Quantum key management and distribution method for full-link quantum security

Abstract

The embodiment of the invention provides a quantum key management and distribution method for full-link quantum security, and the method comprises the steps that a first agent platform sends a first key request to a management and control platform, and receives a target quantum key and a unique identifier; the first agent platform sends the unique identifier to a second agent platform, so that the second agent platform obtains the target quantum key from the management and control platform; the first proxy platform receives a second key request of the first device, and sends the target quantum key and the unique identifier to the first device, so that the first device sends the unique identifier to a second device; and the second device sends a request including the unique identifier to the second agent platform to obtain the target quantum key. Therefore, the first equipment and the second equipment communicate by using the target quantum key; a transmission channel of the unique identifier and each key request is a post-quantum secure virtual private network tunnel. Therefore, full-link protection in the quantum key management and distribution process can be realized, and the quantum security protection capability of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of quantum cryptography and network security technology, and in particular to a full-link quantum secure quantum key management and distribution method. Background Art

[0002] With the rapid development of quantum computing technology, traditional cryptographic systems are facing unprecedented challenges. Existing key management and distribution systems have many shortcomings, including the vulnerability of traditional public key infrastructure to quantum computing attacks, limitations of key distribution systems, lack of full-link protection, inefficient key synchronization and distribution, and insufficient auditing and credibility.

[0003] Therefore, it is urgent to propose a quantum key management and distribution method with full-link protection. Summary of the invention

[0004] The present application provides a full-link quantum-secure quantum key management and distribution method and a computer storage medium, which can achieve full-link protection of the quantum key management and distribution process, thereby improving the quantum security protection capability of the system.

[0005] In a first aspect, the present application provides a full-link quantum-secure quantum key management and distribution method, the method comprising: a first proxy platform sends a first key request to a control platform, and receives a returned target quantum key and a corresponding unique identifier; the target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm; the first proxy platform sends the unique identifier to a second proxy platform, and the second proxy platform obtains the target quantum key from the control platform according to the unique identifier; the first proxy platform and the second proxy platform are located in a first and a second scope, respectively; the first proxy platform receives a second key request from a first device within the first scope, and sends the target quantum key and the unique identifier to the first device; so that the first device sends the unique identifier to the second device within the second scope; the second proxy platform responds to the request containing the unique identifier sent by the second device, and sends the target quantum key to the second device, so that the first device and the second device communicate using the target quantum key; the transmission channel of the unique identifier, the first and second key requests is a post-quantum-secure virtual private network tunnel.

[0006] In this way, full-link protection of the quantum key management and distribution process can be achieved, thereby improving the system's quantum security protection capabilities.

[0007] In a possible implementation, the first proxy platform sends a first key request to the control platform, and receives a returned target quantum key and a corresponding unique identifier, including: the first proxy platform sends a first key request including a target quantity to the control platform, and receives a returned target quantity of quantum keys and their respective corresponding unique identifiers; the first proxy platform randomly selects from the target quantity of quantum keys and their respective corresponding unique identifiers to obtain the target quantum key and the corresponding unique identifier.

[0008] In a possible implementation, the first proxy platform sends a first key request including a target quantity to the control platform, and receives the returned target quantity of quantum keys and their corresponding unique identifiers, including: periodically comparing the current key cache quantity of the first proxy platform with a preset threshold value according to a preset time period; when the current key cache quantity is less than the preset threshold value, obtaining the target quantity according to the current key cache quantity, the historical key usage quantity of the first proxy platform, the maximum key cache quantity, and the current network status factor of the first scope; sending the first key request including the target quantity to the control platform; receiving the returned target quantity of quantum keys and their corresponding unique identifiers, and saving them in the cache of the first proxy platform; checking the current network status of the first proxy platform; and positively adjusting the preset threshold value according to the current network status.

[0009] In a possible implementation, the worse the current network state of the first scope is, the larger the current network state factor is, and the larger the number of targets is.

[0010] In a possible implementation, the formula for calculating the target quantity includes:

[0011] Among them, R is the target number, U is the number of historical key usages, and C max is the maximum number of key caches, C current is the current number of key caches, N status is the current network status factor, α, β, γ are weight coefficients, and the relationship between the weight coefficients is: α+β+γ=1.

[0012] In a possible implementation manner, after sending the target quantum key and the unique identifier to the first device, the method further includes: deleting the target quantum key and the corresponding unique identifier from a cache.

[0013] In a possible implementation, before sending the first key request to the management and control platform, it also includes: the first proxy platform sends a registration and authentication request to the management and control platform, and obtains a returned registration and authentication feedback message; if the result of the registration and authentication feedback message is a failure message, then after updating the registration and authentication request, the updated registration and authentication request is sent to the management and control platform again until the result of the registration and authentication feedback message is a success message.

[0014] In one possible implementation, the method also includes: writing a kernel task module in the operating system kernel of the first agent platform for collecting the unique identifier and the corresponding data of the first and second key requests; setting access permissions for the hardware and software that receive and send the corresponding data in the operating system kernel; and opening access permissions for the kernel task module so that the kernel task module collects the corresponding data by accessing the hardware and software, and generates an audit log based on the corresponding data.

