Quantum session key negotiation method and quantum key distribution system

Abstract

The invention provides a quantum session key negotiation method and a quantum key distribution system. The method comprises the steps that first equipment generates N first secret keys which are different from one another, each first secret key has a corresponding serial number, and N is larger than or equal to 2; the first device sends the N first keys to at least one key distribution center, so that the at least one key distribution center forwards the N first keys to a second device; the first equipment receives key serial number notification information from the second equipment, and determines serial numbers of M first keys randomly selected by the second equipment in the received first keys according to the key serial number notification information, and M is greater than or equal to 1 and less than or equal to N; and the first device generates a second key according to the M first keys, and sets the second key as a quantum session key communicating with the second device. According to the embodiment of the invention, the security of the quantum key distribution process can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of quantum communication technology, and in particular to a quantum session key negotiation method and a quantum key distribution system. Background Art

[0002] In a quantum communication network, communication between terminal devices needs to be encrypted with session keys, so before starting a session, both parties need to negotiate a session key. A single terminal device is usually unable to manually distribute keys to other parties in the network, so they need a trusted key distribution center (KDC). The working principle of the KDC network is to establish a connection between each user and the KDC, thereby establishing N connections.

[0003] KDC is a service that runs on a physical security server. Along with other information about each security principal, KDC stores an encryption key that only the security principal and KDC know. This key, also called a long-term key, is used to exchange between the security principal and KDC.

[0004] The traditional KDC form has the risk of sensitive information leakage and network bottlenecks in practical applications, and it is necessary to design a more secure and flexible symmetric key distribution solution.

[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0006] The purpose of the present disclosure is to provide a quantum session key negotiation method and a quantum key distribution system, which are used to improve the security during the quantum key negotiation process.

[0007] According to a first aspect of an embodiment of the present disclosure, a quantum session key negotiation method is provided, including: a first device generates N first keys that are different from each other, each of the first keys has a corresponding serial number, N≥2; the first device sends the N first keys to at least one key distribution center, so that the at least one key distribution center forwards the N first keys to a second device; the first device receives key serial number notification information from the second device, and determines the serial numbers of M first keys randomly selected by the second device from the N first keys according to the key serial number notification information, 1≤M≤N; the first device generates a second key according to the M first keys, and sets the second key as a quantum session key for communication with the second device.

[0008] According to a second aspect of an embodiment of the present disclosure, a quantum session key agreement method is provided, including: a second device receives N first keys from at least one key distribution center, N≥2; the second device randomly selects M first keys from the N first keys, 1≤M≤N; the second device generates key sequence number notification information according to the sequence numbers of the M first keys, and sends the key sequence number notification information to the first device; the second device generates a second key according to the M first keys, and sets the second key as a quantum session key for communicating with the first device.

[0009] According to a third aspect of an embodiment of the present disclosure, a quantum session key agreement method is provided, comprising: a key distribution center receives key forwarding information from a first device; the key distribution center obtains at least one first key according to the key forwarding information, and a second device as a forwarding destination; the key distribution center forwards the at least one first key to the second device.

[0010] According to a fourth aspect of an embodiment of the present disclosure, a quantum key distribution system is provided, comprising: a first device, used to execute the quantum session key negotiation method as described in any one of the above items; a second device, used to execute the quantum session key negotiation method as described in any one of the above items; and at least one key distribution center, used to execute the quantum session key negotiation method as described in any one of the above items, and forward at least one first key from the first device to the second device.

[0011] The disclosed embodiment of the present invention arranges a first device to send two or more first keys to a second device through at least one key distribution center, and generates a second key for communicating with the second device according to one or more keys randomly selected by the second device from the received first keys. This can avoid the problem of session key leakage caused by the key negotiation process being eavesdropped by an abnormal key distribution center, and greatly improve the security of the session key negotiation process in the quantum communication process.

[0012] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0014] Figure 1 It is a schematic diagram of the structure of a quantum key distribution system in an exemplary embodiment of the present disclosure.

[0015] Figure 2 is a flow chart of a quantum session key negotiation method performed by a first device.

[0016] Figure 3 It is a schematic diagram of a first key distribution method in an exemplary embodiment of the present disclosure.

[0017] Figure 4 4 is a flow chart of a quantum session key negotiation method in an exemplary embodiment of the present disclosure.

[0018] Figure 5 It is a schematic diagram of a first key distribution method in an exemplary embodiment of the present disclosure.

[0019] Figure 6 It is a schematic diagram of a first key distribution method in an exemplary embodiment of the present disclosure.

[0020] Figure 7 is a flow chart of a quantum session key negotiation method performed by a second device.

[0021] Figure 8 Flowchart of a quantum session key negotiation method performed by a key distribution center.

[0022] Fig. 9 It is an interactive schematic diagram of the key distribution process in the system 100. DETAILED DESCRIPTION

[0023] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0024] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0025] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0026] Figure 1 It is a schematic diagram of the structure of a quantum key distribution system in an exemplary embodiment of the present disclosure.

