A global quantum-secure key distribution method against replay attacks

Abstract

The present invention relates to the field of information security technology, and in particular to a global quantum security key distribution method that is resistant to replay attacks. The method of the present application verifies the communication address when the key center receives the key distribution request from the terminal, ensuring the legitimacy of the request and the matching of the terminal and the key pool, thereby effectively preventing network replay attacks. At the same time, combined with the access control of the device identification, the device identification is verified to further ensure that only authorized terminals can access the system, realizing a double verification mechanism. After the key distribution is completed, the key center recycles the resources corresponding to the supplementary quantum key, avoiding the reuse of the key, ensuring the one-time use principle of the key, and improving the efficient use of key resources. The present invention improves the key distribution security of the global quantum security network and provides reliable technical support for quantum communication.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a global quantum secure key distribution method that is resistant to replay attacks. Background Art

[0002] In existing global quantum-safe networks, the key distribution process primarily relies on interactions between quantum-safe terminals and a key center. The key center is responsible for generating keys and encryption keys, and then transmitting the encryption keys to the quantum-safe terminals using quantum-safe encryption. After receiving the key distribution response, the quantum-safe terminal uses the encryption key to decrypt the key center information and key index, and then downloads the key from the key center. This key distribution method ensures secure key transmission.

[0003] However, existing technologies present certain security risks. Once an attacker obtains a key index, they can obtain key center information through network messages and attempt to download keys from the key center. Although keys downloaded by illegal quantum security terminals are unusable because they lack the encryption key and cannot decrypt the key, this downloading behavior places a certain burden on the key center. Summary of the Invention

[0004] To solve the above problems, this application discloses a global quantum secure key distribution method that is resistant to replay attacks, comprising the following steps:

[0005] The key center verifies whether the terminal's device identification is legitimate, and if the verification is passed, establishes a key pool, associates the key pool with the terminal's device identification, assigns a key pool identifier to the key pool, generates a corresponding quantum secure key, and synchronizes the quantum secure key and key pool identifier with the legitimate terminal; the quantum secure key includes a communication protection key and a key protection key;

[0006] The terminal sends a key distribution request to the key center, carrying the key pool identifier and its own device identifier, wherein the device identifier is quantum encrypted using the key protection key;

[0007] The key center decrypts and obtains the device identification and verifies it. After the verification is passed, it sends a key distribution response message to the terminal, carrying the communication address corresponding to the terminal. The key distribution response message is encrypted with the communication protection key and sent to the terminal;

[0008] The terminal receives the key distribution response message from the key center, decrypts it using the key protection key to obtain the communication address, and constructs a key download request message that carries the key pool identifier, its own communication address, and key index. The communication address and key index are quantum encrypted again using the communication protection key.

[0009] The key center receives the key download request message from the terminal, determines the corresponding key pool through the key pool identifier, matches the corresponding communication protection key, decrypts the download request message to obtain the terminal communication address and key index; verifies whether the communication address is correct, and after passing the verification, matches the generated supplementary quantum key based on the key index in the key download request message, and sends the supplementary quantum key to the terminal, wherein the supplementary quantum key is encrypted with the transmission key and sent to the terminal in the form of a file stream;

[0010] The terminal obtains the encrypted supplementary key and obtains the real supplementary quantum key after decryption using the key protection key;

[0011] After the terminal key download is completed, the key center recovers the resources corresponding to the supplementary quantum key.

[0012] The communication protection key and the key protection key are both quantum true random number keys.

[0013] The communication protection key includes an uplink key and a downlink key.

[0014] The communication address includes address and port information.

[0015] The device identification includes manufacturer information and hardware identification.