[0015] In the second aspect, the present application provides a full-link quantum-secure quantum key management and distribution method, which is applied to a first agent platform, and the first agent platform is the initiator of the quantum key management and distribution process. The method includes: sending a first key request to a control platform, and receiving a returned target quantum key and a corresponding unique identifier; the target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm; the unique identifier is sent to a second agent platform, so that the second agent platform obtains the target quantum key from the control platform according to the unique identifier; the first agent platform and the second agent platform are respectively located in a first and a second scope; in response to receiving a second key request from a first device within the corresponding scope of the first agent platform, the target quantum key is sent to the first device; the target quantum key is used for communication between the first device and the second device within the corresponding scope of the second agent platform; the transmission channel of the unique identifier, the first and second key requests is a post-quantum-secure virtual private network tunnel.

[0016] In the third aspect, the present application provides a full-link quantum-secure quantum key management and distribution method, which is applied to a second proxy platform, and the second proxy platform is a responder in the target quantum key management and distribution process. The method includes: receiving a unique identifier sent by a first proxy platform; the first proxy platform is used to obtain the target quantum key and the corresponding unique identifier from the control platform, and then send the target quantum key to the first device within the corresponding scope of the first proxy platform; the target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm; the first proxy platform and the second proxy platform are located in different scopes; a third key request including a unique identifier is sent to the control platform, and the returned target quantum key is received; in response to receiving a fourth key request from the second device within the corresponding scope of the second proxy platform, the target quantum key is sent to the second device; the target quantum key is used for communication between the first device and the second device; the unique identifier, the transmission channel of the third and fourth key requests is a post-quantum-secure virtual private network tunnel.

[0017] In a fourth aspect, the present application provides a computer storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the method described in the first aspect or any possible implementation of the first aspect.

[0018] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 An architecture diagram of a full-link quantum-secure quantum key management and distribution system provided in an embodiment of the present application;

[0021] Figure 2 A design diagram of an interface for a full-link quantum-secure quantum key management and distribution system provided in an embodiment of the present application;

[0022] Figure 3 A flow chart of a full-link quantum-secure quantum key management and distribution method provided in an embodiment of the present application;

[0023] Figure 4 A schematic diagram of a dynamic key pre-caching process provided in an embodiment of the present application;

[0024] Figure 5 A flow chart of a full-link quantum-secure quantum key management and distribution method provided in an embodiment of the present application;

[0025] Figure 6 A flow chart of a full-link quantum-secure quantum key management and distribution method provided in an embodiment of the present application;

[0026] Figure 7 A flow chart of a full-link quantum-secure quantum key management and distribution method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] The following is an introduction to the relevant technologies involved in this application:

[0029] 1. Quantum random number generator (QRNG): A device that uses quantum physics processes to generate true random numbers.

[0030] 2. Key derivation function (KDF): A cryptographic algorithm used to derive multiple sub-keys from a master key material.

[0031] 3. Post-quantum cryptography (PQC) algorithm: a cryptographic algorithm that can resist attacks by quantum computers.

[0032] 4. Implicit identity authentication: Complete authentication without directly exchanging identity information, enhancing the privacy protection of both communicating parties.

[0033] 5. Representational state transfer (REST) ​​interface: An application programming interface (API) built on REST principles that allows different software systems to communicate with each other.

[0034] 6. Post-quantum wireguard (PQ-WireGuard): A post-quantum secure version of the Wireguard protocol. The WireGuard protocol is an open source, high-performance virtual private network (VPN) protocol.

[0035] 7. Internet protocol security (IPSec), transport layer security (TLS): network layer and transport layer security protocols respectively.

[0036] 8. Auditing function: refers to the function of recording and checking system operations to enhance system credibility and security.

[0037] With the rapid development of quantum computing technology, traditional cryptographic systems are facing unprecedented challenges. Existing key management and distribution systems have many shortcomings, including the vulnerability of traditional public key infrastructure to quantum computing attacks, limitations of key distribution systems, lack of full-link protection, inefficient key synchronization and distribution, and insufficient auditing and credibility.

[0038] In view of the above shortcomings, this solution builds a distributed quantum key management and distribution architecture, including using the control platform to manage and distribute quantum keys to the first agent platform and the second agent platform in different scopes, and using the first agent platform and the second agent platform to manage and distribute keys to the devices in their respective scopes, thereby ultimately realizing the quantum key management and distribution of the devices by the control platform, so that

[0039] Devices in each domain use quantum keys for quantum secure communication, which can improve the efficiency of quantum key management and distribution, as well as enhance the flexibility and scalability of the system.

[0040] Based on this, this solution also uses post-quantum secure virtual private network tunnel technology to transmit messages related to quantum key management and distribution between the control platform and the first agent platform, the second agent platform, between the first agent platform, the second agent platform, and between the first agent platform, the second agent platform and the devices in their respective scopes, and between the devices in their respective scopes, so that the entire link meets the requirements of resisting quantum computing attacks, thereby improving the system's quantum security protection capabilities.

[0041] For example, Figure 1 The figure shows an architecture diagram of a full-link quantum-secure quantum key management and distribution system provided by an embodiment of the present application.

[0042] like Figure 1 As shown, the full-link quantum-secure quantum key management and distribution system includes the following modules: a management and control platform 110, a first agent platform 120, a second agent platform 130, a first device (A) 140, a first device (B) 150, a second device (A) 160 and a second device (B) 170.

[0043] Among them, the control platform 110, the first agent platform 120 and the second agent platform 130 can be embodied as any computing unit, server, device, device cluster, etc. with computing and processing capabilities. The first device (A) 140, the first device (B) 150, the second device (A) 160 and the second device (B) 170 can be communication terminals that use quantum keys for secure data transmission, such as quantum security service mobile engines, quantum security U shields, etc.