[0027] refer to Figure 1 , the quantum key distribution system 100 may include a first device 1, a second device 2, and at least one key distribution center 3, wherein:

[0028] The first device 1 is used to generate and send N first keys to at least one key distribution center 3, receive the serial numbers of M first keys from the second device 2, and generate a second key for communication with the second device 2 according to the M first keys;

[0029] The second device 2 is used to receive the first keys from at least one key distribution center 3, randomly select M first keys from the received first keys, generate a second key for communicating with the first device 1 according to the M first keys, and send the sequence numbers of the M first keys to the first device 1;

[0030] At least one key distribution center 3 is used to receive at least one first key from the first device 1 and forward the at least one first key to the second key 2 .

[0031] Among them, the first device 1 and the second device 2 are both terminal devices capable of quantum communication, including but not limited to quantum satellite ground receiving stations, mobile base stations with quantum communication modules, quantum communication experimental terminals dedicated to scientific research institutions, and quantum encryption communication equipment deployed at key nodes by financial institutions to ensure data transmission security.

[0032] The Key Distribution Center 3 (KDC) is responsible for managing and distributing keys, so that both communicating parties can securely obtain the keys used for encrypted communication. The Key Distribution Center 3 not only receives at least one first key from the first device 1 and forwards it to the second device 2 for basic information transmission tasks, but also has the ability to store and manage quantum keys. It can classify and store the massive influx of first keys in a very short time, and ensure the stability of the quantum state of the key during storage, eliminate the risk of key information loss or confusion caused by environmental interference or equipment failure, and provide solid support for subsequent accurate key distribution. In addition, when facing complex key requests from different first devices 1 and forwarding tasks to different second devices 2, the key scheduling and distribution mechanism of KDC can dynamically optimize the key distribution path based on preset priority rules, network load balancing algorithms, and real-time communication link quality monitoring data to ensure that the first key reaches the target second device 2 at the fastest speed and most accurate path. Finally, KDC can implement strict identity authentication and access control. When receiving the key of the first device 1 and forwarding it to the second device 2, multiple quantum encryption authentications will be performed on the device identity. Only authenticated legitimate devices can access KDC for key interaction, effectively resisting disguised intrusions by external illegal devices and cutting off the risk of quantum key leakage at the source.

[0033] It can be understood that in the system 100, there are multiple KDCs, each of which can be connected to multiple devices. Each device can be referred to as the first device 1 when it is the initiator of the session key negotiation, that is, when it needs to send the first key, and each device can be referred to as the second device 2 when it is the receiver of the session key negotiation, that is, when it needs to receive the first key. Therefore, the system 100 can include multiple dynamic first devices 1 and multiple dynamic second devices 2. The role of each device (as the first device 1 and the second device 2) is not fixed, but is relatively set according to the initiation logic of the session key negotiation task. Each device can execute the method of the first device 1 as the first device 1 at the first moment, and execute the method of the second device 2 as the second device 2 at the second moment.

[0034] In addition, each key distribution center 3 stores a pre-shared key (PSK) corresponding to each device. When each device communicates with each key distribution center 3, it is necessary to use the pre-shared key corresponding to the key distribution center. For detailed settings, please see the subsequent embodiments.

[0035] In the related art, a key distribution center is set up between multiple devices, and the session key negotiation process between multiple devices needs to be completed through the key distribution center, that is, one device sends the session key to the KDC, which is forwarded by the KDC to another device to achieve session key synchronization between the two devices. Once the key distribution center is attacked and leaks occur, the session keys of multiple devices connected to the key distribution center will be at risk of leakage, posing a huge security risk. In addition, when the number of devices increases, the KDC used to perform information transfer tasks is very likely to have insufficient processing power, resulting in blockage of the key negotiation process of a large number of communication devices.

[0036] In view of the problems of sensitive information leakage and network bottleneck in the actual application of the traditional key negotiation method, the disclosed embodiment first sets the first device 1 to send two or more first keys, and the second device 2 randomly selects from the received first keys to generate the real session key, i.e., the second key. Since each key distribution center 3 cannot predict which first keys the second device 2 will successfully receive, and which first keys the second device 2 will specifically select, even the second key 2 itself does not know before the selection is completed, and the second device 2 only notifies the first device 1 of the serial number of the first key, and does not transmit the specific key content, the outside world cannot know how the second key is generated, which can greatly avoid the risk of key leakage caused by the KDC transit mechanism in the key negotiation process.

[0037] In addition, in the embodiment of the present disclosure, multiple KDCs can be set to forward N (two or more) first keys. Each KDC only knows part of the first keys. Even if the KDC is attacked or leaked, the attacker cannot obtain all the first keys, and cannot brute force the second key by enumerating the permutations and combinations of the first keys, thereby further improving security.

[0038] Third, since multiple KDCs are set up to handle forwarding transactions, the forwarding pressure can be effectively dispersed, the processing volume bottleneck and network bottleneck caused by the increase in the number of users can be avoided, the normal operation of the key negotiation process can be maintained, and the network robustness can be improved.

[0039] The following is a detailed description of the quantum session key negotiation method performed by the first device 1, the second device 2, and the KDC 3 in the system 100.

[0040] Figure 2 is a flow chart of a quantum session key negotiation method performed by a first device.