[0016] The method of the present application verifies the communication address when the key center receives the key distribution request from the terminal, ensuring the legitimacy of the request and the matching of the terminal and the key pool, thereby effectively preventing network replay attacks. At the same time, combined with the access control of the device identification, it further ensures that only authorized terminals can access the system by verifying the device identification, realizing a double verification mechanism. After the key distribution is completed, the key center recycles the resources corresponding to the supplementary quantum key, avoiding the reuse of the key, ensuring the one-time use principle of the key, and improving the efficient use of key resources. The present invention improves the key distribution security of the global quantum security network and provides reliable technical support for quantum communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flowchart of the global quantum secure key distribution method that is resistant to replay attacks in an embodiment of the present application. DETAILED DESCRIPTION

[0018] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of this application without making any creative efforts are within the scope of protection of this application.

[0019] Example: Figure 1 As shown, a global quantum secure key distribution method that is resistant to replay attacks includes the following steps:

[0020] S101: The key center verifies whether the device identification of the terminal is legitimate. If the verification is passed, it establishes a key pool, associates the key pool with the device identification of the terminal, assigns a key pool identifier to the key pool, generates a corresponding quantum secure key, and synchronizes the quantum secure key and key pool identifier with the legitimate terminal. The quantum secure key includes a communication protection key and a key protection key.

[0021] The key center establishes a legal device identification library, which stores the device identification information of all authorized terminals. When a terminal attempts to establish a connection, the key center verifies the legitimacy of the device identification it sends to ensure that it exists in the device identification library. After the legitimacy verification is passed, the key center initializes a key pool and assigns it a unique key pool identifier.

[0022] For this key pool, the key center generates a quantum secure key, which is a quantum true random number key, specifically including a communication protection key and a key protection key; wherein the communication protection key includes an uplink key and a downlink key; the quantum true random number key is generated by a quantum true random number generator (QRNG); when specifically encrypted, the XOR method can be used for encryption;

[0023] S102: The terminal sends a key distribution request to the key center, carrying a key pool identifier and its own device identifier, wherein the device identifier is quantum encrypted using the key protection key;

[0024] When a terminal needs a key, it generates a key distribution request, which includes the terminal's device ID and the previously synchronized key pool ID. To protect the security of the device ID, the terminal uses the key protection key to perform quantum encryption on the device ID.

[0025] S103: The key center decrypts and obtains the device identifier and verifies it. If the verification is successful, it sends a key distribution response message to the terminal, carrying the communication address corresponding to the terminal. The key distribution response message is encrypted with the communication protection key and sent to the terminal.

[0026] After receiving the key distribution request, the key center uses the key protection key to decrypt the request and obtain the device identification; it verifies the legitimacy of the device identification again and confirms the correctness of the key pool identification; after the verification is passed, the key center generates a key distribution response message containing the communication address of the terminal; it uses the communication protection key to encrypt the key distribution response message to ensure that only the terminal with the corresponding key can decrypt it;

[0027] S104: The terminal receives the key distribution response message from the key center, decrypts it using the key protection key, obtains the communication address, and constructs a key download request message that carries the key pool identifier, its own communication address, and a key index. The communication address and key index are quantum encrypted again using the communication protection key.

[0028] The terminal receives the key distribution response message from the key center and decrypts it using the communication protection key to obtain the communication address. The terminal constructs a key download request message containing the key pool identifier, its own communication address, and key index. To protect the security of the communication address and key index, the terminal performs quantum encryption on them using the communication protection key.

[0029] S105: The key center receives the key download request message from the terminal, determines the corresponding key pool through the key pool identifier, matches the corresponding communication protection key, decrypts the download request message to obtain the terminal communication address and key index; verifies whether the communication address is correct, and after verification, matches the generated supplementary quantum key based on the key index in the key download request message, and issues the supplementary quantum key to the terminal. The supplementary quantum key is encrypted with the transmission key and sent to the terminal in the form of a file stream;

[0030] The key center receives the key download request message and locates the corresponding key pool through the key pool identifier. It uses the matching communication protection key to decrypt the request message and obtain the terminal communication address and key index. It verifies the correctness of the communication address to ensure the legitimacy of the key download request. Based on the key index, the key center matches the corresponding supplementary quantum key from the key pool and encrypts it using the transmission key. The encrypted supplementary quantum key is sent to the terminal in the form of a file stream.