[0044] Specifically, the control platform 110 is the core of the entire system, used to generate quantum-secure quantum keys using post-quantum key algorithms, and is responsible for the storage, distribution and management of quantum keys.

[0045] The first proxy platform 120 and the second proxy platform 130 are respectively an intermediate entity. They are located in different scopes, such as the first and second scopes, and are used to cooperate with the control platform 110 to implement distributed quantum key management and distribution for devices 140-170. Specifically, it includes interacting with the control platform 110 to obtain quantum keys and providing key services for devices 140-170. The above different scopes can be different geographical areas, network areas, business areas, security areas or functional areas, etc.

[0046] With respect to the control platform 110 , the first agent platform 120 is the initiator of the quantum key management and distribution process, and the second agent platform 130 is the responder of the quantum key management and distribution process.

[0047] The first device (A) 140 and the first device (B) 150 are devices within the scope of the first agent platform 120 , and the second device (A) 160 and the second device (B) 170 are devices within the scope of the second agent platform 130 .

[0048] exist Figure 1 In the architecture shown, the system's process for quantum key management and distribution includes:

[0049] Step 1, complete the preparation tasks for the quantum key management and distribution process, including enabling the first agent platform 120 and the second agent platform 130 to complete the registration and authentication on the control platform 110 respectively, so as to establish a trusted connection with the control platform 110.

[0050] Step 2: As the initiator of the quantum key management and distribution process, the first agent platform 120 sends a key request to the control platform 110, and the control platform 110 generates and distributes a key and a corresponding unique identifier to the first agent platform 120. The key distributed by the control platform 110 is a pre-generated quantum key.

[0051] Step 3: As the responder of the quantum key management and distribution process, the second agent platform 130 and the first agent platform 120 complete the exchange of the unique identifier corresponding to the key.

[0052] In step 4, the second proxy platform 130 obtains the quantum key from the management and control platform 110 according to the unique identifier corresponding to the key.

[0053] In step 5, the first agent platform 120 distributes the acquired key to the first device (A) 140 or the first device (B) 150, for example, the first device (A) 140.

[0054] In step 6, the first device (A) 140 completes the exchange of the unique identifier corresponding to the quantum key with the second device (A) 160 or the second device (B) 170, for example, the second device (A) 160.

[0055] In step 7, the second proxy platform 130 distributes the acquired key to the second device (A) 160 or the second device (B) 170 , for example, the second device (A) 160 .

[0056] In step 8, a quantum secure communication link is established between the first device (A) 140 and the second device (A) 160, and the distributed key is used for encrypted communication.

[0057] Before performing each message interaction in the above steps 1-7, a post-quantum secure virtual private network tunnel is established between the control platform 110 and the first agent platform 120 / the second agent platform 130, or the first agent platform 120 and the second agent platform 130, or the first agent platform 120 and the first device (A) 140 / the first device (B) 150, or the second agent platform 130 and the second device (A) 160 / the first device (A) 170, or the first device (A) 140 and the second device (A) 160 for each message exchange.

[0058] And during the process of each message interaction in the above steps 1-7, the management and control platform 110, the first agent platform 120 and the second agent platform 130 also implement audit operations such as security audit and reliability audit of each message interaction process, and provide complete and accurate audit logs to ensure the security, compliance, performance and reliability of the system.

[0059] Therefore, in the above steps 1-7, by using the post-quantum key algorithm to generate a quantum-secure quantum key, and using the post-quantum-secure virtual private network tunnel to transmit messages such as the unique identifier corresponding to the key, key requests and their replies, full-link protected quantum key management and distribution can be achieved.

[0060] In addition, by using the first agent platform 120 and the second agent platform 130 to cooperate with the control platform 110, the quantum key management and distribution of the devices 140-170 can be distributed, which can realize the decoupling of the control platform 110 and the devices 140-170, thereby reducing the direct communication burden of the control platform 110 and improving the key distribution efficiency. It can also provide better flexibility and scalability, so that the system can adapt to the ever-changing security requirements and the expansion of the network scale.

[0061] For example, Figure 2 A full-link quantum-secure quantum key management and distribution system interface design diagram provided in an embodiment of the present application is shown.

[0062] Combination Figure 1 The architecture diagram shown in Figure 2As shown in the figure, this figure shows the main REST API interface design in the system and the possible related parameters of each interface:

[0063] 1.QKMP_API: API provided by the management and control platform 110,

[0064] -register(agentInfo): agent platform registration,

[0065] -authenticate(credentials): proxy platform authentication,

[0066] -requestKey(agentID): request a new quantum key,

[0067] -requestSpecificKey(agentID, keyID): request the corresponding quantum key according to the specific unique identifier,

[0068] -revokeKey(keyID): revoke a specific quantum key,

[0069] -auditKeyUsage(timeRange): audit key usage,

[0070] 2.Agent-API: API provided by the first agent platform 120 / the second agent platform 130 to other agent platforms and devices 140-150 / 160-170,

[0071] -notifyKeyID(fromAgentID, toAgentID, keyID): Notify other agent platforms of the unique identifier corresponding to the quantum key.

[0072] -getKey(agentID, deviceID): Provides the quantum key for the device,

[0073] -requestSpecificKeyForDevice(agentID, deviceID, keyID): Requests a quantum key corresponding to a specific unique identifier for a communication device.

