Distributed quantum network management system

Abstract

The embodiment of the invention provides a distributed quantum network management system. The system comprises a network management center, a proxy server and equipment, the network management center is used for sending a data acquisition request to the proxy server according to a first key identification code corresponding to the network management center and a second key identification code corresponding to the proxy server; the data acquisition request carries a first encrypted ciphertext and a second key identification code, the first encrypted ciphertext is obtained by encrypting a data acquisition signal through the first key identification code, and the data acquisition signal is used for indicating acquisition of device data of the target device; the proxy server is used for decrypting the first encrypted ciphertext according to the second key identification code to obtain a data acquisition signal; collecting device data of the target device; encrypting the equipment data to obtain a second encrypted ciphertext, and sending the second encrypted ciphertext to a network management center; and the network management center is also used for decrypting the second encrypted ciphertext to obtain the device data of the target device, so that the security of data transmission can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of quantum secure communication, and in particular to a distributed quantum network management system. Background Art

[0002] With the development of the Internet, important data such as personal privacy, commercial information, and national security are constantly carried on large-scale and diverse modern communication networks. Ensuring network information security is related to the interests of individuals, enterprises, countries, and the global society. With the continuous development of quantum communication and the application of quantum key distribution technology, the construction scale and service scope of quantum networks are also expanding. In order to safely and compatiblely access multiple devices, a network management system is deployed in the quantum network. Most of the existing network management systems are set up using traditional centralized architectures, which have poor scalability and flexibility, low availability, and insufficient data transmission security between devices. Summary of the invention

[0003] In order to solve the above problems, an embodiment of the present invention discloses a distributed quantum network management system.

[0004] In a first aspect, an embodiment of the present invention provides a distributed quantum network management system, the system comprising: a network management center, a proxy server and a device;

[0005] The network management center is used to obtain a first key identification code corresponding to the network management center and a second key identification code corresponding to the proxy server; according to the first key identification code and the second key identification code, send a data collection request to the proxy server; the data collection request carries a first encrypted ciphertext and the second key identification code, the first encrypted ciphertext is obtained by encrypting a data collection signal through the first key identification code, and the data collection signal is used to indicate the device data of the target device to be collected;

[0006] The proxy server is used to receive the data collection request sent by the network management center; decrypt the first encrypted ciphertext according to the second key identification code to obtain the data collection signal; collect the device data of the target device according to the data collection signal; encrypt the device data of the target device to obtain a second encrypted ciphertext; and send the second encrypted ciphertext to the network management center;

[0007] The network management center is also used to receive the second encrypted ciphertext sent by the proxy server; decrypt the second encrypted ciphertext to obtain the device data of the target device.

[0008] Optionally, it further includes: a first encryption machine, a first security server, a second encryption machine and a second security server; the first encryption machine and the first security server are associated with the network management center, and the second encryption machine and the second security server are associated with the proxy server;

[0009] The network management center is further used to send an encryption key acquisition request to the first security server;

[0010] The first security server is used to negotiate with the second security server to obtain an encryption key according to the encryption key acquisition request sent by the network management center; and send the encryption key to the first encryption machine;

[0011] The second security server is used to negotiate with the first security server to obtain an encryption key; and send the encryption key to the second encryption machine;

[0012] The first encryption machine is used to generate the first key identification code corresponding to the network management center according to the first identifier corresponding to the network management center; and send the first key identification code to the first security server;

[0013] The second encryption machine is used to generate the second key identification code corresponding to the proxy server according to the second identifier corresponding to the proxy server; send the second key identification code to the second security server, so that the second security server sends the second key identification code to the first security server;

[0014] The first security server is further configured to send the first key identification code and the second key identification code to the network management center.

[0015] Optionally, the network management center is used to obtain the first key identification code and the second key identification code sent by the first security server; send a first encryption request carrying the data acquisition signal to the first encryption machine; obtain the first encrypted ciphertext generated by the first encryption machine according to the first key identification code; send the data acquisition request carrying the first encrypted ciphertext and the second key identification code to the proxy server;

[0016] The proxy server is used to receive the data collection request sent by the network management center; send a first decryption request carrying the first encrypted ciphertext to the second encryption machine; obtain a data collection signal obtained by the second encryption machine decrypting the second key identification code; collect device data of the target device according to the data collection signal; send a second encryption request carrying the device data of the target device to the second encryption machine; obtain a second encrypted ciphertext generated by the second encryption machine according to the second encryption request; and send the second encrypted ciphertext to the network management center;

[0017] The network management center is used to receive the second encrypted ciphertext sent by the proxy server; send a second decryption request carrying the second encrypted ciphertext to the first encryption machine; and obtain the device data of the target device decrypted by the first encryption machine.