[0041] refer to Figure 2 , the quantum session key negotiation method 200 may include:

[0042] Step S21, the first device generates N first keys that are different from each other, each first key has a corresponding serial number, N≥2;

[0043] Step S22: the first device sends N first keys to at least one key distribution center, so that the at least one key distribution center forwards the N first keys to the second device;

[0044] Step S23, the first device receives the key sequence number notification information from the second device, and determines the sequence numbers of M first keys randomly selected by the second device from the received first keys according to the key sequence number notification information, where 1≤M≤N;

[0045] Step S24: The first device generates a second key according to the M first keys, and sets the second key as a quantum session key for communicating with the second device.

[0046] In an exemplary embodiment, when the first device 1 starts the session key negotiation process in step S21, N first keys can be generated by QRNG (Quantum Random Number Generator), and these first keys are numbered to determine the sequence number of each first key. The specific value of N can be randomly generated or preset by the developer. In some embodiments, N can be a preset value, such as how many first keys are generated each time when a certain device is preset as the first device 1, or N is preset to be equal to the number of all KDCs included in the system 100. In theory, the larger the number of N, the higher the security, but the greater the pressure on the system.

[0047] In step S22, when sending the first key to the KDC, the first device 1 needs to encrypt the first key using a pre-shared key (PSK) corresponding to each key distribution center 3, and send the encrypted first key to the key distribution center so that the key distribution center can verify the first device based on the pre-shared key.

[0048] The pre-shared key is a key shared between the KDC and the device through a secure channel before using the pre-shared key to protect communication. This key is used for subsequent authentication, encryption or decryption of messages, and other operations. In a large network environment, each new device connected to the KDC needs to be assigned and shared with a PSK by the KDC. If the PSK corresponding to a device is leaked through phishing, malware, or internal personnel, the attacker can use this key to access and tamper with the communication content transmitted between the device and the KDC. Therefore, there are hidden dangers in the existing communication mechanism between devices and KDC. When the KDC is attacked and leaked, the attacker can obtain the PSK of each device that communicates with the KDC, and then decrypt the information forwarded between devices through the KDC, causing information leakage.

[0049] In the embodiment of the present disclosure, the number of PSKs that each device stores for each KDC is set to be different according to different distribution methods of the first key.

[0050] Figure 3 It is a schematic diagram of a first key distribution method in an exemplary embodiment of the present disclosure.

[0051] refer to Figure 3 In an exemplary embodiment, the first device 1 sends N first keys to N key distribution centers respectively.

[0052] In an exemplary embodiment, the specific value of N may also be determined according to the number of selected KDCs.

[0053] Figure 4 4 is a flow chart of a quantum session key negotiation method in an exemplary embodiment of the present disclosure.

[0054] refer to Figure 4 In some embodiments, before or after step S21, method 200 may further include:

[0055] Step S201, the first device randomly determines the number of key distribution centers to be used;

[0056] Step S202: the first device selects at least one key distribution center from available key distribution centers according to the number of key distribution centers used;

[0057] Step S203: the first device records an identifier of at least one key distribution center.

[0058] That is, before communicating with the KDC, the first device 1 first selects the number n of KDCs to be used from the available KDCs in the system 100 , and the number n is less than or equal to the number of key distribution centers 3 actually existing in the system 100 .

[0059] exist Figure 4 In the illustrated embodiment, the first device 1 may use all KDCs included in the system 100 , or may use only part of the KDCs included in the system 100 .

[0060] When the first device 1 uses only part of the KDCs, it can randomly determine the number of KDCs to be used and which KDCs to use, obtain identifiers of the KDCs selected for use, and then form an identifier list of the selected KDCs.

[0061] The number n of KDCs and the KDC identifier list used by a device when it acts as the first device 1 can be fixed, or can be randomly determined each time it acts as the first device 1. If the number of KDCs used by each device each time it acts as the first device 1 and the specific KDCs used are not fixed, it can greatly increase the difficulty of an attacker stealing information of the first device 1.

[0062] In some embodiments, n may also be a preset value, for example, the number of KDCs selected each time when a certain device is used as the first device 1 is preset to be the same, or n is preset to be equal to all KDCs included in the system 100. In this case, the list of KDC identifiers used each time the device is used as the first device 1 may be the same (for example, when all KDCs are used) or different.

[0063] In some embodiments, the number n of KDCs used may be determined according to factors such as the importance of the first device 1 and the importance of the second device 2. The higher the importance, the higher the security requirement and the less sensitive to the communication cost, and more KDCs may be set to participate in forwarding.

[0064] Continue to refer Figure 3 The embodiment shown.

[0065] In step S22, the number N of first keys is set to be equal to the number n of KDCs selected for use, that is, the number of KDCs selected for use is N.

[0066] After the number N is determined by the aforementioned random generation, preset or according to the number n of KDCs, the first device 1 randomly generates N first keys by means of a quantum random number generator, etc. in step S21, and obtains N pre-shared keys corresponding to the N KDCs determined to be used in step S22. Next, the first device 1 encrypts the i-th first key using the i-th pre-shared key corresponding to the i-th key distribution center, and sends the encrypted i-th first key to the i-th key distribution center, 1≤i≤N.

