPSec VPN node on the communication link, so that a two-way IPSec VPN communication channel from the first IPSec VPN node to the second IPSec VPN node is established based on the communication link of the satellite communication system, so that the client accessing the first IPSec VPN node and the second IPSec VPN node can realize secure two-way communication based on the IPSec VPN communication channel, and on the premise of ensuring security, two-way communication between the client on one side of the satellite communication system and the outside is supported, thereby improving user experience.

[0050] To facilitate better understanding of those skilled in the art Figure 3 The embodiment shown, the steps of which will be explained below.

[0051] In step 101, the quantum key is obtained through the quantum key distribution node and the second IPSec VPN node based on the identifier assigned by the quantum key distribution network. The second IPSec VPN node is the second IPSec VPN node in the communication system provided above. It can be understood that in the communication system, the first IPSec VPN node and the second IPSec VPN node access the quantum key distribution network through the quantum key distribution node in the quantum key distribution network. Therefore, the first IPSec VPN node and the second IPSec VPN node can initiate authentication to the quantum key distribution network through the quantum key distribution node in real time or in advance according to the needs, obtain the identifier, and apply for the quantum key. Initiating authentication to the quantum key distribution network and applying for the quantum key are recorded in the relevant technology, which will not be repeated here.

[0052] It should be noted that the embodiment of the present application does not limit the identifier assigned by the quantum key distribution network. It can be any identifier that can uniquely represent the corresponding IPSec VPN node. For example, the identifier can be an ID number, etc., which will not be listed one by one here.

[0053] In step 102, according to the quantum key and the identifier, an IPSec VPN communication channel is established to the second IPSec VPN node through the satellite communication system. It can be understood that the identifier can uniquely identify different IPSec VPN nodes, so it can replace the address information for communication. The quantum key can be used as a key in the process of establishing the IPSec VPN communication channel, so that the IPSec VPN communication channel can be established through the satellite communication system (or, on the satellite communication system) based on the quantum key and the identifier. The IPSec VPN communication channel is a satellite communication link formed by the satellite communication system.

[0054] It should be noted that the embodiment of the present application does not limit the method of integrating quantum keys during the establishment of IPSec VPN communication channels. It is understandable that the relevant technology provides a variety of solutions for integrating and using quantum keys during the establishment of IPSec VPN communication channels, which will not be described one by one here.

[0055] In the embodiment of the present application, the embodiment of the present application further provides a method for integrating the use of quantum keys in the process of establishing an IPSec VPN communication channel. Figure 4 As shown, the communication method applied to the first IPSec VPN node, the process may also include the following steps:

[0056] Step 201: Through the quantum key distribution node, negotiate with the second IPSec VPN node to obtain the quantum key based on the identifier assigned by the quantum key distribution network.

[0057] Step 202: Initiate data exchange with the second IPSec VPN node through the satellite communication system, using the acquired quantum key as the Nonce payload body and the identifier as the communication address, so as to support the establishment of the IPSec VPN communication channel.

[0058] In this way, on the basis of the aforementioned embodiment, the quantum key is further used as the Nonce payload body, so that on the basis of retaining the existing IPSec VPN communication channel establishment process, the quantum key is integrated, which can be well integrated with the existing IPSec VPN communication channel establishment process, so that the communication method provided in the embodiment of the present application can be deployed by making fewer and smaller improvements to the existing equipment, with lower cost and lower implementation difficulty.

[0059] To facilitate better understanding of those skilled in the art Figure 4 The embodiment shown in the figure will be explained below. Figure 3 and Figure 4 It is not difficult to see from the process shown that Figure 4The embodiment shown is in Figure 3 On the basis of the illustrated embodiment, step 102 is replaced by step 202, and step 101 is substantially the same as step 201, which will not be described in detail here.

