Unicast source global quantum security multicast network key supplement method

Abstract

The invention discloses a unicast source global quantum security multicast network key supplement method. The key supplement request is initiated through the quantum security multicast source, so that key supplement in the unicast source global quantum security multicast network can be reliably and safely realized, and each multicast member in the quantum security multicast group can be effectively prevented from performing the key supplement request; in the prior art, the multicast key center needs to process a plurality of redundant key supplement requests at the same time, resulting in network congestion and network resource consumption, and the processing burden of the multicast key center is reduced. After the multicast key center generates and distributes the supplementary multicast group key, the supplementary multicast group key can be encrypted and multicast to all multicast members in the quantum security multicast group based on the encryption key corresponding to the supplementary multicast group key, so that the security of the supplementary multicast group key is ensured, and the security of the quantum security multicast group is improved. And the real-time performance and continuity of key supplement are also improved, and the synchronization delay of the supplementary multicast group key among the multicast members is reduced.

Description

Technical Field

[0001] The present application relates to the field of information security and quantum encryption technology, and in particular to a method for supplementing keys in a unicast source global quantum secure multicast network. Background Art

[0002] With the rapid development of information technology, the proposal of the global quantum secure communication solution marks a major innovation in the field of quantum secure communication. The solution is committed to building a seamless and highly flexible communication network. Its core is to use access base stations as communication hubs to achieve key relay between quantum secure network terminals. This innovative design ensures that secure and efficient quantum communication can be achieved between quantum secure terminals regardless of their geographical location, thereby greatly improving the security and reliability of information transmission.

[0003] In daily applications, multicast technology is widely used due to its high efficiency and flexibility, such as command issuance, video live broadcast, multimedia classroom, etc. Therefore, integrating multicast technology into the global quantum security network will further enhance the practicality and application value of the network.

[0004] However, in the global quantum security network, key supplementation is a key link to ensure communication security. The key supplementation mechanism adopted by the quantum security terminal in the global quantum security network usually relies on an end-to-end communication mode, that is, the quantum security terminal sends a key supplementation request to the access base station to which it is connected, and the access base station assigns a key center to the quantum security terminal to process the key supplementation request of the quantum security terminal. After receiving the key supplementation request, the key center will generate an encryption key and a supplementary key for the quantum security terminal. Subsequently, the key center sends the encryption key to the quantum security terminal in a quantum secure encryption manner through the access base station. After obtaining the encryption key, the quantum security terminal can request the key center to distribute the supplementary key in a quantum secure encryption manner.

[0005] This traditional key supplementation mechanism is powerless when facing multicast networks. Multicast networks are a special communication mode in which information is sent to one or more multicast members in the multicast network in a multicast manner, rather than traditional end-to-end communication. Since the number of members in a multicast network may be large and the relationships between members are complex and changeable, it is difficult to meet the security needs of all members through a single end-to-end key distribution method. This limitation makes the application of the above key supplementation mechanism in multicast networks difficult. Summary of the invention

[0006] The present application provides a method for supplementing keys in a unicast source global quantum secure multicast network, which is used to implement key supplementation in a unicast source global quantum secure multicast network.

[0007] In a first aspect, the present application provides a method for supplementing a key of a unicast source global quantum secure multicast network, the method comprising:

[0008] The quantum secure multicast source initiates a key supplement request message to the first access base station to which it is connected; wherein the key supplement request carries a multicast group identifier of the quantum secure multicast group;

[0009] The first access base station receives the key supplement request; determines a multicast key center corresponding to the multicast group identifier; and sends a multicast key distribution request message carrying the multicast group identifier to the multicast key center;

[0010] The multicast key center receives the multicast key distribution request message; generates a supplementary multicast group key corresponding to the multicast group identifier, and obtains an encryption key corresponding to the supplementary multicast group key; generates a multicast key distribution response message and sends it to the first access base station, so that the first access base station generates a key supplement response message based on the received multicast key distribution response message and sends it to the quantum secure multicast source; and, according to the multicast group identifier, multicasts the supplementary multicast group key encrypted based on the encryption key;

[0011] The quantum secure multicast source receives the key supplement response message and the encrypted supplementary multicast group key; obtains the encryption key, and decrypts the encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key;

[0012] For any multicast member in the quantum secure multicast group, the encrypted supplementary multicast group key is received; the encryption key is obtained, and based on the encryption key, the encrypted supplementary multicast group key is decrypted to obtain the supplementary multicast group key.

[0013] In some possible implementations, the communication method between the quantum secure multicast source and the first access base station is: quantum secure encrypted communication based on a symmetric pairing key between the two parties.

[0014] In some possible implementations, if the key supplement request and the multicast key distribution request message both carry a first key distribution identifier, and the first key distribution identifier indicates that the encryption key corresponding to the supplemented multicast group key was distributed by the multicast group key center when the multicast group key was distributed last time, then the multicast key center, the quantum secure multicast source, and the multicast group members all retrieve the encryption key from their respective local storages.

[0015] In some possible implementations, the method further comprises:

[0016] The multicast key center generates a pre-distributed encryption key for encrypting a supplementary multicast group key to be distributed next time; performs quantum encryption on the pre-distributed encryption key based on the encryption key; and multicasts the encrypted pre-distributed encryption key according to the multicast group identifier;

[0017] The quantum secure multicast source receives the encrypted pre-distributed encryption key; based on the encryption key, decrypts the encrypted pre-distributed encryption key to obtain the pre-distributed encryption key; and supplements the currently unused encryption key according to the pre-distributed encryption key.

[0018] In some possible implementations, if the key supplement request and the multicast key distribution request message both carry a second key distribution identifier, and the second key distribution identifier indicates that the encryption key corresponding to the supplemented multicast group key is newly generated by the multicast group key center this time, then the multicast key distribution response message and the key supplement response message both carry the encryption key;

[0019] The multicast key center multicasts the supplementary multicast group key encrypted based on the encryption key according to the multicast group identifier, including:

[0020] According to the multicast group identifier, multicast the current distribution identifier and the supplementary multicast group key encrypted based on the encryption key; wherein the current distribution identifier is used to query the encryption key generated this time;

[0021] The quantum secure multicast source obtains the encryption key, including:

[0022] Obtaining the encryption key from the key supplement response message;

[0023] The multicast group member obtains the encryption key in the following manner, including:

[0024] The multicast group member receives the current distribution identifier; sends an encryption key supplement request carrying the current distribution identifier and the multicast group identifier to the second access base station to determine the multicast key center corresponding to the multicast group identifier through the second access base station, and forwards the encryption key supplement request to the multicast key center;

[0025] An encryption key response message carrying the encryption key sent by the multicast key center is received through the second access base station; wherein the multicast key center determines the encryption key requested by the multicast group member through the multicast group identifier and the current distribution identifier carried in the encryption key supplement request.

