Whole-domain quantum security key distribution method for preventing replay attack

Abstract

The invention relates to the technical field of information security, in particular to a global quantum security key distribution method for preventing replay attack. According to the method, when the key center receives the key distribution request of the terminal, the communication address is verified, the legality of the request and the matching between the terminal and the key pool are ensured, and therefore network replay attacks are effectively prevented. Meanwhile, in combination with access control of the equipment identifier, only the authorized terminal can be further ensured to access the system by verifying the equipment identifier, so that a dual-verification mechanism is realized. After the key distribution is completed, the key center recycles the resources corresponding to the supplementary quantum key, so that the repeated use of the key is avoided, the disposable use principle of the key is ensured, and the efficient utilization of the key resources is improved. According to the invention, the key distribution security of the global quantum security network is improved, and reliable technical support is provided for quantum communication.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a global quantum security key distribution method that is resistant to replay attacks. Background Art

[0002] In the existing global quantum security network, the key distribution process mainly relies on the interaction between the quantum security terminal and the key center. The key center is responsible for generating keys and encryption keys, and sending the encryption keys to the quantum security terminal through quantum security encryption. After receiving the key distribution response, the quantum security terminal uses the encryption key to decrypt and obtain the key center information and key index, and then downloads the key from the key center. This key distribution method ensures the secure transmission of keys.

[0003] However, the existing technology has certain security risks. Once the attacker obtains the key index, he can obtain the key center information through network messages and try to download the key from the key center. Although the keys downloaded by illegal quantum security terminals cannot be used because they do not have encryption keys and cannot decrypt keys, this download behavior imposes a certain burden on the key center. Summary of the invention

[0004] To solve the above problems, the present application discloses a global quantum security key distribution method that is resistant to replay attacks, comprising the following steps:

[0005] The key center verifies whether the device identification of the terminal is legal, and after the verification is passed, establishes a key pool, associates the key pool with the device identification of the terminal, assigns a key pool identification to the key pool, generates a corresponding quantum security key, and synchronizes the quantum security key and the key pool identification with the legal terminal; the quantum security key includes a communication protection key and a key protection key;

[0006] The terminal sends a key distribution request to the key center, carrying the key pool identifier and its own device identifier, wherein the device identifier is quantum encrypted by the key protection key;

[0007] The key center decrypts and obtains the device identification and verifies it. After the verification is passed, it sends a key distribution response message to the terminal, carrying the communication address corresponding to the terminal. The key distribution response message is encrypted with the communication protection key and sent to the terminal;

[0008] The terminal receives the key distribution response message from the key center, obtains the communication address after decryption through the key protection key, and constructs a key download request message, which carries the key pool identifier, its own communication address and key index, wherein the communication address and key index are quantum encrypted again using the communication protection key;

[0009] The key center receives the key download request message from the terminal, determines the corresponding key pool through the key pool identifier, matches the corresponding communication protection key, decrypts the download request message to obtain the terminal communication address and key index; verifies whether the communication address is correct, and after the verification is passed, matches the generated supplementary quantum key based on the key index in the key download request message, and sends the supplementary quantum key to the terminal, wherein the supplementary quantum key is encrypted with the transmission key and sent to the terminal in the form of a file stream;

[0010] The terminal obtains the encrypted supplementary key, and obtains the real supplementary quantum key after decryption by the key protection key;

[0011] After the terminal key download is completed, the key center recovers the resources corresponding to the supplementary quantum key.

[0012] The communication protection key and the key protection key are both quantum true random number keys.

[0013] The communication protection key includes an uplink key and a downlink key.

[0014] The communication address includes address and port information.

[0015] The device identification includes manufacturer information and hardware identification.