[0067] like Figure 3 As shown, a first key K1i (i is the serial number of the first key) can be sent to each KDC, and K1i can be encrypted using PSKi, and the encrypted K1i can be sent to KDCi.

[0068] By sending an encrypted first key K1i to each KDC, the possibility of all first keys being intercepted by one or some KDCs is greatly reduced, and the security of the key negotiation process is further improved.

[0069] It should be noted that the process of the first device 1 encrypting K1i using PSKi may specifically include:

[0070] The first device 1 uses PSKi to generate the ciphertext Ki by one-time encryption (OTP, One-Time Pad) of K1i, and calculates Hmaci=Hmac_PSKi(K1i) through the Hmac function to obtain the Hmac value corresponding to PSKi and K1i. Finally, the ciphertext Ki and Hmaci are sent to the KDC for KDC to verify the identity of the first device 1.

[0071] Among them, the Hmac function (Hash-based Message Authentication Code) combines the key with the message and generates a fixed-length authentication code through a hash operation to verify the integrity and authenticity of the message, and can also authenticate the source of the message to a certain extent. During the specific operation, the Hmac function uses PSKi and K1i to generate an Hmac value for verifying the integrity and authenticity of PSKi and K1i, ensuring that K1i has not been tampered with during transmission.

[0072] exist Figure 3 In the illustrated embodiment, after receiving the encrypted information from the first device 1, the KDC uses the PSK corresponding to the first device 1 to decrypt the ciphertext Ki. At the same time, an Hmac operation is performed based on the successfully decrypted PSK and the decrypted first key K1i. The obtained Hmac value is compared with the received Hmaci. If they are consistent, it means that K1i has not been tampered with during the transmission process, and the identity of the first device 1 has been verified.

[0073] During the decryption process, if a KDC only stores one PSK for a device, it can be used directly for decryption. In some embodiments, a KDC can store multiple PSKs for a device, and correspondingly, a device also stores multiple PSKs with the KDC. At this time, different PSKs can be used to test decryption, or the first device 1 can be agreed in advance on which PSK to use for this communication, such as setting the first PSK for odd dates and the second PSK for even dates, etc. Correspondingly, at the first device 1 end, if multiple PSKs are stored for a KDC, a PSK can be randomly selected for encryption, or a PSK can be used for encryption according to the agreement.

[0074] In addition to sending one first key to each KDC, in an exemplary embodiment, multiple first keys may be sent to each KDC.

[0075] Figure 5 It is a schematic diagram of a first key distribution method in an exemplary embodiment of the present disclosure.

[0076] refer to Figure 5In an exemplary embodiment, the first device 1 may send P first keys to the key distribution center in P times, 2≤P≤N. That is, the first device 1 sends two or more first keys to one KDC.

[0077] In an exemplary embodiment, the first device 1 may use P different pre-shared keys corresponding to the key distribution center 3 to encrypt P first keys respectively, and send the encrypted first keys to the key distribution center P times.

[0078] like Figure 5 As shown, assume that there are two KDCs in system 100, namely KDC1 and KDC2, N=8, assume that for KDC1, P=3, and the first device 1 stores three PSKs corresponding to KDC1, namely PSK11, PSK12, and PSK13; for KDC2, P=5, and the first device 1 stores five PSKs corresponding to KDC2, namely PSK21, PSK22, PSK23, PSK24, and PSK25.

[0079] After generating 8 first keys K1i (i is the serial number of the first key), the first device 1 uses PSK11 to encrypt K11 and sends it to KDC1 three times, uses PSK12 to encrypt K12 and sends it to KDC1, and uses PSK13 to encrypt K13 and sends it to KDC1. Next, the first device 1 uses PSK21 to encrypt K14 and sends it to KDC2 five times, uses PSK22 to encrypt K15 and sends it to KDC2, uses PSK23 to encrypt K16 and sends it to KDC2, uses PSK24 to encrypt K17 and sends it to KDC2, and uses PSK25 to encrypt K18 and sends it to KDC2. The encryption method is as described above and will not be repeated here.

[0080] In such embodiments, the number of PSKs that each device stores for each KDC may be randomly determined by the KDC when distributing PSKs to the devices.

[0081] Therefore, the first device 1 uses 8 PSKs corresponding to the two KDCs to encrypt 8 first keys respectively and distributes them to the two KDCs. Each KDC cannot know the complete set of first keys. Each KDC stores multiple PSKs for the first device 1. When decrypting data from the first device 1, a limited number of attempts are required to determine the corresponding PSK for this time and obtain the information contained therein, namely the first key Ki. Even if the KDC is attacked, the attacker first needs to find that the KDC stores more than one PSK for a device, and then needs to find all the PSKs corresponding to the device. Every time the encrypted information transmitted by the device is received, all the PSKs corresponding to the device need to be used for tentative cracking, which greatly increases the cracking time and the probability of the attack being discovered, which can further reduce the possibility of the first key being leaked and further improve the security of the quantum session key negotiation process. Even if the attacker cracks the first key transmitted by the KDC, he cannot obtain the entire set of first keys, and does not know which first keys the second device 2 will choose to generate the second key, which makes cracking extremely difficult.