[0060] In step 202, through the satellite communication system, the obtained quantum key is used as the Nonce payload body and the identifier is used as the communication address to initiate data exchange to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel. Among them, the Nonce payload body is one of the data exchanged in the data exchange stage during the establishment of the IPSec VPN communication channel, which is usually represented by Ni and Nr, where i refers to the initiator of the communication and r refers to the responder of the communication. In the embodiment of the present application, the first IPSec VPN node, as the initiator (in order to ensure security, the process is first initiated by the side of the access satellite communication system), passes the quantum key obtained by itself as the parameter of Ni to the other party, and the second IPSec VPN node, as the responder, passes the quantum key obtained by itself as the parameter of Nr to the other party.

[0061] In some embodiments, a method for integrating the use of quantum keys in the process of establishing an IPSec VPN communication channel is also provided. Specifically, Figure 5 As shown, the communication method applied to the first IPSec VPN node, the process may also include the following steps:

[0062] Step 301: Through the quantum key distribution node, negotiate with the second IPSec VPN node to obtain the quantum key based on the identifier assigned by the quantum key distribution network.

[0063] Step 302: Using the satellite communication system, the obtained quantum key is used as a pre-shared key and the identifier is used as the communication address to initiate identity authentication to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel; or, using the satellite communication system, the obtained quantum key is used as a key for digital signature and the identifier is used as the communication address to initiate identity authentication to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel.

[0064] In this way, on the basis of the aforementioned embodiment, the quantum key is further used as an encryption key in the identity authentication process, so that on the basis of retaining the existing IPSec VPN communication channel establishment process, the quantum key is integrated, which can be well integrated with the existing IPSec VPN communication channel establishment process, so that the communication method provided in the embodiment of the present application can be deployed by making fewer and smaller improvements to the existing equipment, with lower cost and lower implementation difficulty.

[0065] To facilitate better understanding of those skilled in the art Figure 5 The embodiment shown in the figure will be explained below. Figure 3 and Figure 5 It is not difficult to see from the process shown that Figure 5 The embodiment shown is in Figure 3 On the basis of the illustrated embodiment, step 102 is replaced by step 302, and step 101 is substantially the same as step 301, which will not be described in detail here.

[0066] In step 302, the satellite communication system is used to initiate identity authentication to the second IPSec VPN node using the acquired quantum key as the pre-shared key and the identifier as the communication address; or, the satellite communication system is used to initiate identity authentication to the second IPSec VPN node using the acquired quantum key as the key for digital signature and the identifier as the communication address. That is, when using the pre-shared key for identity authentication, the acquired quantum key can be directly used as the pre-shared key, thus avoiding the risk of the pre-shared key not being replaced for a long time and being retained during the transmission process; when using the digital signature for identity authentication, the digital signature information can be encrypted using the acquired quantum key and then transmitted to the other party, thus resisting quantum computing attacks and improving security.

[0067] In some embodiments, a method for integrating the use of quantum keys in the process of establishing an IPSec VPN communication channel is also provided. Specifically, Figure 6 As shown, the communication method applied to the first IPSec VPN node, the process may also include the following steps:

[0068] Step 401: Through the quantum key distribution node, negotiate with the second IPSec VPN node to obtain the quantum key based on the identifier assigned by the quantum key distribution network.

[0069] Step 402, through the satellite communication system, using the information of the acquired quantum key as the negotiation content and the identifier as the communication address, to initiate parameter negotiation to the second IPSec VPN node, so as to obtain the same quantum key from the quantum key distribution network through the quantum key distribution node with the second IPSec VPN node, so as to support the establishment of the IPSec VPN communication channel.

[0070] In this way, on the basis of the aforementioned embodiment, the quantum key is further negotiated as a quantum key that can be used in the process of establishing the IPSec VPN communication channel, so that the quantum key is integrated on the basis of retaining the existing IPSec VPN communication channel establishment process, and it can be well integrated with the existing IPSec VPN communication channel establishment process, so that the communication method provided in the embodiment of the present application can be deployed by making fewer and smaller improvements to existing equipment, with lower cost and lower implementation difficulty.