[0074] 3.DataDevice-API: API provided by devices 140-170,

[0075] -sendKeyID(fromDeviceID, toDeviceID, keyID): Send the unique identifier corresponding to the quantum key to other devices,

[0076] -establishSecureComm(deviceAID, deviceBID, keyID): establish secure communication between devices,

[0077] These API interfaces implement quantum-safe IPSec / TLS channels by adopting the PQ-WireGuard secure communication protocol to ensure the security and reliability of the entire system. The PQ-WireGuard protocol combines the two PQC algorithms, Kyber and ClassicMcEliece, to provide the system with a post-quantum secure virtual private network tunnel. Under this framework, RESTAPI, as a communication protocol that provides efficient data exchange capabilities, works in conjunction with the PQ-WireGuard protocol to ensure efficient and secure data transmission in a quantum-safe environment.

[0078] Based on the above content, the quantum key management and distribution method for full-link quantum security is described in detail.

[0079] For example, Figure 3 A flowchart of a full-link quantum-secure quantum key management and distribution method provided by an embodiment of the present application is shown in FIG. Figure 3 As shown, the method mainly includes the following steps:

[0080] Step S301: The first proxy platform sends a first key request to the control platform, and receives a returned target quantum key and a corresponding unique identifier. The target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm.

[0081] For example, in Figure 1 In the control platform 110 shown, QRNG is used to measure the random collapse of quantum states to obtain true random numbers. Then, the true random numbers are received as inputs by KDF to generate multiple security keys. These security keys are then processed using a post-quantum key algorithm to obtain and store quantum keys that can resist quantum computing attacks.

[0082] Further, a post-quantum secure virtual private network tunnel is established between the control platform 110 and the first agent platform 120, and between the control platform 110 and the second agent platform 130, to transmit interactive information related to quantum key management and distribution. It can be understood that in the following scheme, a post-quantum secure virtual private network tunnel will also be pre-established between the two entities that transmit interactive messages, which will not be repeated.

[0083] Among them, the process of establishing a post-quantum secure virtual private network tunnel includes: generating a post-quantum key using a post-quantum key generation algorithm, securely distributing the post-quantum key between two entities, and combining the distributed post-quantum key with the IPSec / TLS protocol to provide a post-quantum secure virtual private network tunnel.

[0084] The first proxy platform 120 is the initiator of the target quantum key management and distribution process. Before sending the first key request to the control platform, the first proxy platform 120 sends a registration and authentication request to the control platform 110 and obtains a returned registration and authentication feedback message.

[0085] If the result of the registration and authentication feedback message is a failure message, after updating the registration and authentication request, the updated registration and authentication request will be sent to the management and control platform again until the result of the registration and authentication feedback message is a success message.

[0086] In one implementation, using Figure 2 The REST API provided by the management and control platform 110: register(agentInfo) completes the registration of the first agent platform 120, and authenticate(credentials) completes the authentication of the first agent platform 120. Among them, the parameter "agentInfo" includes the registration information provided by the first agent platform 120, such as the account number and password, and the parameter "credentials" includes the authentication information provided by the first agent platform 120, such as the authentication certificate.

[0087] If the result of the registration and authentication feedback message returned by the management and control platform 110 is a failure message, the information in the parameters “agentInfo” and “credentials” is modified until the first agent platform 120 completes registration and authentication on the management and control platform 110 .

[0088] Optionally, the first agent platform 120 uses implicit identity authentication technology to collect information such as the user's touch screen behavior and movement pattern to obtain "agentInfo" and "credentials" parameter information, and then provides the obtained parameter information to the management and control platform 110 for registration and authentication, which can further enhance the security and accuracy of identity authentication.

[0089] As the initiator of the quantum key management and distribution process, after receiving the successful registration and authentication feedback message sent by the control platform 110, the first agent platform 120 sends a first key request to the control platform and receives the returned target quantum key and the corresponding unique identifier.

[0090] In one implementation, using Figure 2The REST API provided by the control platform 110: requestKey(agentID) sends a first key request to the control platform 110, and receives the target quantum key and the corresponding unique identifier returned by the control platform 110. The parameter "agentID" is the unique identifier of the first agent platform 120 in the system.

[0091] In addition, the first proxy platform 120 can also implement a dynamic key pre-caching mechanism, send a first key request including a target number to the management and control platform, receive the target number of quantum keys and their corresponding unique identifiers at one time, and store them in the cache of the first proxy platform 120.

[0092] When distributing quantum keys to devices within the scope of the first proxy platform 120, the target quantum key and the corresponding unique identifier are directly obtained from the target number of quantum keys and their corresponding unique identifiers in the cache, thereby improving the response rate of the system for managing and distributing quantum keys.

[0093] Optionally, a target quantum key and a corresponding unique identifier are obtained by randomly selecting from a target number of quantum keys and their corresponding unique identifiers.

[0094] Alternatively, the target number of quantum keys are sorted according to their generation time, and the most time-sensitive quantum key is used as the target quantum key.

[0095] Step S302: The first proxy platform sends the unique identifier to the second proxy platform, and the second proxy platform obtains the target quantum key from the control platform according to the unique identifier. The first proxy platform and the second proxy platform are located in the first and second scopes, respectively.

[0096] For example, Figure 1 The second proxy platform 130 is an intermediate entity located in a different scope from the first proxy platform 120. The first proxy platform 120 is located in the first scope, and the second proxy platform 130 is located in the second scope. The second proxy platform 130 is the responder of the target quantum key management and distribution process. The first proxy platform 120 and the second proxy platform 130 are used to cooperate with the control platform 110 to implement distributed quantum key management and distribution for devices 140-170.