[0018] Optionally, the proxy server includes multiple ones, and the network management center is deployed with multiple proxy controllers; the proxy controllers correspond to the proxy servers one by one;

[0019] The proxy controller is used to receive the data collection request sent by the network management center according to a preset association relationship, where the preset association relationship is used to indicate the proxy controller corresponding to the target device; send the data collection request to the corresponding proxy server; receive the device data of the target device returned by the proxy server according to the data collection request; and send the device data of the target device to the network management center.

[0020] Optionally, the proxy server is deployed with a northbound interface; the proxy server includes a first mode and a second mode;

[0021] The proxy server is used to call the northbound interface to collect device data of the target device according to the data collection signal in the first mode; and call the northbound interface to send the device data of the target device to the network management center in the second mode.

[0022] Optionally, the northbound interface corresponding to the first mode includes: a basic information collection interface, a performance information collection interface, a business information collection interface and a log information collection interface, and a configuration delivery interface, at least one of them;

[0023] The proxy server is used to call the basic information collection interface to collect the preset hardware data of the target device when the data collection signal indicates collecting the preset hardware data of the target device; and / or, when the data collection signal indicates collecting the software performance data of the target device, call the performance information collection interface to collect the software performance data of the target device; and / or, when the data collection signal indicates collecting the communication transmission data of the target device, call the business information collection interface to collect the communication transmission data of the target device; and / or, when the data collection signal indicates collecting the historical data of the target device, call the log information collection interface to collect the historical data of the target device; and / or, when the data collection signal indicates collecting the configuration information data of the target device, call the configuration sending interface to collect the configuration information data of the target device.

[0024] Optionally, the northbound interface corresponding to the second mode includes: an alarm information reporting interface;

[0025] The proxy server is used to call the alarm information reporting interface to send the alarm information of the target device to the network management center.

[0026] Optionally, the proxy server is also used to collect network data of the quantum network where the device is located according to a preset period; call the northbound interface to send the network data to the network management center; the network data includes: encryption key generation amount, encryption key consumption, real-time coding rate, original coding rate, average coding rate, ground state error rate, bit error rate, quantum bit state, entanglement quality, quantum channel attenuation, network throughput, network delay, at least one of them.

[0027] Optionally, the network management center is further used to receive the network data sent by the proxy server; when the network data reaches a first preset condition, output an alarm message; when the network data reaches a second preset condition, adjust the quantum network according to a preset strategy.

[0028] Optionally, the network management center further includes a data management module and a data storage module;

[0029] The data management module is used to classify the device data of the target device and display the device data of the target device;

[0030] The data storage module is used to store the device data of the target device.

[0031] The embodiments of the present invention include the following advantages:

[0032] The distributed quantum network management system of the embodiment of the present invention includes: a network management center, a proxy server and a device. The distributed architecture system has the characteristics of high performance, flexible expansion and high availability; the network management center is used to send a data acquisition request to the proxy server according to the first key identification code corresponding to the network management center and the second key identification code corresponding to the proxy server; the data acquisition request carries a first encrypted ciphertext and a second key identification code, the first encrypted ciphertext is obtained by encrypting the data acquisition signal by the first key identification code, and the data acquisition signal is used to indicate the device data of the target device to be collected; the proxy server is used to decrypt the first encrypted ciphertext according to the second key identification code to obtain a data acquisition signal; collect the device data of the target device; encrypt the device data to obtain the second encrypted ciphertext, and send it to the network management center; the network management center is also used to decrypt the second encrypted ciphertext to obtain the device data of the target device, so that the signal and data transmission process are fully encrypted, and the security of data transmission between the system and the device is realized. At the same time, the embodiment of the present invention can also monitor and operate the quantum network to ensure the stability of the system operation. Moreover, the embodiment of the present invention can also set a unified northbound interface based on the distributed quantum network management system, so that the access area subnet can be flexibly expanded and compatible with a variety of devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0034] Figure 1 is a structural block diagram of a distributed quantum network management system according to an embodiment of the present invention;

[0035] Figure 2 is a structural block diagram of another distributed quantum network management system according to an embodiment of the present invention;

[0036] Figure 3 is a logic diagram of a distributed quantum network management system according to an embodiment of the present invention;

[0037] Figure 4 It is a structural block diagram of another distributed quantum network management system according to an embodiment of the present invention.