[0071] To facilitate better understanding of those skilled in the art Figure 6 The embodiment shown in the figure will be explained below. Figure 3 and Figure 6 It is not difficult to see from the process shown that Figure 6 The embodiment shown is in Figure 3 On the basis of the illustrated embodiment, step 102 is replaced by step 402, and step 101 is substantially the same as step 401, which will not be described in detail here.

[0072] In step 402, parameter negotiation is initiated to the second IPSec VPN node through the satellite communication system, using the information of the acquired quantum key as the negotiation content and the identifier as the communication address. The embodiment of the present application does not limit the negotiation process of the quantum key. It is understandable that the content of the negotiation may also be different according to different storage formats of the quantum key. For example, the content of the negotiation may include the version information of the quantum key. For example, the content of the negotiation may include the key identifier of the quantum key. Of course, the above is only an example. In some embodiments, the content of the negotiation can be determined according to the requirements and the configuration of the quantum key, etc., which will not be repeated here.

[0073] In some embodiments, in order to better match the existing IPSec VPN communication channel establishment process, an adaptive method for obtaining quantum keys is also provided. Specifically, Figure 7 As shown, the communication method applied to the first IPSec VPN node, the process may also include the following steps:

[0074] Step 501, through the quantum key distribution node, according to the identifier, apply for two quantum keys from the quantum key distribution network to support the establishment of the IPSec VPN communication channel together with a quantum key applied by the second IPSec VPN node from the quantum key distribution network through the quantum key distribution node.

[0075] Step 503, based on the quantum key and the identifier, initiate establishment of an IPSec VPN communication channel to the second IPSec VPN node through the satellite communication system to support the client accessing the first IPSec VPN node and communicating with another client accessing the second IPSec VPN node based on the IPSec VPN communication channel.

[0076] In this way, on the basis of the aforementioned embodiment, further based on the characteristics of the three types of keys negotiated in the IPSec VPN communication channel establishment process, the acquisition of quantum keys is also configured to obtain three quantum keys, thereby integrating quantum keys while retaining the existing IPSec VPN communication channel establishment process, and being able to be well integrated with the existing IPSec VPN communication channel establishment process, so that the communication method provided in the embodiment of the present application can be deployed by making fewer and smaller improvements to existing equipment, with lower cost and lower implementation difficulty.

[0077] To facilitate better understanding of those skilled in the art Figure 7 The embodiment shown in the figure will be explained below. Figure 3 and Figure 7 It is not difficult to see from the process shown that Figure 7 The embodiment shown is in Figure 3 On the basis of the illustrated embodiment, step 101 is replaced by step 501, and step 102 is substantially the same as step 502, which will not be described in detail here.

[0078] In step 501, two quantum keys are applied to the quantum key distribution network according to the identifier through the quantum key distribution node to support the establishment of the IPSec VPN communication channel together with a quantum key applied by the second IPSec VPN node from the quantum key distribution network through the quantum key distribution node. In other words, the first IPSec VPN node and the second IPSec VPN node together obtain three quantum keys from the quantum key distribution network to implement the subsequent IPSec VPN communication channel establishment process based on the three quantum keys, such as the existing IPSec VPN communication channel establishment process.

[0079] Of course, the above is only an example. In some embodiments, the first IPSec VPN node may apply for one quantum key and the second IPSec VPN node may apply for two quantum keys. In this way, the acquisition of quantum keys is triggered by the need to establish an IPSec VPN communication channel, which has good real-time performance and high security. Alternatively, the first IPSec VPN node selects two quantum keys from the applied quantum keys and the second IPSec VPN node selects one quantum key from the applied quantum keys to participate in the establishment of the subsequent IPSec VPN communication channel. In this way, there is no need to interact with the quantum key distribution network in real time, and it will not be disturbed by the unstable factors of the quantum key distribution network, which is more stable, etc., which will not be described one by one here.