[0026] In some possible implementations, after the second access base station determines the multicast key center corresponding to the multicast group identifier and before forwarding the encryption key supplement request to the multicast key center, the method further includes:

[0027] According to the identity information of the multicast group member, it is determined that the multicast group member has the authority to obtain the encryption key.

[0028] The beneficial effects of this application are as follows:

[0029] 1. Initiating a key replenishment request through a quantum secure multicast source can not only reliably and securely implement key replenishment in the global quantum secure multicast network of a unicast source, but also effectively avoid each multicast member in the quantum secure multicast group making a key replenishment request. The multicast key center needs to process multiple redundant key replenishment requests at the same time, causing network congestion and consuming network resources, thereby reducing the processing burden of the multicast key center.

[0030] 2. Through the interaction between the first access base station and the multicast key center, distributed key management is achieved. This management method not only improves the flexibility of key management, but also reduces the impact on the entire system when a single node is attacked or fails.

[0031] 3. After the multicast key center generates and distributes the supplementary multicast group key, it can encrypt the supplementary multicast group key based on the encryption key corresponding to the supplementary multicast group key and multicast it to all multicast members in the quantum secure multicast group. This not only ensures the security of the supplementary multicast group key, but also improves the real-time and continuity of key supplementation, and reduces the delay in synchronization of the supplementary multicast group key among the multicast members. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0033] Figure 1 A schematic diagram of a method for supplementing a unicast source global quantum secure multicast network key according to an embodiment of the present application;

[0034] Figure 2 A schematic diagram of a specific process of supplementing a unicast source global quantum secure multicast network key provided in an embodiment of the present application;

[0035] Figure 3 A schematic diagram of the specific process of unicast source global quantum secure multicast network key supplement provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0037] The global quantum security network can support secure and efficient quantum communication between any quantum security terminals connected to the network, regardless of their geographical location. A core of the global quantum security network is to use the access base station as a communication hub to connect quantum security terminals to the global quantum security network, and to achieve key relay between terminals connected to the global quantum security network.

[0038] During the access process, when a quantum security terminal accesses an access base station, the access base station will assign a network access identifier to the terminal, that is, a unique terminal identifier for the entire global quantum security network, which is used to identify the terminal. The network access identifier carries information about the country, operator, region, cell, access base station, and terminal. With this network access identifier, the terminal can be identified in the global quantum security network through this network access identifier within the time range that the terminal has this identifier. Subsequently, the quantum security terminal can apply for services and request resources from the global quantum security network through the access base station.

[0039] During the key relay process, the encryption end will relay the key through the encryption end access base station through the global quantum security network to the access base station of the decryption end, and then the decryption end access base station will forward the key to the decryption end, so as to ensure that a symmetric quantum security key is formed between the encryption end and the decryption end, and encryption and decryption communication can be achieved. The global quantum security network also includes a key center, which mainly distributes keys, i.e. quantum keys, to quantum security terminals connected to the global quantum security network.

[0040] In the above-mentioned global quantum security network, the two ends of direct communication, for example, between a quantum security terminal and an access base station, or between access base stations, use a symmetric encryption method based on a true random number one-time key. This symmetric encryption method requires that only the two ends of direct communication have a unique true random number symmetric key to ensure the privacy of the communication.

[0041] In daily applications, multicast technology is widely used due to its high efficiency and flexibility, such as command issuance, video live broadcast, multimedia classroom, etc. Therefore, integrating multicast technology into the global quantum security network will further enhance the practicality and application value of the network.

[0042] When the unicast source communicates in the global quantum secure multicast network, the quantum secure multicast source applies for encryption keys and multicast group keys from the key center with global quantum secure multicast capabilities through the access base station it accesses (referred to as the first access base station) to establish a quantum secure multicast group. The multicast group members who join the quantum secure multicast group first apply to join the quantum secure multicast group from the access base station they access (referred to as the second access base station) according to the multicast group identifier. After the second access base station authenticates the joining authority of the multicast group member, it applies to the key center corresponding to the multicast group identifier for the encryption key of the quantum secure multicast group and sends the address information and encryption key of the key center to the multicast group member. According to the address information, the multicast group member downloads the multicast group key encrypted based on the encryption key from the key center, and then decrypts the encrypted multicast group key based on the obtained encryption key to obtain the multicast group key, thereby joining the unicast source global quantum secure multicast network. Subsequently, the multicast group member can receive multicast messages from the quantum secure multicast source that are quantum securely encrypted with the multicast group key.

[0043] When the unicast source global quantum security multicast network communication is carried out, the multicast group key in the quantum security multicast group will be continuously consumed. Therefore, how to supplement the key of the multicast group key is the key to ensure the stability and continuity of the unicast source global quantum security multicast network communication. However, in the global quantum security network, key supplementation is a key link to ensure the security of communication. The key supplement mechanism adopted by the quantum security terminal in the global quantum security network usually relies on the end-to-end communication mode, that is, the quantum security terminal sends a key supplement request to the access base station to which it accesses, and the access base station assigns a key center to the quantum security terminal to process the key supplement request of the quantum security terminal. After receiving the key supplement request, the key center will generate an encryption key and a supplement key for the quantum security terminal. Subsequently, the key center sends the encryption key to the quantum security terminal in a quantum security encryption manner through the access base station. After obtaining the encryption key, the quantum security terminal can request the key center to distribute the supplement key in a quantum security encryption manner.

[0044] This traditional key supplementation mechanism is powerless when facing multicast networks. Multicast networks are a special communication mode in which information is sent to one or more multicast members in the multicast network in a multicast manner, rather than traditional end-to-end communication. Since the number of members in a multicast network may be large and the relationships between members are complex and changeable, it is difficult to meet the security needs of all members through a single end-to-end key distribution method. This limitation makes the application of the above key supplementation mechanism in multicast networks difficult.

[0045] Based on this, the present application provides a method for key supplementation in a unicast source global quantum secure multicast network to achieve key supplementation in a unicast source global quantum secure multicast network.

