A global quantum-secure key supplementation method that is resistant to attacks

Abstract

The present invention relates to the field of information security technology, and in particular to an attack-resistant global quantum security key replenishment method. In the solution of the present application, the access base station is responsible for allocating a key center to the quantum security terminal. This allocation mechanism reduces the pressure on a single key center and also reduces the risk of attack, because it is difficult for an attacker to predict which key center the terminal will connect to. When the key center receives a key distribution request, it verifies the device ID of the terminal. This ensures that only terminals with legitimate device IDs can obtain keys, thereby effectively preventing access and key theft by illegal terminals. Illegal terminals cannot forge normal key distribution requests, and because the verification is based on the device ID, even if the quantum security terminal is restarted and re-authenticated after allocation, the key can be replenished normally.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an attack-resistant global quantum security key supplementation method. Background Art

[0002] In existing global quantum-safe networks, key distribution typically involves a quantum security terminal requesting key distribution from an access base station. The access base station selects a key center based on network load and policy and requests key distribution from it. Upon receiving the request, the key center generates the corresponding secret key and encryption key and distributes the encryption key to the quantum security terminal via the access base station. However, this key distribution method presents certain security risks.

[0003] In existing technologies, as long as an attacker can obtain a key index, they can obtain key center information through network messages and repeatedly attempt to find the key center corresponding to the key index, thereby downloading keys from the key center. Although keys downloaded by illegal quantum security terminals are unusable because they lack the encryption key to decrypt them, this download behavior is still a burden on the key center, causing the key center to increase its burden due to useless downloads. Summary of the Invention

[0004] To solve the above problems, this application discloses an attack-resistant global quantum security key supplementation method, comprising the following steps:

[0005] The key center is allocated to the quantum security terminal requesting key allocation through the access base station. The key center establishes a key pool according to the device ID of the quantum security terminal, allocates a pool index PID to the key pool, generates supplementary quantum keys corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates corresponding security keys for the supplementary keys, wherein the security keys include a key encryption key and a key information encryption key;

[0006] The quantum security terminal sends a key distribution request to the key center based on the acquired key center information, carrying the pool index PID and its own device ID, where the device ID is encrypted using the key information encryption key;

[0007] The key center receives the key distribution request from the quantum security terminal, locates the key pool according to the pool index PID, matches the key information encryption key, decrypts to obtain the corresponding device ID, and compares it with the device ID in the key pool. After the verification is passed, the key center sends a key distribution response message to the quantum security terminal, carrying the communication address assigned to the quantum security terminal. The key distribution response message is sent to the quantum security terminal after quantum encryption.

[0008] The quantum security terminal receives the key distribution response message from the key center, decrypts it using the encryption key to obtain the assigned communication address, and then constructs a key download request message. The message carries the pool index P ID, its own communication address, and the key index KID, where the communication address and key index KID are encrypted again using the key information encryption key.

[0009] The key center receives the key download request message from the quantum security terminal, locates the key pool through the pool index P ID, obtains the corresponding decryption key, decrypts the download request message to obtain the quantum security terminal communication address and key index KID; verifies whether the communication address is consistent with the one generated by itself, and after passing the verification, matches the generated supplementary quantum key based on the key index KID in the key download request message, and issues the supplementary quantum key to the quantum security terminal. The supplementary key is encrypted with the key encryption key and sent to the quantum security terminal in the form of a file stream;

[0010] The quantum security terminal obtains the encrypted supplementary key and obtains the real supplementary quantum key after decrypting the encrypted key.

[0011] The key index KID is the hash value of the quantum secure supplementary key file.

[0012] The process of the quantum security terminal obtaining key center information includes:

[0013] The quantum security terminal accesses the quantum security access base station after passing the authentication;

[0014] The quantum security terminal sends a key supplement request carrying the device ID to the access base station. After receiving the request, the access base station selects a key center and sends a key distribution request to the selected key center.

[0015] The key center establishes a key pool according to the terminal device ID, assigns a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key; the pool index PID, key index KID and security key are carried in a key distribution response message and sent to the access base station;

[0016] After receiving the key distribution response message, the access base station sends the security key, key index KID, pool index PID and key center information to the quantum security terminal through the key distribution response message in a quantum secure encryption manner;

[0017] The quantum security terminal receives the key distribution response message, decrypts it, and obtains the key center information, security key, key index KID, and pool index PID;

[0018] The security key includes a key encryption key and a key information encryption key.