[0080] Of course, the above Figure 4-Figure 7 This is only an example of quantum key integration during the IPSec VPN communication channel establishment process. In some embodiments, the negotiation and data exchange part can be skipped directly, and the symmetric quantum key obtained by the first IPSec VPN node and the second IPSec VPN node from the quantum key distribution network is directly used as the key required to be used in the first IPSec VPN node. In addition, the above Figure 4-Figure 7 Only for Figure 3 Based on the embodiments shown in the figure, corresponding integration ideas are introduced. In some embodiments, the above Figure 4 and Figure 7 They can also be combined with each other, for example, Figure 4 and Figure 5 When combining, Figure 3 On the basis of the illustrated embodiment, step 102 is replaced by sequentially executing step 202 and step 302, etc., which will not be described in detail here.

[0081] In some embodiments, it is understood that the first IPSec VPN node needs to initiate authentication with the quantum key distribution network to obtain a corresponding identifier to support subsequent external communications. Figure 8 As shown, the communication method applied to the first IPSec VPN node, the process may also include the following steps:

[0082] Step 601, initiating authentication to the quantum key distribution network through the quantum key distribution node to obtain an identifier returned by the quantum key distribution network under authentication.

[0083] Step 602: Through the quantum key distribution node, negotiate with the second IPSec VPN node to obtain the quantum key based on the identifier assigned by the quantum key distribution network.

[0084] Step 603: Using the satellite communication system, the obtained quantum key is used as a pre-shared key and the identifier is used as the communication address to initiate identity authentication to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel; or, using the satellite communication system, the obtained quantum key is used as a key for digital signature and the identifier is used as the communication address to initiate identity authentication to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel.

[0085] In this way, the first IPSec VPN node actively initiates authentication to the quantum key distribution network to obtain an identifier.

[0086] To facilitate better understanding of those skilled in the art Figure 8 The embodiment shown in the figure will be explained below. Figure 3 and Figure 8 It is not difficult to see from the process shown that Figure 8 The embodiment shown is in Figure 3 On the basis of the illustrated embodiment, step 601 is further executed before step 101, and steps 101 to 102 are substantially the same as steps 602 to 603, which will not be described in detail here.

[0087] In step 601, authentication is initiated to the quantum key distribution network through the quantum key distribution node to obtain an identifier returned by the quantum key distribution network under authentication. It should be noted that the embodiment of the present application does not limit the information allocated by the quantum key distribution network during authentication. For example, on the basis of the identifier, at least one of the following information may also be included: an authentication key, a communication protection key, etc., which will not be described one by one here.

[0088] In some embodiments, it is understood that the first IPSec VPN node needs to initiate a communication request to the satellite communication system to establish a communication path from the first IPSec VPN node to the Internet via the satellite communication system, so as to support subsequent external communications. Fig. 9 As shown, the communication method applied to the first IPSec VPN node, the process may also include the following steps:

[0089] Step 701, initiating a communication request to a satellite communication system through a satellite terminal to establish a satellite communication link on the satellite communication system.

[0090] Step 702: Through the quantum key distribution node, negotiate with the second IPSec VPN node to obtain the quantum key based on the identifier assigned by the quantum key distribution network.

[0091] Step 703: Using the satellite communication system, the obtained quantum key is used as a pre-shared key and the identifier is used as a communication address to initiate identity authentication to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel; or, using the satellite communication system, the obtained quantum key is used as a key for digital signature and the identifier is used as a communication address to initiate identity authentication to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel.

[0092] In this way, a communication request is actively initiated to the satellite communication system through the first IPSec VPN node, thereby forming a corresponding communication path.

[0093] To facilitate better understanding of those skilled in the art Fig. 9 The embodiment shown in the figure will be explained below. Figure 3 and Fig. 9 It is not difficult to see from the process shown that Fig. 9 The embodiment shown is in Figure 3 Based on the illustrated embodiment, step 701 is further executed before step 101, and steps 101 to 102 are substantially the same as steps 702 to 703, which will not be described in detail here.