[0046] Embodiment 1:

[0047] Figure 1 A schematic diagram of a method for supplementing a unicast source global quantum secure multicast network key provided in an embodiment of the present application, the process comprising:

[0048] S101: A quantum secure multicast source initiates a key supplement request message to a first access base station to which it is connected; wherein the key supplement request carries a multicast group identifier of a quantum secure multicast group.

[0049] In the present application, the quantum security multicast source can be any quantum security terminal in the global quantum security network. The quantum security terminal can be a client such as a quantum security all-in-one machine, a quantum security privacy computer, etc., or a server such as a quantum security application server, a quantum security business server, etc.

[0050] In a unicast source global quantum security multicast network, the quantum security multicast source and all multicast group members share a key pool, that is, they share the same multicast group key. Therefore, for the consumption of the multicast group key, all multicast members (including the quantum security multicast source and the multicast group members) in the unicast source global quantum security multicast network are consistent. When a multicast member finds that the multicast group key is insufficient, all other multicast members in the quantum security multicast group will also have insufficient multicast group keys. In this case, if each multicast member makes a key replenishment request, the key center (referred to as the multicast key center) that replenishes the multicast group key of the quantum security multicast group will process multiple key replenishment requests at the same time, causing network congestion. At the same time, most of these multiple key replenishment requests are redundant, representing the shortage of the multicast group key in the quantum security multicast group, which greatly increases the processing burden of the multicast key center and consumes network resources.

[0051] Since the existence of the business conditions of the quantum security multicast group can be considered to be determined by the quantum security multicast source, when the quantum security multicast source no longer exists, the multicast of the quantum security multicast group will end, and other multicast group members can exit or join the quantum security multicast group at any time in this time period after the quantum security multicast source establishes the unicast source global quantum security multicast network and before the quantum security multicast source exits the unicast source global quantum security multicast network. Therefore, whether the multicast group member exists does not affect the existence and communication of the entire unicast source global quantum security multicast network. Based on this, in the present application, the initiation of the key supplement of the unicast source global quantum security multicast network can be initiated by the quantum security multicast source in the quantum security multicast group. Exemplarily, the quantum security multicast source in the unicast source global quantum security multicast network will monitor the key amount of the multicast group key stored by itself in real time or periodically during the multicast communication process. Among them, the key amount can be the used key amount of the stored multicast group key, or it can be the unused key amount of the stored multicast group key. When it is determined that the stored unused multicast group keys are insufficient based on the key quantity of the multicast group key, a key supplement request message may be initiated. The key supplement request message carries the multicast group identifier of the quantum secure multicast group. The key supplement request is then sent to the first access base station.

[0052] Among them, the multicast group identifier is used to identify a specific quantum secure multicast group. The multicast group identifier can be displayed by an IP address, and the IP address range is within a specific IP address block, which is reserved for multicast communication. For example, in the IPv4 communication protocol, an IPv4 multicast group identifier may be 239.255.255.250. For another example, in the IPv6 communication protocol, the multicast group identifier may be FF02::1:FF00:0 / 104. The key type identifier is used to indicate the required key type, which refers to the multicast group key. The display form of the key type identifier may vary depending on different protocols or implementations. For example, the key type identifier can be a numerical value, such as 1 for the key required for point-symmetric encryption, 2 for the multicast group key, etc. For another example, the key type identifier can also be a string used to uniquely identify the type of key, such as "GROUP_KEY" for the multicast group key.

[0053] In a possible implementation, in order to ensure the continuity and security of multicast communication, a reasonable key amount threshold is pre-configured, for example, an unused key amount threshold or a used key amount threshold. Taking the pre-configured key amount threshold as the used key amount threshold as an example, the quantum secure multicast source determines that the stored unused multicast group keys are insufficient when it is determined that the used key amount exceeds the pre-configured used key amount threshold. Taking the pre-configured key amount threshold as the unused key amount threshold as an example, the quantum secure multicast source determines that the stored unused multicast group keys are insufficient when it is determined that the unused key amount is lower than the pre-configured unused key amount threshold.

[0054] S102: The first access base station receives the key supplement request; determines a multicast key center corresponding to the multicast group identifier; and sends a multicast key distribution request message carrying the multicast group identifier to the multicast key center.

[0055] Based on the above embodiment, the first access base station can receive a key supplement request sent by a quantum secure multicast source. The first access base station can parse the key supplement request to obtain the multicast group identifier carried in the key supplement request. Then, a multicast key center that supports multicast is assigned to the multicast group identifier, and the address information of the multicast key center is obtained. According to the multicast group identifier, a multicast key distribution request message is generated. According to the address information, the multicast key distribution request message is sent to the multicast key center to request the multicast key center to supplement the multicast group key for the quantum secure multicast group of the multicast group identifier.

[0056] Exemplarily, the first access base station can obtain a key center information base configured by a network management system. The key center information base records detailed information such as the address information of at least one key center, the supported key types, whether the multicast function is supported, and the key centers corresponding to each pre-configured multicast group identifier. After the first access base station receives the key supplement request, it can query the key center information base. During the query process, the first access base station determines the multicast key center corresponding to the multicast group identifier carried in the key supplement request from the key centers corresponding to each pre-configured multicast group identifier.

[0057] S103: The multicast key center receives the multicast key distribution request message; generates a supplementary multicast group key corresponding to the multicast group identifier, and obtains an encryption key corresponding to the supplementary multicast group key; generates a multicast key distribution response message and sends it to the first access base station, so that the first access base station generates a key supplement response message based on the received multicast key distribution response message and sends it to the quantum secure multicast source; and, according to the multicast group identifier, multicasts the supplementary multicast group key encrypted based on the encryption key.

[0058] Based on the above embodiment, the multicast key center can receive a multicast key distribution request message sent by the first access base station. The multicast key center can parse the multicast key distribution request message and obtain the multicast group identifier carried in the multicast key distribution request message. The multicast key center queries the multicast key pool previously established for the quantum secure multicast group based on the multicast group identifier, and generates a supplementary multicast group key corresponding to the multicast group identifier in the multicast key pool.

[0059] In order to ensure the security of the process in which multicast members in the unicast source global quantum secure multicast network supplement the multicast group key from the multicast key center, in this application, the multicast key center also obtains the encryption key corresponding to the supplementary multicast group key, and encrypts and transmits the supplementary multicast group key through the encryption key. Then, the supplementary multicast group key and the encryption key are correspondingly saved in the multicast key pool corresponding to the multicast group identifier to facilitate subsequent query and use.