[0082] In addition to transmitting one first key each time, in some embodiments, multiple first keys may be transmitted each time.

[0083] Figure 6 It is a schematic diagram of a first key distribution method in an exemplary embodiment of the present disclosure.

[0084] refer to Figure 6 In some embodiments, the first device 1 may also distribute P first keys to the KDC in Q times, 2≤Q≤P≤N.

[0085] Assume that there are two KDCs in system 100, namely KDC1 and KDC2, N=8, and assume that for KDC1, P=3, Q=2, and three first keys K11~K13 are sent twice. The first device 1 saves two PSKs corresponding to KDC1, namely PSK11 and PSK12; assume that for KDC2, P=5, Q=3, and five first keys K14~K18 are sent three times. The first device 1 saves three PSKs corresponding to KDC2, namely PSK21, PSK22, and PSK23.

[0086] After the first device 1 generates 8 first keys K1i, it sends two first keys K11 and K12 to KDC1 for the first time and encrypts them using PSK11. During encryption, for example, K11 and K12 can be concatenated according to the number of bits, and correspondingly, an Hmac value is generated based on the concatenated information and PSK11. It should be noted that at this time, the length of the first key K1i can be agreed upon with KDC in advance, so that after KDC decrypts the original text, it can identify the two first keys according to the number of bits.

[0087] Next, the first device 1 uses PSK12 to encrypt K13 when sending for the second time; uses PSK21 to encrypt K14 and K15 when sending for the third time; uses PSK22 to encrypt K16 when sending for the fourth time; and uses PSK23 to encrypt K17 and K18 when sending for the fifth time. The encryption method is as described above and will not be repeated here.

[0088] In this embodiment, the number of first keys sent by the first device 1 each time can be randomly set, as long as it is greater than 1, and it does not need to be sent in sequence as in the example. Instead, the first key to be sent this time can be randomly selected, as long as the first key carries serial number information and can be recognized by the second device.

[0089] In addition, the first device 1 does not need to use all the PSKs for sending. The number of sending times can be set to be less than the number of PSKs, and the number of first keys sent each time and the serial number of the first keys can be randomly determined. Therefore, when the KDC receives the encrypted information, it needs to use all the PSKs corresponding to the first device 1 to tentatively decrypt, and identify how many first keys are transmitted this time and the specific content of each first key according to the pre-agreed agreement.

[0090] This will increase the decryption time for the attacker and, to a certain extent, cause the attacker to be confused by the irregular length of the decrypted information, greatly increasing the difficulty for the attacker to steal the first key. Moreover, when there are more than one KDC, the attacker cannot know the first key received by all KDCs, making it extremely difficult to leak the first key.

[0091] In addition to the above distribution methods, those skilled in the art may also make more settings on multiple KDCs, multiple PSKs, the number of times each PSK is sent, the number of first keys sent each time, and other information, which will not be elaborated here.

[0092] The above-mentioned first device 1 sends the first key in a random manner, which does not require complex calculations and has little impact on the processing burden of the first device 1. For the KDC that receives the information, it only needs to find the PSK corresponding to the source device of the information when receiving the information, perform tentative decryption and verification, and increase the number of information bits and information cutting by one at most. As long as the number of PSKs is limited to not too many (for example, not more than 10), it will also have little impact on the processing burden. However, for attackers, the amount of calculation to steal information will increase significantly, and it is almost impossible to steal secrets successfully.

[0093] After the KDC decrypts and verifies the device from the first device 1, it obtains the first key and forwards the first key to the second device 2. When forwarding, it can use the PSK corresponding to the second device 2 for encryption, and at the same time form an Hmac value and send it to the second device 2 for verification of the information. Please refer to the subsequent embodiments for detailed processing.

[0094] The second device 2 receives the encrypted information from the n KDCs, decrypts and verifies the encrypted information according to the PSK corresponding to the n KDCs, and obtains multiple first keys. It should be noted that the number of first keys successfully obtained by the second device 2 is not necessarily equal to the number N of first keys issued by the first device 1.

[0095] In one case, if one or some KDCs are attacked and cannot successfully decrypt the first key, the first key cannot be successfully forwarded to the second device 2. In another case, in order to prevent attackers from intervening in the first key transmission process, the second device 2 can limit the reception of only encrypted information that arrives within a preset time, thereby refusing to receive subsequent information, because the delayed arrival of these timeout information may be caused by the attacker needing more time to crack.

[0096] The second device 2 randomly selects M first keys from the successfully obtained first keys, and notifies the first device 1 of the information of the M first keys through key required notification information. The specific method implemented by the second device 2 is detailed in the subsequent embodiments.

[0097] Next, in step S23, the first device receives the key sequence number notification information from the second device, and determines the sequence numbers of M first keys randomly selected by the second device from the received first keys according to the key sequence number notification information, where 1≤M≤N.

[0098] The first device 1 determines the M first keys according to the serial numbers of the M first keys, and then in step S24, the first device generates a second key according to the M first keys, and sets the second key as a quantum session key for communicating with the second device.