[0094] In step 701, a communication request is initiated to the satellite communication system through the satellite terminal to establish a satellite communication link on the satellite communication system. The embodiment of the present application does not limit the method of initiating the communication request. It can be understood that it is roughly the same as the user initiating the communication request to the satellite communication system through the satellite terminal in the related art, and will not be described in detail here.

[0095] Accordingly, the embodiment of the present application further provides a communication method, which is applied to a second IPSec VPN node. The second IPSec VPN node is the second IPSec VPN node in the aforementioned communication system, which will not be described in detail here. Fig.10 As shown, the communication method applied to the second IPSec VPN node may include the following steps:

[0096] Step 801, through a quantum key distribution node, negotiate with a first IPSec VPN node to obtain a quantum key based on an identifier assigned by a quantum key distribution network, wherein the first IPSec VPN node accesses a satellite communication system through a connection with a satellite terminal, and the first IPSec VPN node accesses a quantum key distribution network through a connection with another quantum key distribution node.

[0097] Step 802, based on the quantum key and the identifier, respond to the establishment of the IPSec VPN communication channel initiated by the first IPSec VPN node through the satellite communication system to support the client accessing the first IPSec VPN node and another client accessing the second IPSec VPN node to communicate with each other based on the IPSec VPN communication channel.

[0098] In this way, the first IPSec VPN node and the second IPSec VPN node obtain the assigned identifier from the quantum key distribution network through the connected quantum key distribution node, so that the second IPSec VPN node side can communicate and access with the first IPSec VPN node side based on the identifier, and obtain the quantum key while obtaining the identifier, so that on the basis of forming a communication link of the satellite communication system based on their respective access relationships with the satellite communication system, the first IPSec VPN node can actively initiate the establishment of an IPSec VPN communication channel to the second IPSec VPN node on the communication link, so that a two-way IPSec VPN communication channel from the first IPSec VPN node to the second IPSec VPN node is established based on the communication link of the satellite communication system, so that the client accessing the first IPSec VPN node and the second IPSec VPN node can realize secure two-way communication based on the IPSec VPN communication channel, and on the premise of ensuring security, two-way communication between the client on one side of the satellite communication system and the outside is supported, thereby improving user experience.

[0099] It is not difficult to find that this embodiment is a method embodiment corresponding to the above embodiment, and this embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment, and in order to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied in the above embodiment.

[0100] To help those skilled in the art better understand the communication method provided in the embodiments of the present application, the following will explain it through the corresponding interaction process.

[0101] First, the first IPSec VPN node initiates a communication request to the satellite communication system to establish a communication link based on the satellite communication system. Fig.11 As shown, including:

[0102] 1. Initiate a communication request through a satellite terminal. At this time, the satellite terminal is placed in a suitable development position on the ground, accurately aligns with the direction of the satellite, and transmits a modulated data signal to the satellite to apply for uplink communication.

[0103] 2. The communication satellite forwards the request to the satellite core network. At this time, after receiving the communication request, the communication satellite converts it into a downlink signal with the same frequency as the ground station at the satellite core network, and forwards the communication request to the ground station. After receiving it, the ground station sends it to the core network for processing.

[0104] 3. The satellite core network processes the request and returns the result. At this point, the satellite core network finally processes the request from the satellite terminal and returns the relevant results of link establishment to the communication satellite through the ground station.

[0105] 4. The communication satellite forwards the link establishment result. At this point, the communication satellite continues to convert the result into a signal with the same frequency as the satellite terminal, returns it to the satellite terminal and further returns it to the first IPSec VPN node. In this way, if there is no error, the satellite communication link is established. Subsequent satellite terminals can directly communicate with the satellite core network to perform subsequent Internet-related business operations. After the first IPSec VPN node accesses the satellite terminal, it can use the established communication link.