[0038] Description of reference numerals:

[0039] The network management center 11 , the proxy server 12 , the device 13 , the proxy controller 21 , the first encryption machine 31 , the first security server 32 , the second encryption machine 33 , the second security server 34 , the data management module 41 , and the data storage module 42 . DETAILED DESCRIPTION

[0040] The present invention proposes a distributed quantum network management system, the purpose of which is to improve the security of data transmission between the system and the device. To achieve this goal, the embodiment of the present invention encrypts the data acquisition signal of the network management center and the device data collected by the proxy server, thereby ensuring the security of data transmission in the quantum network management system with a distributed architecture.

[0041] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] Reference Figure 1 , shows a structural block diagram of a distributed quantum network management system according to an embodiment of the present invention, the system comprising: a network management center 11, a proxy server 12 and a device 13;

[0043] The network management center 11 is used to obtain a first key identification code corresponding to the network management center 11 and a second key identification code corresponding to the proxy server 12; according to the first key identification code and the second key identification code, send a data acquisition request to the proxy server 12; the data acquisition request carries a first encrypted ciphertext and the second key identification code, the first encrypted ciphertext is obtained by encrypting a data acquisition signal through the first key identification code, and the data acquisition signal is used to indicate the acquisition of device data of a target device 13;

[0044] The proxy server 12 is used to receive the data collection request sent by the network management center 1; decrypt the first encrypted ciphertext according to the second key identification code to obtain the data collection signal; collect the device data of the target device 13 according to the data collection signal; encrypt the device data of the target device 13 to obtain a second encrypted ciphertext; and send the second encrypted ciphertext to the network management center 11;

[0045] The network management center 11 is further used to receive the second encrypted ciphertext sent by the proxy server 12 ; decrypt the second encrypted ciphertext to obtain the device data of the target device 13 .

[0046] In an embodiment of the present invention, a distributed quantum network management system includes: a network management center, a proxy server and a device, and has the characteristics of high performance, flexible expansion and high availability. The network management center can send a data acquisition request to the proxy server according to the first key identification code corresponding to the network management center and the second key identification code corresponding to the proxy server. The data acquisition request carries a first encrypted ciphertext and a second key identification code, wherein the first encrypted ciphertext is obtained by encrypting the data acquisition signal by the first key identification code, and the data acquisition signal is used to indicate the device data of the target device to be collected. The proxy server can decrypt the first encrypted ciphertext according to the second key identification code to obtain a data acquisition signal, collect the device data of the target device according to the indication of the data acquisition signal, and then encrypt the device data to obtain a second encrypted ciphertext, and return the second encrypted ciphertext to the network management center, so that the network management center decrypts the second encrypted ciphertext to obtain the device data of the target device. The embodiment of the present invention encrypts the entire process of signal and data transmission, thereby achieving the security of data transmission between the system and the device.

[0047] Reference Figure 2 , shows a structural block diagram of another distributed quantum network management system according to an embodiment of the present invention, wherein the proxy server 12 includes a plurality of proxy servers, and the network management center 11 is deployed with a plurality of proxy controllers 21; the proxy controllers 21 correspond one to one with the proxy servers 12;

[0048] The agent controller 21 is used to receive the data collection request sent by the network management center 11 according to a preset association relationship, and the preset association relationship is used to indicate the agent controller 21 corresponding to the target device 13; send the data collection request to the corresponding agent server 12; receive the device data of the target device 13 returned by the agent server 12 according to the data collection request; and send the device data of the target device 13 to the network management center 11.

[0049] In an embodiment of the present invention, a plurality of proxy controllers are deployed in the network management center, and the proxy controllers correspond to the proxy servers one by one. Among them, the devices may include quantum devices, cryptographic devices and classical devices, and the proxy servers may include quantum key distribution servers (QKDNC), password management servers (KMS) and classical layer signal transmission servers (CLS). The preset association relationship may be: quantum devices are associated with proxy controllers corresponding to quantum key distribution servers one by one, cryptographic devices are associated with proxy controllers corresponding to password management servers one by one, and classical devices are associated with proxy controllers corresponding to classical layer signal transmission servers one by one. The proxy controller may send the data collection request of the network management center to the proxy server corresponding to the target device, so that the proxy server collects the device data of the target device according to the data collection request, and sends the device data of the target device to the network management center after data filtering and data analysis.