[0099] In an exemplary embodiment, the first device 1 generates the second key according to the M first keys, which may be achieved, for example, by using a key derivation function (KDF).

[0100] A key derivation function (KDF) is used to derive one or more other keys from an initial key material (such as a master key, a shared key, etc.). KDF can enhance the security of the key by introducing additional parameters (such as salt values, etc.), making the derived session key more difficult to be guessed or cracked by attackers. It can also convert an initial shared key into a session key suitable for specific cryptographic operations (such as encryption, authentication, etc.). For example, a longer master key is converted into a shorter key for encryption of a specific session. In addition, through KDF, multiple keys for different purposes can be derived from a relatively fixed shared key. For example, in a secure communication system, different keys are derived for encrypting communication data, calculating message authentication codes, etc.

[0101] In an exemplary embodiment, the first device 1 and the second device 2 respectively store the same key derivation function, and the key derivation function corresponds to both the first device and the second device. In step S24, the first device 1 uses the key derivation function corresponding to the second device 2 to operate on M first keys to generate a second key.

[0102] Each device can store multiple key derivation functions, and each key derivation function can correspond to one or more other devices, so that for every two devices, both parties store a unique and identical key derivation function corresponding to the other party. After knowing the input data of the key derivation function, that is, the M first keys, both parties can obtain the same key result according to the same key derivation function without communicating with each other, further reducing the possibility of leakage of the session key.

[0103] After the second key is generated, the session key negotiation process is completed, and the first device 1 and the second device 2 can communicate with each other using the second key. It should be noted that, depending on the derivation mechanism of the key derivation function, the number of second keys can be one or more, but no matter how many second keys there are, the second keys owned by the first device 1 and the second device 2 and the purpose corresponding to each second key are the same, and the two parties do not need to communicate.

[0104] Next, the quantum session key negotiation method performed by the second device 2 is introduced.

[0105] Figure 7 is a flow chart of a quantum session key negotiation method performed by a second device.

[0106] refer to Figure 7 , the quantum session key negotiation method 700 may include:

[0107] Step S71, the second device receives N first keys from at least one key distribution center, N≥2;

[0108] Step S72, the second device randomly selects M first keys from N first keys, 1≤M≤N;

[0109] Step S73, the second device generates key serial number notification information according to the serial numbers of the M first keys, and sends the key serial number notification information to the first device;

[0110] Step S74: The second device generates a second key according to the M first keys, and sets the second key as a quantum session key for communicating with the first device.

[0111] Refer to the previous embodiments.

[0112] In some embodiments, the KDC sends the first key to the second device 2 by sending encrypted information to the second device 2. The encrypted information sent by the KDC to the second device 2 is in an encrypted form as shown above, including a ciphertext and an Hmac value.

[0113] In step S71, the information received by the second device 2 from the KDC may be a ciphertext formed by encrypting the first key through PSK and an Hmac value.

[0114] The KDC may distribute multiple PSKs to the second device 2. At this time, when the second device 2 receives encrypted information from a certain KDC, it may use at least one PSK corresponding to the KDC to decrypt the ciphertext to obtain the first key.

[0115] If a KDC sends the first key to the second device 2 multiple times, the second device 2 can use the PSK distributed by the KDC to decrypt the ciphertext in turn to obtain the first key.

[0116] In some embodiments, the ciphertext sent by the KDC may include more than one first key. In this case, the KDC and the first device 1 and the second device 2 may pre-agree on the number of bits of the first key, so that the second device 2 can accurately extract multiple first keys from the decrypted information.

[0117] In step S71, the second device 2 may wait for a period of time to receive all the information from n KDCs. Alternatively, it may start timing after receiving the encrypted information from a KDC, end timing after a preset time, and only process the encrypted information obtained during the timing process. Thus, it refuses to receive the encrypted information from the KDC that may be attacked and infiltrated, so that even if the attacker successfully deciphers the information transmitted by the first device 1 to a certain KDC, it cannot be taken into consideration by the second device 2, and the deciphering is invalid.

[0118] In addition, this approach makes the number of first keys used by the second device 2 more difficult to predict, further improving the security of the key negotiation process.

[0119] After the second key 2 decrypts the first key and completes the verification according to the Hmac value, it is equivalent to completing the identity verification. So far, the first key 1 and the second key 2 have safely completed the identity verification without direct communication.

[0120] Next, in step S72, the second device 2 randomly determines M first keys from the received first keys. The specific value of M can be either a preset value or a randomly generated value. Because before the second device 2 randomly determines the M first keys, the number of first keys used by the second device 2 is uncertain, the source is uncertain, the first key sequence number is uncertain, the number M selected to use in the first keys is uncertain, and the specific M first keys to be selected are also uncertain, the attacker cannot know which first keys the first device 1 and the second device 2 will use to generate the second key, making the final negotiated second key almost impossible to crack.

[0121] In step S73, the second device generates key serial number notification information according to the serial numbers of the M first keys, and sends the key serial number notification information to the first device. In some embodiments, the key serial number notification information may include, in addition to the serial numbers of the M first keys, an Hmac value generated based on the values ​​of the M first keys, so as to facilitate verification by the first device 1. Since the key serial number communication information does not include key specific information, it cannot be deciphered even if it is intercepted.