[0016] The method of the present application verifies the communication address when the key center receives the key distribution request from the terminal, ensuring the legitimacy of the request and the matching of the terminal and the key pool, thereby effectively preventing network replay attacks. At the same time, combined with the access control of the device identification, the device identification is verified to further ensure that only authorized terminals can access the system, realizing a double verification mechanism. After the key distribution is completed, the key center recovers the resources corresponding to the supplementary quantum key, avoiding the reuse of the key, ensuring the one-time use principle of the key, and improving the efficient use of key resources. The present invention improves the key distribution security of the global quantum security network and provides reliable technical support for quantum communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of a global quantum secure key distribution method that is resistant to replay attacks in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0019] Example: Figure 1 As shown, a global quantum security key distribution method for preventing replay attacks includes the following steps:

[0020] S101: The key center verifies whether the device identification of the terminal is legal, and after the verification is passed, establishes a key pool, associates the key pool with the device identification of the terminal, assigns a key pool identification to the key pool, generates a corresponding quantum security key, and synchronizes the quantum security key and the key pool identification with the legal terminal; the quantum security key includes a communication protection key and a key protection key;

[0021] The key center establishes a legal device identification library, which stores the device identification information of all authorized terminals. When a terminal attempts to establish a connection, the key center will verify the legitimacy of the device identification it sends to ensure that it exists in the device identification library. After the legitimacy verification is passed, the key center initializes a key pool and assigns it a unique key pool identifier.

[0022] For the key pool, the key center generates a quantum security key, which is a quantum true random number key, specifically including a communication protection key and a key protection key; wherein the communication protection key includes an uplink key and a downlink key; the quantum true random number key is generated by a quantum true random number generator (QRNG); when encrypting, the XOR method can be used for encryption;

[0023] S102: The terminal sends a key distribution request to the key center, carrying a key pool identifier and its own device identifier, wherein the device identifier is quantum encrypted by the key protection key;

[0024] When a terminal needs a key, it generates a key distribution request, which includes the terminal's device ID and the previously synchronized key pool ID. To protect the security of the device ID, the terminal uses the key protection key to perform quantum encryption on the device ID.

[0025] S103: The key center decrypts and obtains the device identification and verifies it. After the verification is passed, a key distribution response message is sent to the terminal, carrying the communication address corresponding to the terminal. The key distribution response message is encrypted with a communication protection key and sent to the terminal.

[0026] After receiving the key distribution request, the key center uses the key protection key to decrypt the request and obtain the device identification; it verifies the legitimacy of the device identification again and confirms the correctness of the key pool identification; after the verification, the key center generates a key distribution response message, which includes the communication address of the terminal; it uses the communication protection key to encrypt the key distribution response message to ensure that only the terminal with the corresponding key can decrypt it;

[0027] S104: The terminal receives the key distribution response message from the key center, obtains the communication address after decryption through the key protection key, and constructs a key download request message, which carries the key pool identifier, its own communication address and key index, wherein the communication address and key index are quantum encrypted again using the communication protection key;

[0028] The terminal receives the key distribution response message from the key center and decrypts it using the communication protection key to obtain the communication address. The terminal constructs a key download request message, which includes the key pool identifier, its own communication address and key index. In order to protect the security of the communication address and key index, the terminal uses the communication protection key to perform quantum encryption on them.

[0029] S105: The key center receives the key download request message from the terminal, determines the corresponding key pool through the key pool identifier, matches the corresponding communication protection key, decrypts the download request message to obtain the terminal communication address and key index; verifies whether the communication address is correct, and after the verification is passed, matches the generated supplementary quantum key based on the key index in the key download request message, and sends the supplementary quantum key to the terminal, wherein the supplementary quantum key is encrypted with the transmission key and sent to the terminal in the form of a file stream;

[0030] The key center receives the key download request message and locates the corresponding key pool through the key pool identifier; uses the matching communication protection key to decrypt the request message and obtain the terminal communication address and key index; verifies the correctness of the communication address to ensure the legitimacy of the key download request; according to the key index, the key center matches the corresponding supplementary quantum key from the key pool and encrypts it with the transmission key; sends the encrypted supplementary quantum key to the terminal in the form of a file stream;