[0050] In one embodiment, the proxy server 12 is deployed with a northbound interface; the proxy server 12 includes a first mode and a second mode;

[0051] The proxy server 12 is used to call the northbound interface to collect device data of the target device 13 according to the data acquisition signal in the first mode; and call the northbound interface to send the device data of the target device 13 to the network management center 11 in the second mode.

[0052] The northbound interface corresponding to the first mode includes: a basic information collection interface, a performance information collection interface, a business information collection interface and a log information collection interface, and a configuration delivery interface, at least one of them; the northbound interface corresponding to the second mode includes: an alarm information reporting interface;

[0053] The proxy server 12 is used to call the basic information collection interface to collect the preset hardware data of the target device when the data collection signal indicates the collection of preset hardware data of the target device; and / or, when the data collection signal indicates the collection of software performance data of the target device, call the performance information collection interface to collect the software performance data of the target device; and / or, when the data collection signal indicates the collection of communication transmission data of the target device, call the business information collection interface to collect the communication transmission data of the target device; and / or, when the data collection signal indicates the collection of historical data of the target device, call the log information collection interface to collect the historical data of the target device; and / or, when the data collection signal indicates the collection of configuration information data of the target device, call the configuration sending interface to collect the configuration information data of the target device.

[0054] The proxy server is used to call the alarm information reporting interface to send the alarm information of the target device to the network management center.

[0055] In an embodiment of the present invention, the proxy server can securely access quantum devices, cryptographic devices, and classical devices through a unified northbound interface standard. The proxy server can define a northbound interface, design a specific protocol message structure and rules for the interface, and set a first mode and a second mode. In the first mode, that is, when the pre-set data transmission rule is a pull PULL mode, the proxy controller can call the northbound interface to the proxy server to collect device data of the target device according to the data acquisition signal. In the second mode, that is, when the pre-set data transmission rule is a pull PUSH mode, the proxy controller can obtain the device data pushed by the proxy server to the message middleware.

[0056] Among them, the northbound interface can include: basic information collection interface, performance information collection interface, business information collection interface, log information collection interface, configuration delivery interface, alarm information reporting interface, etc. The northbound interface is designed based on restful (Representational State Transfer, a software architecture style).

[0057] Exemplarily, when the data transmission rule is the pull mode, and the data collection signal carries deviceId (unique identifier of the target device) to indicate the collection of preset hardware data of the target device, the proxy server can call the basic information collection interface to collect the preset hardware data of the target device. The preset hardware data may include deviceId (unique identifier of the device), deviceType (device type), deviceArea (device area), deviceName (device name), deviceEquipment (device manufacturer), deviceVersion (device version), and macAddress (MAC address);

[0058] When the data transmission rule is the pull mode, and the data collection signal carries deviceId (unique identifier of the target device) to indicate the collection of software performance data of the target device, the proxy server can call the performance information collection interface to collect the software performance data of the target device. The software performance data may include deviceId (unique identifier of the device), deviceType (device type), cpuUse (CPU usage), memoryUse (memory usage), diskUse (disk usage), bandwidth (bandwidth), temperature (device temperature), fanSpeed ​​(fan speed), deviceStatus (device status), and deviceRunningTime (device running time);

[0059] When the data transmission rule is the pull mode, and the data collection signal carries deviceId (unique identifier of the target device) to indicate the collection of communication transmission data of the target device, the proxy server can call the business information collection interface to collect the communication transmission data of the target device. The communication transmission data may include deviceId (unique identifier of the device), deviceType (device type), syKeyEncryptionRate (symmetric key encryption rate), syKeyDecryptionRate (symmetric key decryption rate), productionMacRate (mac generation rate), verifyingMacRate (mac verification rate), hmacGenerationRate (hmac generation rate), verifyHmacRate (hmac verification rate), asyPubKeyEncryptionRate (asymmetric public key encryption rate), asyPrvKeyDecryptionRate (asymmetric private key decryption rate), asyPrvKkeyS gnatureRate (asymmetric private key signature rate), asyPubKeySignatureRate (asymmetric public key signature rate), secretKeyProduction (key generation amount), secretKeyConsumption (key consumption amount), currentCodeFormationRate (real-time coding rate), primitiveCodeFormationRate (original coding rate), avgCodeFormationRate (average coding rate), misjudgmentRate (ground state misjudgment rate), errorRate (bit error rate data), flowRate (flow data), qubitState (quantum bit state), entMass (entanglement quality), quantChannelAtte (quantum channel attenuation), netThroughput (network throughput), netDelay (network delay), algorithm (encryption and decryption algorithm support), operate (operator);