[0060] When the multicast key center obtains the supplementary multicast group key corresponding to the multicast group identifier and the encryption key corresponding to the supplementary multicast group key, a multicast key distribution response message can be generated and sent to the first access base station to respond to the multicast key distribution request message sent by the first access base station. The multicast key distribution response message is used to notify the first access base station that the supplementary multicast group key has been distributed. When the first access base station receives the multicast key distribution response message, it can generate a key supplement response message and send it to the quantum secure multicast source to promptly respond to the key supplement request sent by the quantum secure multicast source.

[0061] In order to supplement the multicast group key in time, in the present application, the multicast key center can perform quantum encryption on the supplementary multicast group key based on the encryption key after obtaining the supplementary multicast group key corresponding to the multicast group identifier and the encryption key corresponding to the supplementary multicast group key, and then multicast the encrypted supplementary multicast group key according to the multicast group identifier.

[0062] S104: The quantum secure multicast source receives the key supplement response message and the encrypted supplementary multicast group key; obtains the encryption key, and decrypts the encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key.

[0063] Based on the above embodiment, the quantum secure multicast source can not only receive the encrypted supplementary multicast group key multicasted by the multicast key center through the multicast group identifier, but also receive the key supplement response message sent by the first access base station. When the quantum secure multicast source receives the key supplement response message and the encrypted supplementary multicast group key, it obtains the encryption key corresponding to the encrypted supplementary multicast group key. Then, based on the encryption key, the encrypted supplementary multicast group key is decrypted to obtain the supplementary multicast group key, thereby realizing the supplementation of the stored multicast group key based on the supplementary multicast group key.

[0064] In a possible implementation, after the quantum secure multicast source obtains the supplementary multicast group key, it can determine whether the supplementary multicast group key passes the security check. Exemplarily, the security check includes one or more of the following:

[0065] 1. Integrity check

[0066] To ensure that the supplementary multicast group key is not tampered with or damaged during transmission or storage, in the present application, the quantum secure multicast source can perform an integrity check on the received supplementary multicast group key. For example, by performing a hash check on the supplementary multicast group key, it is determined whether the supplementary multicast group key passes the integrity check. If the supplementary multicast group key passes the integrity check, the quantum secure multicast source retains the supplementary multicast group key; if the supplementary multicast group key does not pass the integrity check, the quantum secure multicast source discards the supplementary multicast group key.

[0067] 2.Consistency check

[0068] In order to prevent errors or inconsistencies in the distribution or storage of the supplementary multicast group key, the quantum secure multicast source can also perform consistency check on the supplementary multicast group key with the multicast key center. For example, the quantum secure multicast source can compare the hash value of the supplementary multicast group key with the hash value of the supplementary multicast group key received by the multicast key center to determine whether the supplementary multicast group key meets the consistency check. If the supplementary multicast group key passes the consistency check, the quantum secure multicast source retains the supplementary multicast group key; if the supplementary multicast group key fails the consistency check, the quantum secure multicast source discards the supplementary multicast group key.

[0069] It should be noted that the method by which the quantum secure multicast source performs security verification on the supplementary multicast group key may include one or more of the above. In the case where the security verification includes the above multiple verification methods, that is, the security of the supplementary multicast group key is ensured by combining integrity verification and consistency verification, the quantum secure multicast source first ensures that the supplementary multicast group key has not been tampered with during transmission or storage through integrity verification; then, the consistency between the supplementary multicast group key and the supplementary multicast group key generated by the multicast key center is ensured through consistency verification. If the supplementary multicast group key passes both of these checks at the same time, then it can be considered that the supplementary multicast group key is safe and reliable and can be used for subsequent encrypted communications. If the supplementary multicast group key fails any of the checks, then corresponding security measures need to be taken, such as discarding the supplementary multicast group key, re-requesting the supplementary multicast group key, or reporting a security incident.

[0070] In a possible implementation, the communication mode between the quantum secure multicast source and the first access base station is: quantum secure encrypted communication based on a symmetric pairing key between the two parties.

[0071] In the present application, in order to ensure the security of communication between the quantum secure multicast source and the first access base station, the quantum secure multicast source and the first access base station perform quantum secure encrypted communication based on the symmetric pairing key between the two parties. Exemplarily, the key supplement request of the quantum secure multicast source is based on the pairing key and is sent to the first access base station by quantum encryption. The key supplement response message of the first access base station is also based on the pairing key and is sent to the quantum secure multicast source by quantum encryption.

[0072] S105: For any multicast member in the quantum secure multicast group, receive the encrypted supplementary multicast group key; obtain the encryption key, and decrypt the encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key.

[0073] For any multicast member currently joined in the quantum secure multicast group, the multicast member can receive the encrypted supplementary multicast group key multicasted by the multicast key center through the multicast group identifier. The encryption key corresponding to the encrypted supplementary multicast group key is obtained. Then, based on the encryption key, the encrypted supplementary multicast group key is decrypted to obtain the supplementary multicast group key, thereby realizing the supplementation of the stored multicast group key based on the supplementary multicast group key.

[0074] It should be noted that after obtaining the supplementary multicast group key, the multicast group member can perform security verification on the supplementary multicast group key. The specific process of the security verification can refer to the process of the quantum secure multicast source performing security verification on the supplementary multicast group key, and the repeated parts will not be repeated.

[0075] The beneficial effects of this application are as follows:

[0076] 1. Initiating a key replenishment request through a quantum secure multicast source can not only reliably and securely implement key replenishment in the global quantum secure multicast network of a unicast source, but also effectively avoid each multicast member in the quantum secure multicast group making a key replenishment request. The multicast key center needs to process multiple redundant key replenishment requests at the same time, causing network congestion and consuming network resources, thereby reducing the processing burden of the multicast key center.

[0077] 2. Through the interaction between the first access base station and the multicast key center, distributed key management is achieved. This management method not only improves the flexibility of key management, but also reduces the impact on the entire system when a single node is attacked or fails.

[0078] 3. After the multicast key center generates and distributes the supplementary multicast group key, it can encrypt the supplementary multicast group key based on the encryption key corresponding to the supplementary multicast group key and multicast it to all multicast members in the quantum secure multicast group. This not only ensures the security of the supplementary multicast group key, but also improves the real-time and continuity of key supplementation, and reduces the delay in synchronization of the supplementary multicast group key among the multicast members.