[0019] After receiving the request, the access base station provides a key center corresponding to the quantum security terminal based on load balancing and priority.

[0020] The key encryption key and the key information encryption key are both quantum true random number keys.

[0021] In the solution of this application, the access base station is responsible for allocating key centers to quantum security terminals. This allocation mechanism reduces the pressure on a single key center and also reduces the risk of attacks, because it is difficult for attackers to predict which key center the terminal will connect to. When the key center receives a key distribution request, it verifies the device ID of the terminal. This ensures that only terminals with legitimate device IDs can obtain keys, thereby effectively preventing access and key theft by illegal terminals. Illegal terminals cannot forge normal key distribution requests, and because the verification is based on the device ID, even if the quantum security terminal is restarted and re-authenticated after allocation, the key can be replenished normally. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a flow chart of the global quantum security key supplement method in an embodiment of the present application;

[0023] Figure 2 This is a schematic diagram of the process of a quantum security terminal obtaining key center information in an embodiment of the present application. DETAILED DESCRIPTION

[0024] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of this application without making any creative efforts are within the scope of protection of this application.

[0025] Example: Figure 1 As shown, a global quantum security key supplement method that is resistant to attack includes the following steps:

[0026] S101: allocating a key center to a quantum security terminal requesting key allocation through an access base station. The key center establishes a key pool according to the device ID of the quantum security terminal, allocates a pool index PID to the key pool, generates supplementary quantum keys corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates corresponding security keys for the supplementary keys. The security keys include a key encryption key and a key information encryption key.

[0027] The pool index PID assigned by the key pool is unique to prevent confusion between different key pools; the generation of the supplementary quantum key should use a quantum random number generator (QRNG) to ensure the randomness and unpredictability of the key; the key index KID generated for the supplementary quantum key is also unique and forms a mapping relationship with the pool index PID to facilitate fast key retrieval;

[0028] S102: The quantum security terminal sends a key distribution request to the key center based on the acquired key center information, carrying the pool index PID and its own device ID. The device ID is encrypted using the key information encryption key to protect the security of the device ID during transmission.

[0029] S103: The key center receives the key distribution request from the quantum security terminal, locates the key pool according to the pool index P ID, matches the key information encryption key, decrypts the key to obtain the corresponding device ID, and compares it with the device ID in the key pool. After the verification is passed, the key center sends a key distribution response message to the quantum security terminal, carrying the communication address allocated to the quantum security terminal. The key distribution response message is sent to the quantum security terminal after quantum encryption.

[0030] When verifying the device ID, hash comparison or other security verification mechanisms can be used to prevent the device ID from being tampered with;

[0031] The device ID is verified through quantum encryption communication, so illegal terminals cannot forge normal key distribution requests. And the device ID is used for verification, so even if the terminal is restarted and re-authenticated after distribution, the key can be replenished normally;

[0032] S104: The quantum security terminal receives the key distribution response message from the key center, decrypts it using the encryption key, obtains the assigned communication address, and then constructs a key download request message. The message carries the pool index PID, its own communication address, and the key index KID, where the communication address and key index KID are encrypted again using the key information encryption key.

[0033] S105: The key center receives the key download request message from the quantum security terminal, locates the key pool through the pool index P ID, obtains the corresponding decryption key, decrypts the download request message to obtain the quantum security terminal communication address and key index KID; verifies whether the communication address is consistent with the one generated by itself, and after passing the verification, matches the generated supplementary quantum key based on the key index KID in the key download request message, and issues the supplementary quantum key to the quantum security terminal, wherein the supplementary key is encrypted with the key encryption key and sent to the quantum security terminal in the form of a file stream;

[0034] S106: The quantum security terminal obtains the encrypted supplementary key and obtains the real supplementary quantum key after decrypting the encrypted key.