[0060] When the data transmission rule is the pull mode, the data collection signal carries deviceId (unique identifier of the target device), logType (log type), startTime (log start time), endTime (log end time), pageNum (log page), pageSize (log page size), indicating the collection of historical data of the target device, the proxy server can call the log information collection interface to collect the historical data of the target device, and the historical data may include logContent (log content);

[0061] When the data transmission rule is the pull mode, the data collection signal carries deviceId (unique identifier of the target device), configType (configuration type), and configParam (configuration parameters), indicating the collection of configuration information data of the target device, the proxy server can call the configuration delivery interface to collect the configuration information data of the target device, and the configuration information data may include configResult (configuration result).

[0062] When the data transmission rule is the pull PUSH mode, the proxy server can call the alarm information reporting interface to send the alarm information of the target device to the network management center. The alarm information may include deviceId (device unique identifier), deviceType (device type), alarmLevel (alarm level), alarmType (alarm type), alarmTime (alarm time), alarmLocation (alarm location), alarmStatus (alarm status), alarmContent (alarm content), and alarmExt (extended information).

[0063] Reference Figure 3 , shows a logic diagram of a distributed quantum network management system provided by an embodiment of the present invention. The system also includes: a first encryption machine 31, a first security server 32, a second encryption machine 33 and a second security server 34; the first encryption machine 31 and the first security server 32 are associated with the network management center 11, and the second encryption machine 33 and the second security server 34 are associated with the proxy server 12;

[0064] The network management center 11 is further used to send an encryption key acquisition request to the first security server 32;

[0065] The first security server 32 is used to negotiate with the second security server 34 to obtain the encryption key according to the encryption key acquisition request sent by the network management center 11; and send the encryption key to the first encryption machine 31;

[0066] The second security server 34 is used to negotiate with the first security server 32 to obtain an encryption key; and send the encryption key to the second encryption machine 33;

[0067] The first encryption machine 31 is used to generate the first key identification code corresponding to the network management center 11 according to the first identification code corresponding to the network management center 11; and send the first key identification code to the first security server 32;

[0068] The second encryption machine 33 is used to generate the second key identification code corresponding to the proxy server 12 according to the second identifier corresponding to the proxy server 12; send the second key identification code to the second security server 34, so that the second security server 34 sends the second key identification code to the first security server 32;

[0069] The first security server 32 is further configured to send the first key identification code and the second key identification code to the network management center 11 .

[0070] The network management center 11 is used to obtain the first key identification code and the second key identification code sent by the first security server 32; send the first encryption request carrying the data acquisition signal to the first encryption machine 31; obtain the first encrypted ciphertext generated by the first encryption machine 31 according to the first key identification code; send the data acquisition request carrying the first encrypted ciphertext and the second key identification code to the proxy server 12;

[0071] The proxy server 12 is used to receive the data collection request sent by the network management center 11; send a first decryption request carrying the first encrypted ciphertext to the second encryption machine 33; obtain the data collection signal obtained by the second encryption machine 33 decrypting the second key identification code; collect the device data of the target device 13 according to the data collection signal; send a second encryption request carrying the device data of the target device 13 to the second encryption machine 33; obtain the second encrypted ciphertext generated by the second encryption machine 33 according to the second encryption request; and send the second encrypted ciphertext to the network management center 11;

[0072] The network management center 11 is used to receive the second encrypted ciphertext sent by the proxy server 12; send a second decryption request carrying the second encrypted ciphertext to the first encryption machine 31; and obtain the device data of the target device 13 decrypted by the first encryption machine 31.