[0031] S106: The terminal obtains the encrypted supplementary key and obtains the real supplementary quantum key after decryption using the key protection key;

[0032] After receiving the encrypted supplementary key file stream, the terminal uses the key protection key to decrypt it and obtain the real supplementary quantum key;

[0033] S107: After the terminal key download is completed, the key center recovers the resources corresponding to the supplementary quantum key;

[0034] After confirming that the terminal has successfully downloaded the supplementary quantum key, the key center immediately reclaims the resources corresponding to the key to prevent the key from being downloaded repeatedly. Even if the request is legitimate, the key cannot be downloaded using this key index again. Even if the original request is replayed using the original quantum security terminal communication, the key download cannot be disguised.

[0035] The communication address includes address and port information.

[0036] The device identification includes manufacturer information and hardware identification.

[0037] For example, assume that there is a Key Distributor Center (KDC) and a Terminal (T), and keys need to be distributed securely between them.

[0038] S101: The key center initializes the key pool

[0039] Terminal T sends the device identification to the KDC, including the manufacturer information "Manufacturer_X" and the hardware identification "HW456".

[0040] The KDC verifies the validity of "Manufacturer_X_HW456" in its device identification database.

[0041] After verification, the KDC creates a key pool for T and assigns the key pool identifier "KP001".

[0042] The KDC generates a pair of quantum-secure keys: a communication protection key "CK001" and a key protection key "MK001".

[0043] KDC synchronizes "CK001", "MK001" and "KP001" to T through the quantum channel.

[0044] S102: The terminal sends a key distribution request

[0045] T needs a new key and generates a key distribution request containing "KP001" and the device identifier "Manufacturer_X_HW456".

[0046] T uses "MK001" to perform quantum encryption on the device ID "Manufacturer_X_HW456" and obtains the encrypted device ID "Encrypted_Manufacturer_X_HW456".

[0047] T sends a key distribution request to the KDC.

[0048] S103: Key Center Response

[0049] After receiving the request, the KDC uses MK001 to decrypt Encrypted_Manufacturer_X_HW456 and obtains Manufacturer_X_HW456.

[0050] The KDC verifies the validity of "Manufacturer_X_HW456" and passes the verification.

[0051] The KDC generates a key distribution response message that contains T's communication address, including the IP address "192.168.1.100" and port information "8080".

[0052] The KDC uses CK001 to encrypt the key distribution response message and obtains Encrypted_Response.

[0053] KDC sends "Encrypted_Response" to T.

[0054] S104: The terminal constructs a key download request

[0055] T receives "Encrypted_Response" and decrypts it using "CK001" to obtain the communication address "192.168.1.100:8080".

[0056] T constructs a key download request message including "KP001", "192.168.1.100:8080" and key index "Key_Index_001".

[0057] T uses "CK001" to perform quantum encryption on "192.168.1.100:8080" and "Key_Index_001" to obtain "Encrypted_Address" and "Encrypted_Index".

[0058] T sends a key download request to the KDC.

[0059] S105: The key center processes the key download request

[0060] The KDC receives the key download request and locates the corresponding key pool through "KP001".

[0061] The KDC uses CK001 to decrypt Encrypted_Address and Encrypted_Index to obtain 192.168.1.100:8080 and Key_Index_001.

[0062] The KDC verifies the correctness of "192.168.1.100:8080" and passes the verification.

[0063] The KDC matches the supplementary quantum key "Supplementary_QK" from the key pool according to "Key_Index_001".

[0064] The KDC uses the transport key "TK" to encrypt "Supplementary_QK" to obtain "Encrypted_QK".

[0065] KDC sends "Encrypted_QK" to T in the form of a file stream.