[0079] Embodiment 2:

[0080] In order to securely download the supplementary multicast group key, based on the above embodiment, in the present application, if the key supplement request and the multicast key distribution request message both carry a first key distribution identifier, and the first key distribution identifier indicates that the encryption key corresponding to the supplementary multicast group key is distributed by the multicast group key center when the multicast group key was distributed last time, then the multicast key center, the quantum secure multicast source and the multicast group members all retrieve the encryption key from their respective local storage.

[0081] In this application, the multicast key center, quantum secure multicast source, and multicast group members can use the pre-distribution encryption key method to obtain the encryption key corresponding to the supplementary multicast group key. That is, under this strategy, the multicast key center is not only responsible for generating and distributing new multicast group keys, but also pre-distributes an encryption key for encrypting the supplementary multicast group key for the next distribution to the quantum secure multicast source and all multicast group members at each distribution. In this way, whenever the multicast group key needs to be supplemented, all parties can quickly retrieve the corresponding encryption key from their local storage without relying on network transmission again, which greatly improves the speed and security of key updates.

[0082] Exemplarily, the quantum secure multicast source initiates a key supplement request carrying a key group identifier and a first key distribution identifier, and sends the key supplement request to the first access base station. The first key distribution identifier is used to indicate that the encryption key corresponding to the current supplementary multicast group key is distributed by the multicast group key center when the supplementary multicast group key was distributed last time. The first key distribution identifier can be implemented by a digital signature, a hash value, or a unique serial number. These forms can ensure the uniqueness and traceability of the first key distribution identifier, which is not specifically limited here.

[0083] After receiving the key supplement request sent by the quantum secure multicast source, the first access base station can parse the key supplement request to obtain the multicast group identifier and the first key distribution identifier carried in the key supplement request. Then, according to the multicast group identifier, the key center information base configured by the network management is queried to determine the multicast key center corresponding to the quantum secure multicast source and the address information of the multicast key center. Then, according to the address information, a multicast key distribution request message carrying the multicast group identifier and the first key distribution identifier is sent to the multicast key center.

[0084] After receiving the multicast key distribution request message sent by the first access base station, the multicast key center parses the multicast key distribution request message and obtains the multicast group identifier and the first key distribution identifier carried in the multicast key distribution request message. According to the multicast group identifier, the multicast key pool previously established for the quantum secure multicast group is queried. A supplementary multicast group key corresponding to the multicast group identifier is generated in the multicast key pool, and the encryption key distributed last time for the quantum secure multicast group is obtained in the multicast key pool, that is, the encryption key corresponding to the supplementary multicast group key is obtained.

[0085] When the multicast key center obtains the supplementary multicast group key corresponding to the multicast group identifier and the encryption key corresponding to the supplementary multicast group key, a multicast key distribution response message can be generated and sent to the first access base station to respond to the multicast key distribution request message sent by the first access base station. At the same time, the multicast key center performs quantum encryption on the supplementary multicast group key based on the encryption key. Then, the encrypted supplementary multicast group key is multicasted according to the multicast group identifier.

[0086] In a possible implementation, in order to achieve continuity and stability of key supplementation, the multicast key center will also generate an encryption key (referred to as a pre-distributed encryption key) for encrypting the supplementary multicast group key to be distributed next time, so that the pre-distributed encryption key can be distributed together with the distribution of the supplementary multicast group key this time. Exemplarily, the multicast key center performs quantum encryption on the pre-distributed encryption key based on the encryption key corresponding to the supplementary multicast group key. Then, the encrypted pre-distributed encryption key is multicasted according to the multicast group identifier.

[0087] When the first access base station receives the multicast key distribution response message, it can generate a key supplement response message and send it to the quantum secure multicast source to promptly respond to the key supplement request sent by the quantum secure multicast source.

[0088] When the quantum secure multicast source receives the key supplement response message and the encrypted supplementary multicast group key, it can query the saved encryption key from the local storage, and then decrypt the encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key.

[0089] In a possible implementation, the quantum secure multicast source may also receive an encrypted pre-distributed encryption key multicasted by a multicast key center. The quantum secure multicast source may decrypt the encrypted pre-distributed encryption key based on the encryption key stored locally to obtain the pre-distributed encryption key. The stored encryption key is then supplemented based on the pre-distributed encryption key.

[0090] It should be noted that after the quantum secure multicast source obtains the pre-distributed encryption key, it also needs to perform a security verification on the pre-distributed encryption key. The security verification process can refer to the process of performing security verification on the supplementary multicast group key in the above embodiment, and will not be described in detail here.

[0091] Similarly, for any multicast member currently joined in the quantum secure multicast group, the multicast member can receive the encrypted supplementary multicast group key multicasted by the multicast key center through the multicast group identifier. Then the saved encryption key is obtained from the local storage. Then, based on the encryption key, the encrypted supplementary multicast group key is decrypted to obtain the supplementary multicast group key, thereby realizing the supplementation of the saved multicast group key based on the supplementary multicast group key.

[0092] In a possible implementation, the multicast group member may also receive the encrypted pre-distributed encryption key multicasted by the multicast key center. The multicast group member may decrypt the encrypted pre-distributed encryption key based on the encryption key stored locally to obtain the pre-distributed encryption key. Then, the stored encryption key may be supplemented according to the pre-distributed encryption key.

[0093] It should be noted that after obtaining the pre-distributed encryption key, the multicast group member can perform a security verification on the pre-distributed encryption key. The specific process of the security verification can refer to the process of the quantum secure multicast source performing a security verification on the supplementary multicast group key, and the repetition will not be repeated.

[0094] Figure 2A schematic diagram of a specific unicast source global quantum secure multicast network key supplement process provided in an embodiment of the present application, the process includes:

[0095] S201: The quantum secure multicast source sends a key supplement request carrying a multicast group identifier and a first key distribution identifier to the first access base station to which it accesses.

[0096] S202: The first access base station queries the key center information database configured by the network management according to the multicast group identifier, and determines the multicast key center corresponding to the quantum secure multicast source and the address information of the multicast key center.

[0097] S203: The first access base station sends a multicast key distribution request message carrying the multicast group identifier and the first key distribution identifier to the multicast key center according to the address information.