[0097] The first proxy platform 120 sends the unique identifier corresponding to the target quantum key to the second proxy platform 130, and the second proxy platform 130 sends a key request message including the unique identifier to the management and control platform 110, thereby obtaining the target quantum key.

[0098] It can be understood that before the second agent platform 130 sends the key request message including the unique identifier to the management and control platform 110 , it also adopts the method described in step S301 to register and authenticate with the management and control platform 110 .

[0099] In one implementation, the first agent platform 120 utilizes Figure 2 The REST API provided by the agent platform: notifyKeyID(fromAgentID, toAgent ID, keyID) sends a unique identifier to the second agent platform 130, the parameter "fromAgentID" is the first agent platform 120, the parameter "toAgentID" is the second agent platform 130, and the parameter "keyID" is the unique identifier of the target quantum key.

[0100] Step S303: The first proxy platform receives a second key request from a first device within the first scope, and sends a target quantum key and a unique identifier to the first device, so that the first device sends the unique identifier to a second device within the second scope.

[0101] Exemplarily, the first device may be Figure 1 The first device (A) 140 or the first device (B) 150 shown in FIG. These devices are within the first scope corresponding to the first agent platform 120, and therefore the first agent platform 120 manages and distributes quantum keys for them.

[0102] In response to receiving the second key request from the first device, the first proxy platform 120 sends the target quantum key and the corresponding unique identifier to the first device, so that the first device sends the corresponding unique identifier to the second device within the corresponding scope of the second proxy platform 130. The second device is a peer communication party with the first device, and is the target object for the first device to perform secure data transmission.

[0103] In one implementation, the first device uses Figure 2 The REST API provided by the agent platform: getKey(agentID, deviceID) sends a second key request to the first agent platform 120, the parameter "agentID" is the first agent platform 120, and the parameter "deviceID" is the first device.

[0104] In one implementation, the first device uses Figure 2The REST API provided by the device platform: sendKeyID(fromDeviceID, toDeviceID, keyID) sends the unique identifier of the target quantum key to the second device. The parameter "fromDeviceID" is the first device, the parameter "toDeviceID" is the second device, and the parameter "keyID" is the unique identifier of the target quantum key.

[0105] The second device may be Figure 1 The second device (A) 160 or the second device (B) 170 shown in the figure are within the second scope corresponding to the second agent platform 130, and therefore quantum keys are managed and distributed on them by the second agent platform 130.

[0106] Step S304: In response to the request containing the unique identifier sent by the second device, the second proxy platform sends the target quantum key to the second device, so that the first device and the second device communicate using the target quantum key. The transmission channel of the unique identifier, the first and second key requests is a post-quantum secure virtual private network tunnel.

[0107] Exemplarily, after receiving the corresponding unique identifier sent by the first device, the second device sends a key request including the corresponding unique identifier to the second proxy platform 130 to obtain the target quantum key corresponding to the unique identifier.

[0108] In one implementation, the second device utilizes Figure 2 The REST API provided by the agent platform: requestSpecificKeyForDevice(agentID, deviceID, keyID) sends a key request to the second agent platform 130, the parameter "agentID" is the second agent platform 130, the parameter "deviceID" is the second device, and the parameter "keyID" is the unique identifier of the target quantum key.

[0109] At this point, the first device and the second agent can perform secure data communication based on the target quantum key.

[0110] In one implementation, the first device uses Figure 2 The REST API provided by the device platform: establishSecureComm(deviceAID, deviceBID, keyID) initiates a connection request to the second device. The parameter "deviceAID" is the first device, the parameter "deviceID" is the second device, and the parameter "keyID" is the unique identifier of the target quantum key.

[0111] Optionally, the first proxy platform 120 further sets a one-time use principle, and after sending the target quantum key to the first device, deletes the target quantum key and the corresponding unique identifier from the cache, thereby improving the security of the system.

[0112] Optionally, the first proxy platform 120 also generates an audit log for the unique identifier and the sending operation of the first and second key requests, which can further improve the security of the system.

[0113] In one implementation, a kernel task module is written in the operating system kernel of the first agent platform 120 to collect the unique identifier and the corresponding data of the first and second key requests; access rights are set in the operating system kernel for the hardware and software that receive and send the above-mentioned corresponding data; the above-mentioned access rights are enabled for the kernel task module so that the kernel task module collects the corresponding data by accessing the hardware and software, and generates an audit log based on the corresponding data.

[0114] Specifically, the kernel task module runs in the kernel space and has the ability to directly access the hardware and operating system internal data. Set access permissions for the hardware and software that receive and send the above corresponding data in the operating system kernel. This can be achieved by using the permission control mechanism provided by the kernel, such as capabilities in the Linux kernel, or using security policies (such as SELinux or AppArmor). Open access permissions for the kernel task module so that the kernel task module collects the above corresponding data by accessing the hardware and software, and generates audit logs based on the above corresponding data. This can be achieved by using appropriate system calls in the kernel task module, such as using cap-set-proc to set the capabilities of the process. The kernel task module should generate audit logs while collecting data. This can be achieved using the audit framework provided by the kernel, such as the Linux auditd service.

[0115] It is understandable that similar audit functions can also be implemented in the management and control platform 110 and the second agent platform 130 to ensure the security, compliance, performance and reliability of the system.