[0073] In the embodiment of the present invention, Figure 3 As shown in the figure, the process of data transmission encryption by the distributed quantum network management system is as follows:

[0074] (1) The network management center sends an encryption key acquisition request to the first security server to establish a secure channel for communication between the network management center and the proxy server;

[0075] (2) The first security server negotiates with the second security server to obtain the encryption key according to the encryption key acquisition request;

[0076] (3) The first security server sends the encryption key to the first encryption machine;

[0077] (4) The second security server sends the encryption key to the second encryption machine;

[0078] (5) The first encryption machine generates a first key identification code corresponding to the network management center according to the first identifier corresponding to the network management center; and sends the first key identification code to the first security server;

[0079] (6) the second encryption machine generates a second key identification code corresponding to the proxy server according to the second identifier corresponding to the proxy server; and sends the second key identification code to the second security server;

[0080] (7) The second security server sends the second key identification code to the first security server;

[0081] (8) The first security server sends the first key identification code and the second key identification code to the network management center;

[0082] (9) The network management center obtains the first key identification code and the second key identification code sent by the first security server; and sends a first encryption request carrying a data collection signal to the first encryption machine;

[0083] (10) The first encryption machine generates a first encrypted ciphertext according to the first key identification code, and sends the first encrypted ciphertext to the network management center;

[0084] (11) The network management center sends a data collection request carrying the first encrypted ciphertext and the second key identification code to the proxy server;

[0085] (12) The proxy server receives the data collection request sent by the network management center; and sends a first decryption request carrying the first encrypted ciphertext to the second encryption machine;

[0086] (13) The second encryption machine decrypts the data acquisition signal obtained according to the second key identification code, and sends the data acquisition signal to the proxy server;

[0087] (14) The proxy server collects device data of the target device according to the data collection signal; and sends a second encryption request carrying the device data of the target device to the second encryption machine;

[0088] (15) The second encryption machine generates a second encrypted ciphertext according to the second encryption request, and sends the second encrypted ciphertext to the proxy server;

[0089] (16) The proxy server sends the second encrypted ciphertext to the network management center;

[0090] (17) The network management center receives the second encrypted ciphertext sent by the proxy server; and sends a second decryption request carrying the second encrypted ciphertext to the first encryption machine;

[0091] (18) The first encryption machine decrypts and obtains the device data of the target device, and sends the device data of the target device to the network management center.

[0092] The embodiment of the present invention negotiates encryption keys through an independent security server and a cryptographic machine, and encrypts the data acquisition signal of the network management center and the device data collected by the proxy server through the encryption key, thereby ensuring the security of data transmission in a quantum network management system with a distributed architecture.

[0093] In one embodiment, the proxy server is also used to collect network data of the quantum network where the device is located according to a preset period; call the northbound interface to send the network data to the network management center; the network data includes: encryption key generation amount, encryption key consumption, real-time coding rate, original coding rate, average coding rate, ground state error rate, bit error rate, quantum bit state, entanglement quality, quantum channel attenuation, network throughput, network delay, at least one of them.

[0094] The network management center is also used to receive the network data sent by the proxy server; when the network data reaches a first preset condition, output an alarm message; when the network data reaches a second preset condition, adjust the quantum network according to a preset strategy.

[0095] In an embodiment of the present invention, the proxy server can collect network data of the quantum network where the device is located according to a preset period, and after performing data cleaning, data normalization, data standardization, data inheritance and aggregation, and data calculation on the network data through the proxy controller, the network data is sent to the network management center. The preset period can be flexibly set according to the data update frequency. Exemplarily, the preset period for data with a high update frequency can be set shorter, and the preset period for data with a low update frequency can be set longer, and the data collection time for data with an update frequency greater than 24 hours can be placed at night. Among them, the network data may include: encryption key generation amount, encryption key consumption amount, real-time coding rate, original coding rate, average coding rate, ground state error rate, bit error rate, quantum bit state, entanglement quality, quantum channel attenuation, network throughput, network delay, etc.

[0096] The network management center can output alarm information when the network data reaches the first preset condition; when the network data reaches the second preset condition, the quantum network can be adjusted according to the preset strategy. Specifically, the network management center can automatically generate an alarm when the network data reaches the first preset condition, such as through email, text message, instant messaging tools, and perform alarm record analysis and post-event tracking. At the same time, when the network data reaches the second preset condition, the channel parameters of the quantum network can be automatically adjusted or the device can be restarted to locate and restore the fault. Among them, the first preset condition can be that the network data is abnormal and the data cannot be transmitted, and the second preset condition can be that the network data is abnormal and the data is transmitted normally.