[0122] In step S74, the second device generates a second key based on the M first keys, and sets the second key as a quantum session key for communicating with the first device. Similar to the first device 1, the first device 1 and the second device 2 store the same key derivation function, which corresponds to both the first device 1 and the second device 2. The second device 2 uses the key derivation function corresponding to the first device 1 to operate on the M first keys to generate the second key. The detailed method is described in the above description of the first device 1, which will not be repeated here.

[0123] Figure 8 Flowchart of a quantum session key negotiation method performed by a key distribution center.

[0124] refer to Figure 8 , the quantum session key negotiation method 800 may include:

[0125] Step S81, the key distribution center receives key forwarding information from the first device;

[0126] Step S82, the key distribution center obtains at least one first key and a second device as a forwarding destination according to the key forwarding information;

[0127] Step S83: The key distribution center forwards at least one first key to the second device.

[0128] Refer to the above method 200 and method 700 at the same time, and understand the method 800 in combination.

[0129] When the KDC receives the key forwarding information (or encrypted information) from the first device 1, it uses the PSK corresponding to the first device 1 to decrypt and verify. If the KDC distributes multiple PSKs to the first device 1, the KDC can decrypt the key forwarding information according to the multiple PSKs to obtain the first key. The decryption method is, for example, to try in turn, or to use a certain PSK according to the agreement. See the above description for details.

[0130] In some embodiments, during the KDC decryption process, the first keys in the encrypted information from the first device 1 can be identified based on the length of the first key pre-agreed with the first device 1, and the first keys can be saved.

[0131] Each time the KDC receives a key forwarding message, it decrypts it, determines the forwarding destination, ie, the second device 2, and then executes the forwarding.

[0132] Similar to the sending method of the first device 1, the key distribution center uses at least one pre-shared key corresponding to the second device to encrypt at least one first key respectively, and sends the encrypted at least one first key to the second device respectively. If the KDC distributes multiple PSKs to the second device 2, when the KDC sends the first key 1 to the second device 2, it can also use multiple PSKs to encrypt the first key 1 multiple times and generate an Hmac value.

[0133] In addition, the KDC may also send multiple first keys to the second device 2 at one time, as long as the length of the first key is agreed upon with the first device 1 and the second device 2 in advance.

[0134] For each KDC, multiple first keys may be received multiple times, but the forwarding destination of these first keys is all the second device 2. Therefore, after determining the second device 2, the KDC can extract all PSKs corresponding to the second device 2, use all or part of them, and forward the first key to the second device 2 without causing a significant impact on the processing burden.

[0135] For a single KDC, the more KDCs there are in the system 100, the lower the number of times it participates in forwarding (in the case of random selection of the KDC used). When adding new devices, it will not have a significant impact on the processing cost.

[0136] Therefore, in the disclosed embodiment, the processing costs of the first device 1, the second device 2, and the key distribution center 3 will not increase significantly, but the decryption cost of the attacker will increase sharply, making cracking almost impossible.

[0137] Fig. 9 It is an interactive schematic diagram of the key distribution process in the system 100.

[0138] refer to Fig. 9 In an exemplary embodiment, taking the distribution of N first keys to N KDCs as an example, the key distribution process in which the first device 1, the second device 2, and the key distribution center 3 participate may include:

[0139] In step S901, N KDCs all use a quantum random number generator to generate a pre-shared key (PSK), generate a PSK for each device, and maintain a PSK list corresponding to each device.

[0140] In step S902, N KDCs distribute the PSK corresponding to the device to the device. Each device will receive at least N PSKs. Each KDC only knows the PSK value distributed by itself and cannot obtain the PSK value sent to the device by other KDCs.

[0141] Step S903: The first device 1 generates N first keys through QRNG and numbers them.

[0142] Step S904, the first device 1 uses the PSKi corresponding to the key distribution center i to encrypt the first key K1i through a one-time encryption (OTP) method, and calculates Hmac=Hmac_PSKi(K1i). Similarly, the first device 1 uses different PSKs to encrypt different first keys, generates different Hmac values, and forms encrypted information based on the ciphertext and the Hmac value.

[0143] Step S905: The first device 1 sends N pieces of encryption information to N KDCs respectively.

[0144] Step S906, after receiving the ciphertext, each KDC finds the PSK value of the first device 1 according to the maintained PSK list, decrypts the first key, and verifies the Hmac value to implement identity authentication and integrity verification.

[0145] Step S907: KDC finds the PSK value corresponding to the second device 2 according to the PSK list, and encrypts the corresponding first key again through OTP.

[0146] Step S908 , the KDC sends the re-encrypted first key and the Hmac value generated based on the PSK of the second device 2 to the second device 2 .

[0147] Step S909, after the second device 2 receives N encrypted data from N KDCs, it uses N corresponding PSK keys to decrypt N first keys respectively, uses the corresponding PSK to calculate the Hmac value for these N fragments, and compares it with the received Hmac to perform identity authentication and integrity verification. If it passes, the first key is retained.

[0148] Step S910: The second device 2 randomly selects M first keys from the reserved first keys.