[0035] For example, assume there is a quantum security terminal with a device ID of “QTerm12345”;

[0036] The key center establishes a key pool for the terminal, assuming that the pool index P ID is "Poo l#001";

[0037] The key center generates four supplementary quantum keys, namely "QKey1", "QKey2", "QKey3", and "QKey4", and the corresponding key indexes KID are "KID001", "KID002", "KID003", and "KID004" respectively;

[0038] For each supplementary quantum key, a transmission key "TransKey1-4" and a key information encryption key "EncKey1-4" are generated;

[0039] By establishing a device-specific key pool, key management becomes more targeted.

[0040] The quantum security terminal "QTerm12345" sends a key distribution request to the key center, carrying "Pool#001" and the encrypted device ID;

[0041] Enhanced security of key requests by encrypting the device ID;

[0042] After receiving the request, the key center finds the key pool through "Pool#001", uses "EncKey1-4" to decrypt the device ID, and after verification, sends a quantum encrypted key distribution response message carrying the assigned communication address "CommAddr#QTerm12345";

[0043] The quantum security terminal decrypts the response message, obtains "CommAddr#QTerm12345", and constructs a key download request message carrying "Pool#001", "CommAddr#QTerm12345" and the encrypted "KID001-004";

[0044] The key center receives the request, verifies the communication address, matches "KID001", and issues the encrypted "QKey1";

[0045] The quantum security terminal decrypts the file stream and obtains "QKey1".

[0046] The key index KID is the hash value of the quantum-safe supplementary key file. The device DID is verified through quantum cryptography communication, and the key index KID is used as the hash value of the quantum-safe supplementary key file to ensure that unauthorized terminals cannot forge legitimate key distribution requests.

[0047] like Figure 2 As shown, the process of the quantum security terminal obtaining key center information includes:

[0048] S201: The quantum security terminal accesses the quantum security access base station after passing the authentication;

[0049] The quantum security terminal can use its unique device ID to authenticate with the quantum security access base station. After the authentication is passed, a secure quantum communication session is established. Authentication ensures that only legitimate terminals can access the network, ensuring network security.

[0050] S202: The quantum security terminal sends a key supplement request carrying the device ID to the access base station. After receiving the request, the access base station selects a key center and sends a key distribution request to the selected key center.

[0051] In one possible implementation, the quantum security terminal generates a key replenishment request containing a device ID and a timestamp, signs the request with the terminal's private key to ensure its integrity and authenticity, and then sends the request to the access base station. The combination of the device ID and timestamp prevents replay attacks, and the signature ensures the authenticity of the request.

[0052] S203: The key center establishes a key pool according to the terminal device ID, assigns a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key; the pool index PID, key index KID and security key are carried in a key distribution response message and sent to the access base station;

[0053] The key center verifies the validity of the terminal device ID and creates a key pool for the terminal, which contains multiple quantum keys. It generates a unique key index KID for each quantum key. It uses the quantum key to generate security keys, including key encryption keys and key information encryption keys. It packages all this information in a key distribution response message.

[0054] The randomness and unpredictability of quantum keys ensure key security, while the key pool and multi-index mechanism improve the flexibility of key management and the ability to replace keys;

[0055] S204: After receiving the key distribution response message, the access base station sends the security key, key index KID, pool index PID and key center information to the quantum security terminal through the key distribution response message in a quantum secure encryption manner;

[0056] The access base station verifies the integrity of the key distribution response message, encrypts the key information using quantum-safe encryption, and sends the encrypted information to the quantum-safe terminal. Quantum-safe encryption utilizes the absolute security of quantum keys to ensure the security of key information during transmission.

[0057] S205: The quantum security terminal receives the key distribution response message, decrypts it, and obtains the key center information, security key, key index KID, and pool index P ID. The security key includes a key encryption key and a key information encryption key.

[0058] The quantum security terminal receives the key distribution response message and decrypts it using the pre-shared quantum key to verify the integrity and authenticity of the message, and stores the key center information, security key, key index KID and pool index PID. The quantum security terminal's processing of key information ensures the confidentiality and integrity of the key.

[0059] After receiving the request, the access base station provides a key center corresponding to the quantum security terminal based on load balancing and priority.