[0116] Exemplarily, the audit operation of the control platform 110 generates an audit log for each key operation in the process of quantum key management and distribution, including but not limited to:

[0117] -Agency platform registration and certification,

[0118] -Quantum key generation and distribution,

[0119] -Quantum key usage,

[0120] -System configuration changes.

[0121] Exemplarily, the transmission channel of the unique identifier and the first and second key requests is a post-quantum secure virtual private network tunnel.

[0122] Therefore, the quantum key management and distribution process in this solution has full-link quantum security protection capabilities.

[0123] In summary, the full-link quantum-secure quantum key management and distribution process described in this solution not only realizes efficient quantum key management and distribution, but also improves the overall performance and credibility of the system by implementing a dynamic key pre-caching mechanism and a security audit mechanism.

[0124] For example, Figure 4 The following is a schematic diagram of the dynamic key pre-caching process provided by the embodiment of the present application. Figure 4 As shown, the implementation steps of this process include:

[0125] Step S401, detecting the current key cache quantity.

[0126] Exemplarily, a periodic detection strategy may be designed in the first agent platform 120, and the detection may be triggered by starting a timer with a preset duration.

[0127] For each detection, the current key cache quantity of the first proxy platform is compared with a preset threshold.

[0128] If it is determined that the current number of key caches is not less than or greater than the preset threshold, the implementation process of this dynamic key pre-caching mechanism ends, and the timer is restarted to enter the next waiting cycle to trigger this detection. The preset threshold is not greater than the maximum number of key caches C max .

[0129] Step S402, calculating the required number of quantum keys.

[0130] Exemplarily, if it is determined that the current key cache quantity is less than a preset threshold, the target quantity is obtained based on predetermined influencing factors of the dynamic key pre-caching mechanism, such as the current key cache quantity, the historical key usage quantity, the maximum key cache quantity, and the current network status factor of the first scope where the first proxy platform 120 is located.

[0131] Based on each influencing factor and its respective weight coefficient, the formula for calculating the target number of required quantum keys is as follows:

[0132]

[0133] In formula (1), R is the target number, U is the number of historical key usages, and C max is the maximum number of key caches, C current is the current number of key caches, Nstatus is the current network status factor, α, β, γ are weight coefficients, and the relationship between the weight coefficients is: α+β+γ=1.

[0134] The worse the current network status of the first scope is, the higher the current network status factor N is. status The larger it is, the larger the target number R is.

[0135] Specifically, N status The value of is between 0 and 1, and the smaller the value, the better the network status. For example, if the network latency is low, the packet loss rate is low, the bandwidth utilization is reasonable, and the network connection is stable, then the value of the network status factor will be small, indicating that the network is in good condition. On the contrary, if the network latency is high, the packet loss rate is high, the bandwidth utilization is overloaded, or the network connection is unstable, the value of the network status factor will be high, indicating that the network may have performance problems or poor health. Since the worse the network status, the more difficult it is to obtain quantum keys. Therefore, when the network status is worse, a larger value of N can be used to increase the network status. status A larger target number is obtained, so that more quantum keys can be obtained from the control platform 110 at one time, so as to improve the efficiency of quantum key management and distribution of the system.

[0136] For example, in formula (1), U can be taken as the average key usage rate in the past period of time, assuming that an average of 100 keys are used per second. max =500keys, indicating that a maximum of 500 keys can be cached. Current key cache quantity C current =200keys, indicating that 200 keys have been cached. Network status factor N status The value is 0.2. α, β, and γ are 0.5, 0.3, and 0.1 respectively.

[0137] At this time, in formula (1), This indicates that the first proxy platform 120 needs to obtain 141 quantum keys from the management and control platform 110 at one time.

[0138] It is understandable that formula (1) can also be optimized according to the actual operation of the first proxy platform 120. For example, the influencing factors in formula (1) can be added or deleted, and their respective weight coefficients can be adjusted, so that the first proxy platform 120 can achieve the best performance and resource utilization efficiency under different network conditions and business requirements.

[0139] Step S403, requesting a target number of quantum keys.

[0140] Exemplarily, after determining the target quantity, the first agent platform 120 sends a first key request including the target quantity to the management and control platform 110 to obtain the target quantity of quantum keys and their respective corresponding unique identifiers.

[0141] Step S404, updating the cache.

[0142] Exemplarily, the target number of quantum keys and their corresponding unique identifiers returned by the control platform 110 are received and stored in the cache of the first agent platform 120 to update the cache.

[0143] Step S405, checking the network status.

[0144] Exemplarily, the current network status of the scope in which the first proxy platform 120 is located is also checked and determined.

[0145] Step S406, increasing the cache threshold.

[0146] Exemplarily, if the current network status is good, the preset threshold is increased.

[0147] Step S407, reducing the cache threshold.

[0148] For example, if the current network status is poor, it is more difficult to obtain quantum keys, so the preset threshold is reduced, thereby increasing the probability of the first agent platform 120 initiating a quantum key management and distribution process to obtain more quantum keys from the management and control platform 110.

[0149] Therefore, by introducing a dynamic key pre-caching mechanism in the first proxy platform 120, the response rate of the system for managing and distributing quantum keys can be improved.

[0150] For example, Figure 5 A flowchart of a full-link quantum-secure quantum key management and distribution method provided by an embodiment of the present application is shown in FIG. Figure 1 The first proxy platform 120 shown in FIG. 1 is the initiator of the target quantum key management and distribution process. Figure 5 As shown, it mainly includes the following steps:

[0151] Step S501, sending a first key request to the control platform, and receiving a returned target quantum key and a corresponding unique identifier. The target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm.