[0106] Secondly, the first IPSec VPN node and the second IPSec VPN node initiate authentication to the quantum key distribution network through the quantum key distribution node. At the same time, the first IPSec VPN node and the second IPSec VPN node negotiate to obtain the quantum key from the quantum key distribution network based on the assigned ID. Specifically, Fig.12 As shown, including:

[0107] 1. The first IPSec VPN node and the second IPSec VPN node respectively apply for authentication and access to the quantum key distribution network through the quantum key distribution node. The quantum key distribution network returns the authentication result. Only the devices that have been authenticated and accessed can apply for subsequent key applications. In this way, before applying for the key, the quantum key distribution network assigns the first IPSec VPN node and the second IPSec VPN node relevant IDs (identifications), authentication keys, communication protection keys, etc. to prepare for the subsequent secure delivery of quantum keys. At the same time, the quantum key distribution network configures the first IPSec VPN node and the second IPSec VPN node with relevant quantum channel resources to support real-time key applications.

[0108] 2. The first IPSec VPN node applies to the quantum key distribution network for a key to be paired with the second IPSec VPN node. It needs to provide the key length, the ID of the second IPSec VPN node in the quantum key distribution network, timestamp and other information. After the application is successful, the quantum key distribution network returns the quantum key and the corresponding quantum key ID to the first IPSec VPN node.

[0109] 3. The first IPSec VPN node forwards the obtained quantum key ID to the second IPSec VPN node, and the second IPSec VPN node uses the received quantum key ID to obtain the corresponding quantum key from the quantum key distribution network. In this way, the first IPSec VPN node and the second IPSec VPN node have the same quantum key, which can be integrated into the existing encryption system to enhance its security.

[0110] It should be noted that quantum key negotiation and distribution actually requires the cooperation of various module components in the quantum network to be completed. The embodiments of this application mainly focus on how users of quantum keys obtain relevant interfaces of keys through the quantum network, without paying attention to related details. For specific implementation details, please refer to the quantum key distribution scheme in the related technology, which will not be described here one by one.

[0111] Then, the first IPSec VPN node and the second IPSec VPN node establish an IPSecVPN communication channel according to the quantum key and the identifier. In order to facilitate those skilled in the art to better understand the scheme of integrating quantum keys in the process of establishing an IPSecVPN communication channel provided in the embodiment of the present application, and the difference and compatibility with the related IPSecVPN communication channel establishment scheme, the IPSecVPN communication channel establishment scheme in the related art is described here first.

[0112] like Fig.13 As shown, the process of establishing an IPSec VPN communication channel in the related art is specifically as follows:

[0113] 1. IKE (Internet Key Exchange) parameter negotiation, that is, negotiating the password-related policies of both parties, including the process identification of both parties, DH password encryption algorithm, hash algorithm, identity authentication method, DH group category, SA survival period, etc.

[0114] 2. Exchange DH (Diffie-Hellman) key data, that is, the two parties exchange the required key parameters through the DH protocol, including the random numbers Ni and Nr generated by both ends, and parameters X and Y in the DH protocol. Through this step, three types of keys can be generated: message integrity verification key; IKE phase message encryption key, IPsec message encryption and verification key.

[0115] 3. Bilateral identity authentication, that is, bilateral identity authentication based on pre-sharing or digital signature.

[0116] 4. Establish an IKE security channel. That is, after both parties complete identity authentication, an IKE security channel is established to protect the subsequent IPSec security channel establishment process.

[0117] 5. Negotiate to establish an IPsec security channel and authenticate both parties, that is, both parties complete IPSec security proposal negotiation, identity authentication and data verification, and generate the IPSec VPN channel key for final use.

[0118] 6. Establish an IPSec VPN security channel, that is, establish an IPSec VPN security channel, and all data will be encrypted and protected through this channel for transmission.

[0119] However, different from the above process, based on the solution provided by the above implementation, the process of establishing the IPSec VPN communication channel between the first IPSec VPN node and the second IPSec VPN node is specifically referred to as follows: Fig.14 ,include:

[0120] 1. IKE parameter negotiation. At this time, the first IPSec VPN node applies for quantum keys KA-1 and KA-2 from the quantum key distribution network. The second IPSec VPN node obtains the quantum key KB-1 from the quantum key distribution network. Finally, both parties obtain three quantum keys through the original IKE parameter negotiation channel.