[0060] In the specific scheme, after receiving the key supplement request from the quantum security terminal, the access base station first checks the load status in the current system;

[0061] Select a key center with lower load based on the preset load balancing algorithm (such as polling, least connections, hashing, etc.);

[0062] At the same time, the priority of the terminal is taken into consideration (which may be based on the terminal type, service level agreement SLA, etc.). If the terminal has a higher priority, a specific or higher priority key center may be selected;

[0063] Record the selected key center information in the log of the access base station for subsequent management and auditing;

[0064] Load balancing ensures that the resources of the key center are reasonably allocated to avoid overloading of a single key center. At the same time, the priority mechanism ensures that key businesses can receive timely responses.

[0065] The key encryption key and key information encryption key are both quantum true random number keys. The process specifically includes: the key center uses a quantum random number generator (QRNG) to generate a set of quantum true random number keys;

[0066] The generated quantum true random number key is divided into two parts: one part is used for the key encryption key (KEK), and the other part is used for the key information encryption key (IEK);

[0067] This ensures that the generated quantum true random number key meets security requirements, such as sufficient randomness and length.

[0068] Quantum true random number keys are generated based on quantum physics phenomena. Their randomness and unpredictability are far higher than traditional pseudo-random numbers, and therefore can provide higher security.

[0069] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A global quantum security key supplementation method that is resistant to attack, characterized in that: The following steps are involved: The key center is allocated to the quantum security terminal requesting key allocation through the access base station. The key center establishes a key pool according to the device ID of the quantum security terminal, allocates a pool index PID to the key pool, generates supplementary quantum keys corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates corresponding security keys for the supplementary keys, wherein the security keys include a key encryption key and a key information encryption key; The quantum security terminal sends a key distribution request to the key center based on the acquired key center information, carrying the pool index PID and its own device ID, where the device ID is encrypted using the key information encryption key; The key center receives the key distribution request from the quantum security terminal, locates the key pool according to the pool index PID, matches the key information encryption key, decrypts to obtain the corresponding device ID, and compares it with the device ID in the key pool. After the verification is passed, the key center sends a key distribution response message to the quantum security terminal, carrying the communication address assigned to the quantum security terminal. The key distribution response message is sent to the quantum security terminal after quantum encryption. The quantum security terminal receives the key distribution response message from the key center, decrypts it using the encryption key to obtain the assigned communication address, and then constructs a key download request message. The message carries the pool index PID, its own communication address, and the key index KID, where the communication address and key index KID are encrypted again using the key information encryption key. The key center receives the key download request message from the quantum security terminal, locates the key pool through the pool index PID, obtains the corresponding decryption key, decrypts the download request message to obtain the quantum security terminal communication address and key index KID; verifies whether the communication address is consistent with the one generated by itself, and after passing the verification, matches the generated supplementary quantum key based on the key index KID in the key download request message, and issues the supplementary quantum key to the quantum security terminal. The supplementary key is encrypted with the key encryption key and sent to the quantum security terminal in the form of a file stream; The quantum security terminal obtains the encrypted supplementary key and obtains the real supplementary quantum key after decrypting the encrypted key.

2. The method according to claim 1, characterized in that The key index KID is the hash value of the quantum secure supplementary key file.

3. The method according to claim 1, characterized in that The process of the quantum security terminal obtaining key center information includes: The quantum security terminal accesses the quantum security access base station after passing the authentication and authorization; The quantum security terminal sends a key supplement request carrying the device ID to the access base station. After receiving the request, the access base station selects a key center and sends a key distribution request to the selected key center. The key center establishes a key pool according to the terminal device ID, assigns a pool index PID to the key pool, generates a supplementary quantum key corresponding to the key pool, generates a key index KID for each supplementary quantum key, and then generates a corresponding security key for the supplementary key; the pool index PID, key index KID and security key are carried in a key distribution response message and sent to the access base station; After receiving the key distribution response message, the access base station sends the security key, key index KID, pool index PID and key center information to the quantum security terminal through the key distribution response message in a quantum secure encryption manner; The quantum security terminal receives the key distribution response message, decrypts it, and obtains the key center information, security key, key index KID, and pool index PID; The security key includes a key encryption key and a key information encryption key.

4. The method according to claim 3, characterized in that After receiving the request, the access base station provides a key center corresponding to the quantum security terminal based on load balancing and priority.

5. The method according to claim 1, wherein The key encryption key and the key information encryption key are both quantum true random number keys.

Images