[0097] Reference Figure 4 , showing a structural block diagram of another distributed quantum network management system provided by an embodiment of the present invention, the network management center 11 further includes a data management module 41 and a data storage module 42;

[0098] The data management module 41 is used to classify the device data of the target device 13 and display the device data of the target device 13;

[0099] The data storage module 42 is used to store the device data of the target device 13 .

[0100] In an embodiment of the present invention, the data management module may include a homepage large screen unit, a resource management unit, a network topology management unit, a configuration management unit, an alarm management unit, a performance management unit, a security management unit, and a system management unit. Among them, the homepage large screen unit is used to display the quantum network link distribution, the performance data trend of the managed equipment, and the alarm overview of the managed equipment; the resource management unit is used to manage the proxy controller resources, equipment resources, subnet resources, and acquisition and control proxy server resources, and the proxy server includes a quantum key distribution server, a password management server, and a classical layer signal transmission server. The network topology management unit is used for equipment topology map display and topology automatic discovery. The configuration management unit is used to view and edit important configurations of managed equipment. The alarm management unit is used to view, process, and analyze and count equipment alarm records. The performance management unit is used for real-time display, query, editing, statistical analysis, and intelligent automatic adjustment of equipment performance. The security management unit is used for system threat detection and defense, system regular vulnerability scanning and assessment, disaster recovery and backup. The system management unit is used for user, role, tenant, menu management, and dictionary management.

[0101] The data storage module may include a device information data unit, a device system performance data unit, a device business performance data unit, an alarm data unit, and a log data unit. Among them, the device information data unit is used for the unified storage of basic information data of quantum, cryptographic, and classical devices. The device system performance data unit is used for the unified storage of system performance data of quantum, cryptographic, and classical devices. The device business performance data unit is used for the unified storage of business performance data of quantum, cryptographic, and classical devices. The alarm data unit is used for the unified storage of alarm data of quantum, cryptographic, and classical devices. The log data unit is used for the unified storage of log data of quantum, cryptographic, and classical devices.

[0102] The distributed quantum network management system of the embodiment of the present invention includes: a network management center, a proxy server and a device, wherein the proxy server includes multiple proxy servers, and the network management center is deployed with multiple proxy controllers, and the proxy controllers correspond one to one with the proxy servers, and have the characteristics of high performance, flexible expansion and high availability. Encryption key negotiation is performed through an independent security server and a cipher machine, and the data acquisition signal of the network management center and the device data collected by the proxy server are encrypted through the encryption key, so that the security of data transmission can be guaranteed in the quantum network management system of the distributed architecture. At the same time, the embodiment of the present invention can also monitor and operate the quantum network to ensure the stability of the system operation. Moreover, the embodiment of the present invention can also set a unified northbound interface based on the distributed quantum network management system, so that the access area subnet can be flexibly expanded and compatible with a variety of devices.

[0103] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0104] Those skilled in the art will appreciate that the embodiments of the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more machine-readable media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0105] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0106] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0108] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0109] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0110] The above is a detailed introduction to a distributed quantum network management system provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A distributed quantum network management system, characterized in that: include: Network management center, proxy servers and equipment; The network management center is used to obtain a first key identification code corresponding to the network management center and a second key identification code corresponding to the proxy server; according to the first key identification code and the second key identification code, send a data collection request to the proxy server; the data collection request carries a first encrypted ciphertext and the second key identification code, the first encrypted ciphertext is obtained by encrypting a data collection signal through the first key identification code, and the data collection signal is used to indicate the device data of the target device to be collected; The proxy server is used to receive the data collection request sent by the network management center; decrypt the first encrypted ciphertext according to the second key identification code to obtain the data collection signal; According to the data acquisition signal, collecting device data of the target device; encrypting the device data of the target device to obtain a second encrypted ciphertext; and sending the second encrypted ciphertext to the network management center; The network management center is also used to receive the second encrypted ciphertext sent by the proxy server; decrypt the second encrypted ciphertext to obtain the device data of the target device.