[0152] Step S502: Send the unique identifier to the second proxy platform, so that the second proxy platform obtains the target quantum key from the control platform according to the unique identifier. The first proxy platform and the second proxy platform are located in the first and second scopes, respectively.

[0153] Step S503, in response to receiving a second key request from a first device in a first scope, sending a target quantum key to the first device; the target quantum key is used for communication between the first device and a second device in a second scope corresponding to the second proxy platform. The transmission channel of the unique identifier, the first and second key requests is a post-quantum secure virtual private network tunnel.

[0154] In one implementation, in response to receiving a second key request from a first device within a scope corresponding to the first proxy platform, the method further includes: sending a unique identifier to the first device so that the first device sends the unique identifier to the second device.

[0155] So that the second proxy platform obtains the target quantum key from the control platform according to the unique identifier, including: after the second proxy platform obtains the target quantum key from the control platform according to the unique identifier, the target quantum key is sent to the second device that receives the unique identifier.

[0156] The specific implementation process of steps S501-503 refers to steps S301-304 and will not be repeated here.

[0157] For example, Figure 6 A flowchart of a full-link quantum-secure quantum key management and distribution method provided by an embodiment of the present application is shown in FIG. Figure 1 The second proxy platform 130 shown is the responder of the target quantum key management and distribution process. Figure 6 As shown, it mainly includes the following steps:

[0158] Step S601, receiving a unique identifier sent by the first proxy platform. The first proxy platform is used to obtain the target quantum key and the corresponding unique identifier from the control platform, and then send the target quantum key to the first device in the corresponding scope of the first proxy platform. The target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm. The first proxy platform and the second proxy platform are located in different scopes.

[0159] For example, Figure 1 The first proxy platform 120 is the initiator of the quantum key management and distribution process, and the second proxy platform 130 is the responder of the quantum key management and distribution process. The first proxy platform 120 and the second proxy platform 130 are used to cooperate with the control platform 110 to implement distributed quantum key management and distribution for devices 140-170.

[0160] As the initiator of the quantum key management and distribution process, the first agent platform 120 is used to obtain the target quantum key and the corresponding unique identifier from the control platform.

[0161] As a responder of the quantum key management and distribution process, the second agent platform 130 receives the unique identifier sent by the first agent platform 120. The unique identifier corresponds to the target quantum key generated by the control platform 110 using the post-quantum key algorithm.

[0162] In addition, after the first proxy platform 120 obtains the target quantum key and the corresponding unique identifier from the control platform, it also responds to the key sending request of the first device in the corresponding scope of the first proxy platform and sends the target quantum key and the corresponding unique identifier to the first device, so that the first device sends the unique identifier to the second device in the corresponding scope of the second proxy platform 130. The second device is a communication party that is equal to the first device, and it is the target object for the first device to perform secure data transmission.

[0163] Step S602: Send a third key request including a unique identifier to the management and control platform, and receive a returned target quantum key.

[0164] Exemplarily, the second proxy platform 130 sends a third key request including a unique identifier to the management and control platform 110, and receives a target quantum key corresponding to the returned unique identifier.

[0165] Step S603, in response to receiving a fourth key request from a second device within a scope corresponding to the second proxy platform, sending a target quantum key to the second device. The target quantum key is used for communication between the first device and the second device. The transmission channel of the third and fourth key requests is a post-quantum secure virtual private network tunnel.

[0166] Exemplarily, the fourth key request of the second device includes a unique identifier corresponding to the target quantum key.

[0167] In response to receiving the fourth key request from the second device, the second agent platform 130 sends the target quantum key to the second device.

[0168] At this point, the first device and the second device can perform secure data communication based on the target quantum key.

[0169] For example, Figure 7 The flowchart of a quantum key management and distribution method for full-link quantum security provided by an embodiment of the present application is shown. Figure 7 As shown, the method mainly includes the following steps:

[0170] Step S701, agent platform registration and authentication.

[0171] For example, Figure 1 The first agent platform 120 and the second agent platform 130 shown in FIG. 1 register and authenticate with the management and control platform 110. Only the agent platform that succeeds in authentication can request a key.

[0172] Step S702: The proxy platform requests a key.

[0173] Exemplarily, the first agent platform 120 requests the control platform 110 to obtain the quantum key. The control platform 110 generates the quantum key and the corresponding unique identifier, and returns them to the first agent platform 120.

[0174] Step S703: exchange of unique identifiers between proxy platforms.

[0175] Exemplarily, the first agent platform 120 notifies the second agent platform 130 of the unique identifier of the target quantum key.

[0176] Step S704: The first proxy platform 120 requests a quantum key corresponding to a unique identifier.

[0177] Exemplarily, the first agent platform 120 uses the received unique identifier to obtain the target quantum key from the management and control platform 110 .

[0178] Step S705: The first proxy platform 120 requests a quantum key from the first device in the corresponding scope.

[0179] Exemplarily, the first device requests a quantum key from the first proxy platform 120. The first proxy platform 120 returns a target quantum key and a corresponding unique identifier.

[0180] Step S706: The first device sends a unique identifier to the second device in the corresponding scope of the second proxy platform 130 .

[0181] Exemplarily, the first device sends the unique identifier to the second device.

[0182] Step S707: The second device requests the second proxy platform 130 to uniquely identify the corresponding target quantum key.