[0031] S106: The terminal obtains the encrypted supplementary key, and obtains the real supplementary quantum key after decryption using the key protection key;

[0032] After receiving the encrypted supplementary key file stream, the terminal uses the key protection key to decrypt it and obtain the real supplementary quantum key;

[0033] S107: After the terminal key download is completed, the key center recovers the resources corresponding to the supplementary quantum key;

[0034] After confirming that the terminal has successfully downloaded the supplementary quantum key, the key center will immediately reclaim the resources corresponding to the key to prevent the key from being downloaded repeatedly. Even if it is a legitimate request, this key cannot be downloaded with this key index. Even if the original request is replayed using the original quantum security terminal communication, it is impossible to disguise the download of the key.

[0035] The communication address includes address and port information.

[0036] The device identification includes manufacturer information and hardware identification.

[0037] For example, assume that there is a Key Distribution Center (KDC) and a Terminal (T), and keys need to be distributed securely between them.

[0038] S101: The key center initializes the key pool

[0039] Terminal T sends the device identification to KDC, including manufacturer information "Manufacturer_X" and hardware identification "HW456".

[0040] The KDC verifies the legitimacy of "Manufacturer_X_HW456" in its device identification library.

[0041] After the verification is passed, the KDC creates a key pool for T and assigns a key pool identifier "KP001".

[0042] The KDC generates a pair of quantum-secure keys: the communication protection key "CK001" and the key protection key "MK001".

[0043] KDC synchronizes "CK001", "MK001" and "KP001" to T through the quantum channel.

[0044] S102: The terminal sends a key distribution request

[0045] T needs a new key and generates a key distribution request containing "KP001" and the device identifier "Manufacturer_X_HW456".

[0046] T uses "MK001" to perform quantum encryption on the device identification "Manufacturer_X_HW456" to obtain the encrypted device identification "Encrypted_Manufacturer_X_HW456".

[0047] T sends a key distribution request to KDC.

[0048] S103: Key center response

[0049] After receiving the request, KDC uses "MK001" to decrypt "Encrypted_Manufacturer_X_HW456" and obtains "Manufacturer_X_HW456".

[0050] The KDC verifies the legitimacy of "Manufacturer_X_HW456" and passes the verification.

[0051] KDC generates a key distribution response message containing T's communication address, including IP address "192.168.1.100" and port information "8080".

[0052] KDC uses "CK001" to encrypt the key distribution response message and obtains "Encrypted_Response".

[0053] KDC sends "Encrypted_Response" to T.

[0054] S104: The terminal constructs a key download request

[0055] T receives "Encrypted_Response", decrypts it using "CK001", and obtains the communication address "192.168.1.100:8080".

[0056] T constructs a key download request message including "KP001", "192.168.1.100:8080" and key index "Key_I ndex_001".

[0057] T uses "CK001" to perform quantum encryption on "192.168.1.100:8080" and "Key_I ndex_001" to obtain "Encrypted_Address" and "Encrypted_I ndex".

[0058] T sends a key download request to the KDC.

[0059] S105: The key center processes the key download request

[0060] KDC receives the key download request and locates the corresponding key pool through "KP001".

[0061] KDC uses "CK001" to decrypt "Encrypted_Address" and "Encrypted_Index" to obtain "192.168.1.100:8080" and "Key_Index_001".

[0062] The KDC verifies the correctness of "192.168.1.100:8080" and passes the verification.

[0063] KDC matches the supplementary quantum key "Supp l ementary_QK" from the key pool according to "Key_Index_001".

[0064] KDC uses the transmission key "TK" to encrypt "Supp l ementary_QK" to obtain "Encrypted_QK".

[0065] KDC sends "Encrypted_QK" to T in the form of a file stream.