2. The system according to claim 1, characterized in that Also includes: A first encryption machine, a first security server, a second encryption machine and a second security server; the first encryption machine and the first security server are associated with the network management center, and the second encryption machine and the second security server are associated with the proxy server; The network management center is further used to send an encryption key acquisition request to the first security server; The first security server is used to negotiate with the second security server to obtain an encryption key according to the encryption key acquisition request sent by the network management center; and send the encryption key to the first encryption machine; The second security server is used to negotiate with the first security server to obtain an encryption key; sending the encryption key to the second encryption machine; The first encryption machine is used to generate the first key identification code corresponding to the network management center according to the first identifier corresponding to the network management center; and send the first key identification code to the first security server; The second encryption machine is used to generate the second key identification code corresponding to the proxy server according to the second identifier corresponding to the proxy server; send the second key identification code to the second security server, so that the second security server sends the second key identification code to the first security server; The first security server is further configured to send the first key identification code and the second key identification code to the network management center.

3. The system according to claim 2, characterized in that The network management center is used to obtain the first key identification code and the second key identification code sent by the first security server; send the first encryption request carrying the data acquisition signal to the first encryption machine; obtain the first encrypted ciphertext generated by the first encryption machine according to the first key identification code; send the data acquisition request carrying the first encrypted ciphertext and the second key identification code to the proxy server; The proxy server is used to receive the data collection request sent by the network management center; Sending a first decryption request carrying the first encrypted ciphertext to the second encryption machine; obtaining a data acquisition signal obtained by the second encryption machine through decryption according to the second key identification code; and acquiring device data of the target device according to the data acquisition signal; Sending a second encryption request carrying the device data of the target device to the second encryption machine; Obtaining a second encrypted ciphertext generated by the second encryption machine according to the second encryption request; Sending the second encrypted ciphertext to the network management center; The network management center is used to receive the second encrypted ciphertext sent by the proxy server; send a second decryption request carrying the second encrypted ciphertext to the first encryption machine; and obtain the device data of the target device decrypted by the first encryption machine.

4. The system according to claim 1, characterized in that The proxy servers include multiple ones, and the network management center is deployed with multiple proxy controllers; the proxy controllers correspond one to one with the proxy servers; The proxy controller is used to receive the data collection request sent by the network management center according to a preset association relationship, and the preset association relationship is used to indicate the proxy controller corresponding to the target device; Sending the data collection request to the corresponding proxy server; Receive the device data of the target device returned by the proxy server according to the data collection request; and send the device data of the target device to the network management center.

5. The system according to claim 1, characterized in that The proxy server is deployed with a northbound interface; the proxy server includes a first mode and a second mode; The proxy server is used to call the northbound interface to collect device data of the target device according to the data collection signal in the first mode; and call the northbound interface to send the device data of the target device to the network management center in the second mode.

6. The system according to claim 5, characterized in that The northbound interface corresponding to the first mode includes: a basic information collection interface, a performance information collection interface, a business information collection interface and a log information collection interface, and a configuration delivery interface, at least one of them; The proxy server is used to call the basic information collection interface to collect the preset hardware data of the target device when the data collection signal indicates collecting the preset hardware data of the target device; and / or, when the data collection signal indicates collecting the software performance data of the target device, call the performance information collection interface to collect the software performance data of the target device; and / or, when the data collection signal indicates collecting the communication transmission data of the target device, call the business information collection interface to collect the communication transmission data of the target device; and / or, when the data collection signal indicates collecting the historical data of the target device, call the log information collection interface to collect the historical data of the target device; and / or, when the data collection signal indicates collecting the configuration information data of the target device, call the configuration sending interface to collect the configuration information data of the target device.

7. The system according to claim 5, characterized in that The northbound interface corresponding to the second mode includes: an alarm information reporting interface; The proxy server is used to call the alarm information reporting interface to send the alarm information of the target device to the network management center.

8. The system according to claim 5, characterized in that The proxy server is also used to collect network data of the quantum network where the device is located according to a preset period; call the northbound interface to send the network data to the network management center; the network data includes: encryption key generation amount, encryption key consumption amount, real-time coding rate, original coding rate, average coding rate, ground state error rate, bit error rate, quantum bit state, entanglement quality, quantum channel attenuation, network throughput, network delay, at least one of them.

9. The system according to claim 8, characterized in that The network management center is also used to receive the network data sent by the proxy server; when the network data reaches a first preset condition, output an alarm message; when the network data reaches a second preset condition, adjust the quantum network according to a preset strategy.

10. The system according to claim 1, characterized in that The network management center also includes a data management module and a data storage module; The data management module is used to classify the device data of the target device and display the device data of the target device; The data storage module is used to store the device data of the target device.

Images