[0098] S204: The multicast key center queries the multicast key pool previously established for the quantum secure multicast group according to the multicast group identifier carried in the multicast key distribution request message.

[0099] S205: The multicast key center generates a supplementary multicast group key and a pre-distributed encryption key corresponding to the multicast group identifier in the multicast key pool based on the first key distribution identifier, and obtains the encryption key distributed to the quantum secure multicast group last time in the multicast key pool.

[0100] S206: The multicast key center generates a multicast key distribution response message and sends it to the first access base station.

[0101] S207: The multicast key center performs quantum encryption on the supplementary multicast group key and the pre-distributed encryption key based on the encryption key, and multicasts the encrypted supplementary multicast group key and the encrypted pre-distributed encryption key according to the multicast group identifier.

[0102] S208: The first access base station generates a key supplement response message based on the multicast key distribution response message and sends it to the quantum secure multicast source.

[0103] S209: Upon receiving the key supplement response message, the encrypted supplementary multicast group key and the encrypted pre-distributed encryption key, the quantum secure multicast source queries the saved encryption key from the local storage.

[0104] S210: The quantum secure multicast source decrypts the encrypted supplementary multicast group key and the encrypted pre-distributed encryption key based on the encryption key to obtain the supplementary multicast group key and the pre-distributed encryption key, supplements the stored multicast group key according to the supplementary multicast group key, and supplements the locally stored encryption key according to the pre-distributed encryption key.

[0105] For any multicast member currently joined in the quantum secure multicast group, the following S211 to S212 are executed:

[0106] S211: The multicast group member receives the encrypted supplementary multicast group key and the encrypted pre-distributed encryption key multicasted by the multicast key center through the multicast group identifier.

[0107] S212: The multicast group member obtains the saved encryption key from the local storage, decrypts the encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key, supplements the saved multicast group key according to the supplementary multicast group key, and supplements the locally saved encryption key according to the pre-distributed encryption key.

[0108] Embodiment 3:

[0109] In order to securely download the supplementary multicast group key, based on the above embodiments, in the present application, if the key supplement request and the multicast key distribution request message both carry a second key distribution identifier, and the second key distribution identifier indicates that the encryption key corresponding to the supplementary multicast group key is newly generated by the multicast group key center this time, then the multicast key distribution response message and the key supplement response message both carry the encryption key;

[0110] The multicast key center multicasts the supplementary multicast group key encrypted based on the encryption key according to the multicast group identifier, including:

[0111] According to the multicast group identifier, multicast the current distribution identifier and the supplementary multicast group key encrypted based on the encryption key; wherein the current distribution identifier is used to query the encryption key generated this time;

[0112] The quantum secure multicast source obtains the encryption key, including:

[0113] Obtaining the encryption key from the key supplement response message;

[0114] The multicast group member obtains the encryption key in the following manner, including:

[0115] The multicast group member receives the current distribution identifier; sends an encryption key supplement request carrying the current distribution identifier and the multicast group identifier to the second access base station to determine the multicast key center corresponding to the multicast group identifier through the second access base station, and forwards the encryption key supplement request to the multicast key center;

[0116] An encryption key response message carrying the encryption key sent by the multicast key center is received through the second access base station; wherein the multicast key center determines the encryption key requested by the multicast group member through the multicast group identifier and the current distribution identifier carried in the encryption key supplement request.

[0117] For a public unicast source global quantum security multicast network, there may be frequent joining and exit of multicast group members. Moreover, in the case where the behavior of the multicast group members is uncontrollable, in order to ensure the independence of the supplementary multicast group keys each time, the multicast group members who need to exit the unicast source global quantum security multicast network should avoid illegally obtaining the supplementary multicast group keys distributed subsequently. Based on this, in this application, a new distribution encryption key method can be adopted to obtain the encryption key corresponding to the supplementary multicast group key of this time, that is, under this strategy, the multicast key center is not only responsible for generating and distributing new multicast group keys, but also generates the encryption key corresponding to the supplementary multicast group key of this time at each distribution, and then distributes the newly generated encryption key to the multicast group member under the legal request mechanism of the multicast group member. In this way, whether it is a multicast group member who has joined the quantum security multicast group or a multicast group member who has exited the quantum multicast group, they can only receive the encrypted supplementary multicast group key through the multicast group identifier, but not the encryption key corresponding to the supplementary multicast group key. Only when the encryption key corresponding to the supplementary multicast group key is obtained from the multicast key center according to the legal request process, can the real supplementary multicast group key be obtained, ensuring the independence of each supplementary multicast group key, thereby effectively preventing the risk of key leakage.

[0118] Exemplarily, the quantum secure multicast source initiates a key supplement request carrying a key group identifier and a second key distribution identifier, and sends the key supplement request to the first access base station. The second key distribution identifier is used to indicate that the encryption key corresponding to the supplemented multicast group key is newly generated by the multicast group key center this time. The second key distribution identifier can be implemented by a digital signature, a hash value, or a unique serial number. These forms can ensure the uniqueness and traceability of the second key distribution identifier, which is not specifically limited here.

[0119] After receiving the key supplement request sent by the quantum security multicast source, the first access base station can parse the key supplement request to obtain the multicast group identifier and the second key distribution identifier carried in the key supplement request. Then, according to the multicast group identifier, the key center information base configured by the network management is queried to determine the multicast key center corresponding to the quantum security multicast source and the address information of the multicast key center. Then, according to the address information, a multicast key distribution request message carrying the multicast group identifier and the second key distribution identifier is sent to the multicast key center.

[0120] After receiving the multicast key distribution request message sent by the first access base station, the multicast key center parses the multicast key distribution request message and obtains the multicast group identifier and the second key distribution identifier carried in the multicast key distribution request message. According to the multicast group identifier, the multicast key pool previously established for the quantum security multicast group is queried. The supplementary multicast group key corresponding to the multicast group identifier, the encryption key corresponding to the supplementary multicast group key, and the current distribution identifier are generated and saved in the multicast key pool. Among them, the current distribution identifier is used to facilitate the subsequent multicast key center to query the encryption key generated this time.

[0121] When the multicast key center obtains the supplementary multicast group key corresponding to the multicast group identifier and the encryption key corresponding to the supplementary multicast group key, a multicast key distribution response message carrying the encryption key can be generated and sent to the first access base station to respond to the multicast key distribution request message sent by the first access base station. At the same time, the multicast key center performs quantum encryption on the supplementary multicast group key based on the encryption key. Then, according to the multicast group identifier, the current distribution identifier and the encrypted supplementary multicast group key are multicasted.