[0066] S106: The terminal obtains the supplementary quantum key

[0067] T receives the "Encrypted_QK" file stream, decrypts it using "MK001", and obtains the real supplementary quantum key "Supplementary_QK".

[0068] S107: Key Center Reclaims Resources

[0069] After KDC confirms that T has successfully downloaded "Supplementary_QK", it immediately reclaims the resources corresponding to "Supplementary_QK" to ensure that the key will not be reused.

[0070] In the solution of this embodiment, when the key center receives a key distribution request from a terminal, it verifies whether the communication address (including IP address and port information) in the message is consistent with the actual communication address of the terminal. If they are consistent, it indicates that the message was indeed sent by a legitimate quantum security terminal and that the terminal matches the key pool mentioned in the request.

[0071] This verification mechanism ensures that only terminals with the correct device identification and communication address can obtain quantum security keys, thereby improving the security of the system.

[0072] If an attacker attempts to replay an old message in the network, since the communication address usually changes dynamically, the communication address in the replayed message is likely to be inconsistent with the actual communication address of the terminal.

[0073] When the key center verifies the communication address, if it finds any inconsistency, it will reject the request, thereby effectively preventing network replay attacks.

[0074] This mechanism ensures that even if an attacker intercepts previous communication content, he cannot use it to obtain new key resources.

[0075] Access control combined with device identification: Device identification includes manufacturer information and hardware identification, which provides a unique identity for the terminal.

[0076] The key center further ensures that only authorized terminals can access the system by verifying the device identification. This dual verification (communication address and device identification) mechanism greatly enhances the system's access control capabilities.

[0077] After the key distribution is completed, the key center will reclaim the resources corresponding to the supplementary quantum key.

[0078] This avoids the reuse of keys and ensures the one-time use principle of keys, thereby improving the security of keys. The resource recycling mechanism also ensures the efficient use of key resources in the key pool and prevents resource waste.

[0079] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A global quantum secure key distribution method that is resistant to replay attacks, characterized in that: The following steps are involved: The key center verifies whether the terminal's device identification is legitimate, and if the verification is passed, establishes a key pool, associates the key pool with the terminal's device identification, assigns a key pool identifier to the key pool, generates the corresponding quantum secure key, and synchronizes the quantum secure key and key pool identifier with the legitimate terminal; The quantum security key includes a communication protection key and a key protection key; The terminal sends a key distribution request to the key center, carrying the key pool identifier and its own device identifier, wherein the device identifier is quantum encrypted using the key protection key; The key center decrypts and obtains the device identification and verifies it. After the verification is passed, it sends a key distribution response message to the terminal, carrying the communication address corresponding to the terminal. The key distribution response message is encrypted with the communication protection key and sent to the terminal; The terminal receives the key distribution response message from the key center, decrypts it using the key protection key to obtain the communication address, and constructs a key download request message that carries the key pool identifier, its own communication address, and key index. The communication address and key index are quantum encrypted again using the communication protection key. The key center receives the key download request message from the terminal, determines the corresponding key pool through the key pool identifier, matches the corresponding communication protection key, decrypts the download request message to obtain the terminal communication address and key index; verifies whether the communication address is correct, and after passing the verification, matches the generated supplementary quantum key based on the key index in the key download request message, and sends the supplementary quantum key to the terminal, wherein the supplementary quantum key is encrypted with the transmission key and sent to the terminal in the form of a file stream; The terminal obtains the encrypted supplementary key and obtains the real supplementary quantum key after decryption using the key protection key; After the terminal key download is completed, the key center recovers the resources corresponding to the supplementary quantum key.

2. The method according to claim 1, characterized in that The communication protection key and the key protection key are both quantum true random number keys.

3. The method according to claim 2, characterized in that The communication protection key includes an uplink key and a downlink key.

4. The method according to claim 1, wherein The communication address includes address and port information.

5. The method according to claim 1, wherein The device identification includes manufacturer information and hardware identification.

Images