[0066] S106: The terminal obtains a supplementary quantum key

[0067] T receives the "Encrypted_QK" file stream, decrypts it using "MK001", and obtains the real supplementary quantum key "Supp l ementary_QK".

[0068] S107: Key center reclaims resources

[0069] After KDC confirms that T has successfully downloaded "Supp l ementary_QK", it immediately recycles the resources corresponding to "Supp l ementary_QK" to ensure that the key will not be reused.

[0070] In the scheme of this embodiment, when the key center receives the key distribution request from the terminal, it verifies whether the communication address (including IP address and port information) in the message is consistent with the actual communication address of the terminal; if they are consistent, it indicates that the message is indeed sent by a legitimate quantum security terminal, and the terminal matches the key pool mentioned in the request;

[0071] This verification mechanism ensures that only terminals with the correct device identification and communication address can obtain quantum security keys, thereby improving the security of the system.

[0072] If an attacker tries to replay an old message in the network, since the communication address usually changes dynamically, the communication address in the replayed message is likely to be inconsistent with the actual current communication address of the terminal.

[0073] When the key center verifies the communication address, if it finds inconsistency, it will reject the request, thereby effectively preventing network replay attacks.

[0074] This mechanism ensures that even if an attacker intercepts previous communication content, he cannot use it to obtain new key resources.

[0075] Access control combined with device identification: Device identification includes manufacturer information and hardware identification, which provides a unique identity for the terminal.

[0076] The key center further ensures that only authorized terminals can access the system by verifying the device identification. This double verification (communication address and device identification) mechanism greatly enhances the system's access control capabilities.

[0077] After the key distribution is completed, the key center will recycle the resources corresponding to the supplementary quantum key.

[0078] It avoids the reuse of keys and ensures the one-time use principle of keys, thereby improving the security of keys. The resource recycling mechanism also ensures the efficient use of key resources in the key pool and prevents waste of resources.

[0079] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A global quantum secure key distribution method that is resistant to replay attacks, characterized in that: The following steps are involved: The key center verifies whether the device identification of the terminal is legal, and after the verification is passed, establishes a key pool, associates the key pool with the device identification of the terminal, assigns a key pool identification to the key pool, generates a corresponding quantum security key, and synchronizes the quantum security key and key pool identification with the legal terminal; The quantum security key includes a communication protection key and a key protection key; The terminal sends a key distribution request to the key center, carrying the key pool identifier and its own device identifier, wherein the device identifier is quantum encrypted by the key protection key; The key center decrypts and obtains the device identification and verifies it. After the verification is passed, it sends a key distribution response message to the terminal, carrying the communication address corresponding to the terminal. The key distribution response message is encrypted with the communication protection key and sent to the terminal; The terminal receives the key distribution response message from the key center, obtains the communication address after decryption through the key protection key, and constructs a key download request message, which carries the key pool identifier, its own communication address and key index, wherein the communication address and key index are quantum encrypted again using the communication protection key; The key center receives the key download request message from the terminal, determines the corresponding key pool through the key pool identifier, matches the corresponding communication protection key, decrypts the download request message to obtain the terminal communication address and key index; verifies whether the communication address is correct, and after the verification is passed, matches the generated supplementary quantum key based on the key index in the key download request message, and sends the supplementary quantum key to the terminal, wherein the supplementary quantum key is encrypted with the transmission key and sent to the terminal in the form of a file stream; The terminal obtains the encrypted supplementary key, and obtains the real supplementary quantum key after decryption by the key protection key; After the terminal key download is completed, the key center recovers the resources corresponding to the supplementary quantum key.

2. The method according to claim 1, characterized in that: The communication protection key and the key protection key are both quantum true random number keys.

3. The method according to claim 2, characterized in that The communication protection key includes an uplink key and a downlink key.

4. The method according to claim 1, characterized in that: The communication address includes address and port information.

5. The method according to claim 1, characterized in that The device identification includes manufacturer information and hardware identification.

Images