[0122] When the first access base station receives the multicast key distribution response message, it can generate a key supplement response message carrying the encryption key and send it to the quantum secure multicast source to promptly respond to the key supplement request sent by the quantum secure multicast source. For example, the first access base station sends the key supplement request to the quantum secure multicast source by quantum encryption based on a pairing key symmetric with the quantum secure multicast source to ensure the security of the encryption key.

[0123] When the quantum secure multicast source receives the key supplement response message and the encrypted supplementary multicast group key, it can obtain the encryption key from the key supplement response message. Then, based on the encryption key, the encrypted supplementary multicast group key is decrypted to obtain the supplementary multicast group key. For example, the quantum secure multicast source decrypts the received encrypted key supplement request based on the paired key symmetric with the first access base station to obtain the encryption key carried in the key supplement request.

[0124] For any multicast member currently joined in the quantum secure multicast group, the multicast member can receive the current distribution identifier and the encrypted supplementary multicast group key multicasted by the multicast key center through the multicast group identifier. Then the multicast member can generate an encryption key supplement request based on the current distribution identifier and the multicast group identifier, and send the encryption key supplement request to the second access base station. For example, the multicast member sends the encryption key supplement request quantum encrypted to the second access base station based on the symmetric pairing key with the second access base station.

[0125] After the second access base station receives the encryption key supplement request, it can parse the encryption key supplement request and extract the multicast group identifier and the current distribution identifier carried in the encryption key supplement request. Then, from the key centers corresponding to the pre-configured multicast group identifiers, it is queried whether there is a multicast key center corresponding to the multicast group identifier carried in the encryption key supplement request. If it is determined that there is a multicast key center corresponding to the multicast group identifier, it means that there is a quantum security multicast group corresponding to the multicast group identifier, and the address information of the multicast key center is obtained. According to the address information, the encryption key supplement request is sent to the multicast key center. If it is determined that there is no multicast key center corresponding to the multicast group identifier, it means that the quantum security multicast group corresponding to the multicast group identifier has not been established, and the response to the multicast group member can be refused.

[0126] In a possible implementation manner, after the second access base station determines the multicast key center corresponding to the multicast group identifier and before forwarding the encryption key supplement request to the multicast key center, the method further includes:

[0127] According to the identity information of the multicast group member, it is determined that the multicast group member has the authority to obtain the encryption key.

[0128] In order to ensure the legitimacy of the multicast group member requesting the encryption key, in the present application, the second access base station can verify the identity information of the quantum security terminal requesting the encryption key to determine whether the quantum security terminal has the authority to request the encryption key. Wherein, the identity information may include but is not limited to: MAC address, IP address, network access identification or other security credentials that can be used to verify the identity. Exemplarily, after receiving the encryption key supplement request, the second access base station can obtain the multicast group identification and the identity information of the quantum security terminal that sends the encryption key supplement request from the encryption key supplement request. In the case where the quantum security multicast group corresponding to the multicast group identification is queried from the network management configuration according to the multicast group identification, based on the identity information, it is determined whether the quantum security terminal meets the request condition for requesting the encryption key. Wherein, the request condition can be in various forms, including but not limited to: the identity information of the multicast member is the identity information authorized to join the quantum security multicast group, the identity information of the multicast member is not the identity information rejected to join the quantum security multicast group, and the number of times the identity information joins the quantum security multicast group in a unit time period is less than the preset number threshold, etc. If, based on the identity information, it is determined that the quantum security terminal meets the request conditions for requesting an encryption key, it means that the quantum security terminal has the authority to request an encryption key, and then the multicast key center is determined according to the multicast group identifier. If, based on the identity information, it is determined that the quantum security terminal does not meet the request conditions for requesting an encryption key, it means that the quantum security terminal is illegal and does not have the authority to request an encryption key, then the quantum security terminal is refused to respond.

[0129] Based on the above embodiment, the multicast key center can receive the encryption key supplement request sent by the second access base station, parse the encryption key supplement request, and obtain the multicast group identifier and the current distribution identifier carried in the multicast group key. Then, according to the multicast group identifier, find the multicast key pool previously established for the multicast group identifier, and based on the current distribution identifier, obtain the encryption key corresponding to the current supplemented multicast group key from the multicast key pool. Then, send the encryption key response message carrying the encryption key to the second access base station, so that the encryption key is forwarded to the multicast member through the second access base station.

[0130] Once the second access base station receives the encryption key response message sent by the multicast key center, it can forward the encryption key response message to the multicast group member. For example, the second access base station can use the symmetric key paired with the multicast group member to quantum encrypt the encryption key response message and send it to the multicast group member, thereby preventing the encryption key from being directly exposed in plain text in the network.

[0131] If the multicast group member receives the encrypted encryption key response message sent by the second access base station, the symmetric key with the second access base station can be obtained, and then the encrypted encryption key response message can be decrypted according to the symmetric key to obtain the encryption key. When the multicast group member obtains the encryption key, the received encrypted supplementary multicast group key can be decrypted based on the encryption key to obtain the supplementary multicast group key.

[0132] It should be noted that after obtaining the encryption key, the multicast group member can perform a security verification on the encryption key. The specific process of the security verification can refer to the process of the quantum secure multicast source performing a security verification on the supplementary multicast group key, and the repetition will not be repeated.

[0133] Figure 3 A schematic diagram of a specific unicast source global quantum secure multicast network key supplement process provided in an embodiment of the present application, the process includes:

[0134] S301: The quantum secure multicast source sends a key supplement request carrying a multicast group identifier and a second key distribution identifier to the first access base station to which it is connected.

[0135] S302: The first access base station queries the key center information database configured by the network management according to the multicast group identifier, and determines the multicast key center corresponding to the quantum secure multicast source and the address information of the multicast key center.

[0136] S303: The first access base station sends a multicast key distribution request message carrying the multicast group identifier and the second key distribution identifier to the multicast key center according to the address information.

[0137] S304: The multicast key center queries the multicast key pool previously established for the quantum secure multicast group according to the multicast group identifier carried in the multicast key distribution request message.

[0138] S305: The multicast key center generates, based on the second key distribution identifier, in the multicast key pool a supplementary multicast group key corresponding to the multicast group identifier, an encryption key corresponding to the supplementary multicast group key, and a current distribution identifier.