[0149] In step S911, the second device 2 sends the serial numbers of the M first keys and Hmac generated based on the value of the retained first key to the first device 1.

[0150] Step S912: the first device 1 and the second device 2 generate a final second key, ie, a session key, according to the M first keys through a common KDF (Kni).

[0151] In summary, the disclosed embodiments have extremely high security and can greatly improve the difficulty of information deciphering in the session key negotiation process at a low deployment cost and computing cost. When setting up multiple KDCs, the cost of adding new devices is proportional to the number of KDCs and has nothing to do with the number of devices. And it can greatly reduce the probability of a KDC experiencing a processing bottleneck. Finally, devices can complete the key negotiation process without communicating specific session keys, and indirectly implement identity authentication through distributed KDCs.

[0152] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0153] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A quantum session key negotiation method, characterized in that: include: The first device generates N first keys that are different from each other, each of the first keys has a corresponding sequence number, and N≥2; The first device sends the N first keys to at least one key distribution center, so that the at least one key distribution center forwards the N first keys to the second device; The first device receives key sequence number notification information from the second device, and determines, according to the key sequence number notification information, sequence numbers of M first keys randomly selected by the second device from the received first keys, where 1≤M≤N; The first device generates a second key according to the M first keys, and sets the second key as a quantum session key for communicating with the second device.

2. The quantum session key negotiation method according to claim 1, characterized in that: The first device sending the N first keys to at least one key distribution center includes: The first device sends the N first keys to N key distribution centers respectively.

3. The quantum session key negotiation method according to claim 2, characterized in that: The first device sending the N first keys to the N key distribution centers respectively includes: The first device obtains N pre-shared keys corresponding to N key distribution centers; The first device uses the i-th pre-shared key corresponding to the i-th key distribution center to encrypt the i-th first key, and sends the encrypted i-th first key to the i-th key distribution center, so that the key distribution center verifies the first device according to the pre-shared key, 1≤i≤N.

4. The quantum session key negotiation method according to claim 1, characterized in that: The first device sending the N first keys to at least one key distribution center includes: The first device sends P first keys to the key distribution center, 2≤P≤N.

5. The quantum session key negotiation method according to claim 4, characterized in that: The sending of the N first keys by a device to at least one key distribution center comprises: The first device obtains P different pre-shared keys corresponding to the key distribution center; The first device uses the P different pre-shared keys to encrypt the P first keys respectively, and sends the encrypted first keys to the key distribution center P times, so that the key distribution center verifies the first device according to the pre-shared keys.

6. The quantum session key negotiation method according to claim 1, characterized in that: The first device and the second device respectively store the same key derivation function, the key derivation function corresponds to both the first device and the second device, and the first device generates the second key according to the M first keys, comprising: The first device uses a key derivation function corresponding to the second device to operate on the M first keys to generate the second key.

7. The quantum session key negotiation method according to any one of claims 1 to 6, characterized in that: Also includes: The first device randomly determines the number of key distribution centers to be used; The first device selects the at least one key distribution center from available key distribution centers according to the number of the used key distribution centers; The first device records an identifier of the at least one key distribution center.

8. A quantum session key negotiation method, characterized in that: include: The second device receives N first keys from at least one key distribution center, N≥2; The second device randomly selects M first keys from the N first keys, 1≤M≤N; The second device generates key sequence number notification information according to the sequence numbers of the M first keys, and sends the key sequence number notification information to the first device; The second device generates a second key according to the M first keys, and sets the second key as a quantum session key for communicating with the first device.

9. The quantum session key negotiation method according to claim 8, characterized in that: The second device receiving N first keys from at least one key distribution center includes: The second device decrypts the information from the key distribution center using at least one pre-shared key corresponding to the key distribution center to obtain the first key.

10. The quantum session key negotiation method according to claim 8, characterized in that: The first device and the second device respectively store the same key derivation function, the key derivation function corresponds to both the first device and the second device, and the second device generates a second key according to the M first keys, comprising: The second device uses a key derivation function corresponding to the first device to operate on the M first keys to generate the second key.

11. A quantum session key negotiation method, characterized in that: include: The key distribution center receives key forwarding information from the first device; The key distribution center obtains at least one first key and a second device as a forwarding destination according to the key forwarding information; The key distribution center forwards the at least one first key to the second device.

12. The quantum session key negotiation method according to claim 11, characterized in that: The key distribution center acquiring at least one first key according to the key forwarding information includes: The key distribution center decrypts the key forwarding information according to at least one pre-shared key corresponding to the first device to obtain the first key.

13. The quantum session key negotiation method according to claim 11, characterized in that: The key distribution center forwarding the at least one first key to the second device includes: The key distribution center uses at least one pre-shared key corresponding to the second device to encrypt the at least one first key respectively, and sends the encrypted at least one first key to the second device respectively.

14. A quantum key distribution system, characterized in that: include: A first device, configured to execute the quantum session key negotiation method according to any one of claims 1 to 7; A second device, configured to execute the quantum session key negotiation method as described in any one of claims 8 to 10; At least one key distribution center, used to execute the quantum session key agreement method as described in any one of claims 11-13.

Images