[0183] Exemplarily, the second device requests the second proxy platform 130 to uniquely identify the corresponding target quantum key, and receives the returned target quantum key ( Figure 1 7 in the previous step).

[0184] Step S708: The first device and the second device establish a quantum secure communication link.

[0185] Exemplarily, the first device and the second device establish quantum secure communication using the same obtained quantum key.

[0186] Based on the method in the above embodiment, the embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the above embodiment. Figure 3 , Figure 5 , Figure 6 or Figure 7 The method shown.

[0187] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0188] The professionals should also be further aware that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0189] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0190] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation method of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A full-link quantum-secure quantum key management and distribution method, the method comprising: The first proxy platform sends a first key request to the management and control platform, and receives a returned target quantum key and a corresponding unique identifier; The target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm; The first agent platform sends the unique identifier to the second agent platform, and the second agent platform obtains the target quantum key from the control platform according to the unique identifier; the first agent platform and the second agent platform are located in the first and second scopes respectively; The first proxy platform receives a second key request from a first device within the first scope, and sends the target quantum key and the unique identifier to the first device; so that the first device sends the unique identifier to the second device within the second scope; The second proxy platform sends the target quantum key to the second device in response to the request including the unique identifier sent by the second device, so that the first device and the second device communicate using the target quantum key; The transmission channel of the unique identifier and the first and second key requests is a post-quantum secure virtual private network tunnel.

2. The method according to claim 1, wherein the first proxy platform sends a first key request to the management and control platform, and receives a returned target quantum key and a corresponding unique identifier, comprising: The first proxy platform sends a first key request including a target number to the control platform, and receives the target number of quantum keys and their corresponding unique identifiers in return; The first proxy platform randomly selects from the target number of quantum keys and their corresponding unique identifiers to obtain the target quantum key and the corresponding unique identifier.

3. The method according to claim 2, wherein the first proxy platform sends a first key request including a target number to the control platform, and receives the returned quantum keys of the target number and their corresponding unique identifiers, including: Periodically comparing the current key cache quantity of the first proxy platform with a preset threshold value according to a preset time period; When the current key cache quantity is less than a preset threshold, the target quantity is obtained according to the current key cache quantity, the historical key usage quantity of the first proxy platform, the maximum key cache quantity, and the current network status factor of the first scope; Sending a first key request including a target quantity to the management and control platform; Receive the target number of quantum keys and their corresponding unique identifiers, and store them in the cache of the first proxy platform; Checking the current network status of the first proxy platform; The preset threshold is positively adjusted according to the current network status.

4. The method according to claim 3, wherein: The worse the current network state of the first scope is, the larger the current network state factor is, and the larger the target number is.

5. The method according to claim 3, wherein the formula for calculating the target quantity comprises: Where R is the target number, U is the number of historical key usages, and C max is the maximum number of key caches, C current is the current key cache number, N status is the current network status factor, α, β, γ are weight coefficients, and the relationship between the weight coefficients is: α+β+Y=1.

6. The method according to claim 3, after sending the target quantum key and the unique identifier to the first device, the method further comprises: The target quantum key and the corresponding unique identifier are deleted from the cache.

7. The method according to claim 1, before sending the first key request to the management and control platform, further comprising: The first proxy platform sends a registration and authentication request to the management and control platform, and obtains a returned registration and authentication feedback message; If the result of the registration and authentication feedback message is a failure message, after updating the registration and authentication request, the updated registration and authentication request is sent to the management and control platform again until the result of the registration and authentication feedback message is a success message.

8. The method according to claim 1, further comprising: In the operating system kernel of the first proxy platform, a kernel task module is written for collecting the unique identifier and the data corresponding to the first and second key requests; Setting access permissions in the operating system kernel for hardware and software that receive and send the corresponding data; The access permission is opened for the kernel task module, so that the kernel task module collects the corresponding data by accessing the hardware and software, and generates an audit log according to the corresponding data.

9. A full-link quantum-secure quantum key management and distribution method, applied to a first agent platform, the first agent platform being the initiator of the quantum key management and distribution process, the method comprising: Send a first key request to the control platform, and receive a returned target quantum key and a corresponding unique identifier; The target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm; Sending the unique identifier to a second proxy platform, so that the second proxy platform obtains the target quantum key from the control platform according to the unique identifier; the first proxy platform and the second proxy platform are located in the first and second scopes, respectively; In response to receiving a second key request from a first device within a scope corresponding to the first proxy platform, sending the target quantum key to the first device; The target quantum key is used for communication between the first device and the second device within the corresponding scope of the second proxy platform; The transmission channel of the unique identifier and the first and second key requests is a post-quantum secure virtual private network tunnel.

10. A full-link quantum-secure quantum key management and distribution method, applied to a second agent platform, the second agent platform being a responder of a target quantum key management and distribution process, the method comprising: Receive a unique identifier sent by the first proxy platform; The first proxy platform is used to obtain the target quantum key and the corresponding unique identifier from the control platform, and then send the target quantum key to the first device in the corresponding scope of the first proxy platform; the target quantum key and the corresponding unique identifier are generated by the control platform using a post-quantum key algorithm; the first proxy platform and the second proxy platform are located in different scopes; Sending a third key request including the unique identifier to the control platform, and receiving the returned target quantum key; In response to receiving a fourth key request from a second device within a scope corresponding to the second proxy platform, sending the target quantum key to the second device; The target quantum key is used for communication between the first device and the second device; The unique identifier, the transmission channel of the third and fourth key requests is a post-quantum secure virtual private network tunnel.

Images