[0139] S306: The multicast key center generates a multicast key distribution response message carrying the encryption key and sends it to the first access base station.

[0140] S307: The multicast key center performs quantum encryption on the supplementary multicast group key based on the encryption key, and multicasts the current distribution identifier and the encrypted supplementary multicast group key according to the multicast group identifier.

[0141] S308: The first access base station generates a key supplement response message carrying the encryption key based on the multicast key distribution response message and sends it to the quantum secure multicast source.

[0142] S309: When the quantum secure multicast source receives the key supplement response message and the encrypted supplemented multicast group key, it obtains the encryption key from the key supplement response message.

[0143] S310: The quantum secure multicast source decrypts the encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key, and supplements the stored multicast group key according to the supplementary multicast group key.

[0144] For any multicast member currently joined in the quantum secure multicast group, the following S311 to S312 are executed:

[0145] S311: The multicast group member receives the current distribution identifier and the encrypted supplementary multicast group key multicasted by the multicast key center through the multicast group identifier.

[0146] S312: The multicast group member sends an encryption key supplement request carrying the current distribution identifier and the multicast group identifier to the second access base station to which it is connected.

[0147] S313: After receiving the encryption key supplement request, the second access base station obtains the identity information of the multicast member from the encryption key supplement request, and determines whether the multicast member has the authority to request the encryption key based on the identity information.

[0148] S314: When determining that the multicast group member has the authority to request the encryption key, the second access base station determines the multicast key center and the address information of the multicast key center based on the multicast group identifier.

[0149] S315: The second access base station forwards the encryption key supplement request to the multicast key center according to the address information.

[0150] S316: After receiving the encryption key supplement request, the multicast key center searches for the multicast key pool previously established for the multicast group identifier according to the multicast group identifier carried in the encryption key supplement request, and obtains the encryption key corresponding to the supplemented multicast group key from the multicast key pool based on the current distribution identifier carried in the encryption key supplement request.

[0151] S317: The multicast key center sends an encryption key response message carrying the encryption key to the second access base station.

[0152] S318: After receiving the encryption key response message, the second access base station encrypts and sends the encryption key response message to the multicast member based on the symmetric key with the multicast member.

[0153] S319: The multicast group member decrypts the received encrypted encryption key response message based on the symmetric key with the second access base station to obtain the encryption key.

[0154] S320: The multicast group member decrypts the received encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key, and supplements the stored multicast group key according to the supplementary multicast group key.

Claims

1. A method for supplementing keys in a unicast source global quantum secure multicast network, characterized in that: The method comprises: The quantum secure multicast source initiates a key supplement request message to the first access base station to which it is connected; wherein the key supplement request carries a multicast group identifier of the quantum secure multicast group; The first access base station receives the key supplement request; determines a multicast key center corresponding to the multicast group identifier; and sends a multicast key distribution request message carrying the multicast group identifier to the multicast key center; The multicast key center receives the multicast key distribution request message; generates a supplementary multicast group key corresponding to the multicast group identifier, and obtains an encryption key corresponding to the supplementary multicast group key; generates a multicast key distribution response message and sends it to the first access base station, so that the first access base station generates a key supplement response message based on the received multicast key distribution response message and sends it to the quantum secure multicast source; and, according to the multicast group identifier, multicasts the supplementary multicast group key encrypted based on the encryption key; The quantum secure multicast source receives the key supplement response message and the encrypted supplementary multicast group key; obtains the encryption key, and decrypts the encrypted supplementary multicast group key based on the encryption key to obtain the supplementary multicast group key; For any multicast member in the quantum secure multicast group, the encrypted supplementary multicast group key is received; the encryption key is obtained, and based on the encryption key, the encrypted supplementary multicast group key is decrypted to obtain the supplementary multicast group key.

2. The method according to claim 1, characterized in that The communication method between the quantum secure multicast source and the first access base station is: quantum secure encrypted communication based on a symmetric pairing key between the two parties.

3. The method according to claim 1, characterized in that If both the key supplement request and the multicast key distribution request message carry a first key distribution identifier, and the first key distribution identifier indicates that the encryption key corresponding to the supplementary multicast group key was distributed by the multicast group key center when the multicast group key was distributed last time, then the multicast key center, the quantum secure multicast source and the multicast group member all retrieve the encryption key from their respective local storages.

4. The method according to claim 3, characterized in that The method further comprises: The multicast key center generates a pre-distributed encryption key for encrypting a supplementary multicast group key to be distributed next time; performs quantum encryption on the pre-distributed encryption key based on the encryption key; and multicasts the encrypted pre-distributed encryption key according to the multicast group identifier; The quantum secure multicast source receives the encrypted pre-distributed encryption key; based on the encryption key, decrypts the encrypted pre-distributed encryption key to obtain the pre-distributed encryption key; and supplements the currently unused encryption key according to the pre-distributed encryption key.

5. The method according to claim 1, characterized in that If both the key supplement request and the multicast key distribution request message carry a second key distribution identifier, and the second key distribution identifier indicates that the encryption key corresponding to the supplemented multicast group key is newly generated by the multicast group key center this time, then both the multicast key distribution response message and the key supplement response message carry the encryption key; The multicast key center multicasts the supplementary multicast group key encrypted based on the encryption key according to the multicast group identifier, including: According to the multicast group identifier, multicast the current distribution identifier and the supplementary multicast group key encrypted based on the encryption key; wherein the current distribution identifier is used to query the encryption key generated this time; The quantum secure multicast source obtains the encryption key, including: Obtaining the encryption key from the key supplement response message; The multicast group member obtains the encryption key in the following manner, including: The multicast group member receives the current distribution identifier; sends an encryption key supplement request carrying the current distribution identifier and the multicast group identifier to the second access base station to determine the multicast key center corresponding to the multicast group identifier through the second access base station, and forwards the encryption key supplement request to the multicast key center; An encryption key response message carrying the encryption key sent by the multicast key center is received through the second access base station; wherein the multicast key center determines the encryption key requested by the multicast group member through the multicast group identifier and the current distribution identifier carried in the encryption key supplement request.

6. The method according to claim 4, characterized in that After the second access base station determines the multicast key center corresponding to the multicast group identifier and before forwarding the encryption key supplement request to the multicast key center, the method further includes: According to the identity information of the multicast group member, it is determined that the multicast group member has the authority to obtain the encryption key.

Images