[0121] 2. Exchange DH key data. At this time, the random numbers Ni and Nr in the Nonce payload body of the original exchanged data are replaced by KA-1 and KB-1 respectively. There is no need to transmit random number information on the network, reducing the risk of leakage.

[0122] 3. Bilateral identity authentication: At this time, bilateral identity authentication is performed based on pre-sharing or digital signature. When using a pre-shared key, KB-1 can be directly used as the pre-shared key. The advantage of this is that it avoids the risk of the pre-shared key not being replaced for a long time and being retained during the transmission process. Alternatively, when using a digital signature, the digital signature information can be encrypted with KB-1 before transmission, which can resist quantum computing attacks.

[0123] It should be noted that Fig.13 For ease of understanding, the key application process is superimposed on the IPSec VPN communication channel establishment process. In some embodiments, the key can also be applied for in the aforementioned process, and in the IPSec VPN communication channel establishment process, only the quantum key is used without applying for the quantum key, which will not be described one by one here.

[0124] It is not difficult to find from the above example that the communication method and communication system provided by the embodiment of the present application can effectively solve the problem of no encryption protection in the existing satellite communication link. By using quantum key distribution technology and integrating IPSec VPN technology, the problem of no security protection in the original satellite communication link transmission is solved, and the communication content is prevented from being eavesdropped and cracked by a third party. At the same time, it can also increase the convenience of mutual communication between the network where the satellite terminal is located and the Internet, open up the network between the users on the satellite communication system side and the users on the Internet, so that Internet users can also effectively access the network resources of the users accessed on the satellite communication system side, and realize two-way communication.

[0125] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0126] Another aspect of the present application embodiment further provides an electronic device, such as Fig.15 As shown, it includes: at least one processor 1501; and a memory 1502 that is communicatively connected to the at least one processor 1501; wherein the memory 1502 stores instructions that can be executed by the at least one processor 1501, and the instructions are executed by the at least one processor 1501 so that the at least one processor 1501 can execute the communication method described in any of the above method embodiments.

[0127] Among them, the memory 1502 and the processor 1501 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 1501 and the memory 1502 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 1501 is transmitted on a wireless medium through an antenna, and further, the antenna also receives data and transmits the data to the processor 1501.

[0128] The processor 1501 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 1502 can be used to store data used by the processor 1501 when performing operations.

[0129] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0130] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0131] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A communication method, characterized in that: Applied to a first IPSec VPN node, the first IPSec VPN node accesses a satellite communication system through a connection with a satellite terminal, and the first IPSec VPN node accesses a quantum key distribution network through a connection with a quantum key distribution node, the method comprising: The quantum key distribution node is used to negotiate with a second IPSec VPN node based on an identifier assigned by the quantum key distribution network to obtain a quantum key, wherein the second IPSec VPN node accesses the satellite communication system through the Internet and a firewall of the satellite communication system, and the second IPSec VPN node accesses the quantum distribution network through another quantum key distribution node in the Internet; According to the quantum key and the identifier, an IPSec VPN communication channel is established to the second IPSec VPN node through the satellite communication system to support a client accessing the first IPSec VPN node and another client accessing the second IPSec VPN node to communicate with each other based on the IPSec VPN communication channel.

2. The communication method according to claim 1, characterized in that: The initiating establishment of an IPSec VPN communication channel to the second IPSec VPN node through the satellite communication system according to the quantum key and the identifier includes: Through the satellite communication system, the obtained quantum key is used as the Nonce payload body and the identifier is used as the communication address to initiate data exchange to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel.

3. The communication method according to claim 1, characterized in that: The initiating establishment of an IPSec VPN communication channel to the second IPSec VPN node through the satellite communication system according to the quantum key and the identifier includes: Initiate identity authentication to the second IPSec VPN node by using the satellite communication system, using the acquired quantum key as a pre-shared key and the identifier as a communication address, so as to support establishment of the IPSec VPN communication channel; or, Through the satellite communication system, the acquired quantum key is used as a key for digital signature and the identifier is used as a communication address to initiate identity authentication to the second IPSec VPN node to support the establishment of the IPSec VPN communication channel.

4. The communication method according to claim 1, characterized in that: The initiating establishment of an IPSec VPN communication channel to the second IPSec VPN node through the satellite communication system according to the quantum key and the identifier includes: Through the satellite communication system, the information of the quantum key obtained is used as the negotiation content and the identifier is used as the communication address to initiate parameter negotiation to the second IPSec VPN node, so as to obtain the same quantum key from the quantum key distribution network through the quantum key distribution node with the second IPSec VPN node, so as to support the establishment of the IPSec VPN communication channel.

5. The communication method according to any one of claims 1 to 4, characterized in that: The step of obtaining the quantum key through the quantum key distribution node by negotiating with the second IPSec VPN node based on the identifier assigned by the quantum key distribution network includes: Through the quantum key distribution node, according to the identifier, apply for two quantum keys from the quantum key distribution network to support the establishment of the IPSec VPN communication channel together with one quantum key applied by the second IPSec VPN node from the quantum key distribution network through the quantum key distribution node.

6. The communication method according to claim 5, characterized in that: Before the quantum key distribution node negotiates with the second IPSec VPN node to obtain the quantum key based on the identifier assigned by the quantum key distribution network, the method further includes: Through the quantum key distribution node, authentication is initiated to the quantum key distribution network to obtain the identifier returned by the quantum key distribution network under authentication.

7. The communication method according to any one of claims 1 to 4, characterized in that: Before initiating establishment of an IPSec VPN communication channel to the second IPSec VPN node through the satellite communication system according to the quantum key and the identifier, the method further includes: A communication request is initiated to the satellite communication system through the satellite terminal to establish a satellite communication link on the satellite communication system.

8. A communication method, characterized in that: Applied to a second IPSec VPN node, the second IPSec VPN node accesses the satellite communication system through the Internet and a firewall of the satellite communication system, and the second IPSec VPN node accesses the quantum key distribution network through a connection with a quantum key distribution node, the method comprising: The quantum key distribution node is used to negotiate with a first IPSec VPN node based on an identifier assigned by the quantum key distribution network to obtain a quantum key, wherein the first IPSec VPN node is connected to the satellite communication system through a connection with a satellite terminal, and the first IPSec VPN node is connected to the quantum key distribution network through a connection with another quantum key distribution node; According to the quantum key and the identifier, through the satellite communication system, respond to the establishment of the IPSec VPN communication channel initiated by the first IPSec VPN node, so as to support a client accessing the first IPSec VPN node and another client accessing the second IPSec VPN node to communicate with each other based on the IPSec VPN communication channel.

9. A communication system, characterized in that: include: At least two clients, at least one first IPSec VPN node, a satellite communication system, at least one second IPSec VPN node, and a quantum key distribution network; At least one of the clients accesses the first IPSec VPN node, and at least one of the clients accesses the second IPSec VPN node; each of the first IPSec VPN nodes accesses the satellite communication system through a satellite terminal of the satellite communication system, and also accesses the quantum key distribution network through at least one quantum key distribution node in the quantum key distribution network; The second IPSec VPN node located in the Internet is connected to the satellite communication system through a firewall of the satellite communication system, and each of the second IPSec VPN nodes is connected to the quantum key distribution network through at least one quantum key distribution node in the quantum key distribution network; The first IPSec VPN node is used to implement the communication method according to any one of claims 1 to 7, and the second IPSec VPN node is used to implement the communication method according to claim 8.

10. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the communication method according to any one of claims 1 to 7, or the communication method according to claim 8.

Images