QKD and global quantum security fused quantum security communication method

Abstract

The invention relates to the technical field of information security, in particular to a quantum security communication method with QKD (quantum key distribution) and global quantum security fusion. In the scheme of the invention, for the quantum security terminals deployed in the same basic service area, the communication data is encrypted by using the quantum security keys distributed by the key center, so that the security of communication is ensured. And relaying the quantum security key among the basic service areas through a boundary base station, and distributing symmetric quantum keys among the basic service areas by using a QKD key distribution channel so as to encrypt the relayed quantum security key. The process ensures the security of cross-service area communication, and enables the network topology to have a high degree of adaptability. The end-to-end encryption communication between the quantum security terminals is realized, and the privacy of user data is effectively protected.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a quantum security communication method integrating QKD with global quantum security. Background Art

[0002] At present, quantum key distribution (QKD) technology is mainly used to distribute quantum keys between various nodes. However, this key distribution method cannot directly transmit quantum keys to the terminals of users or IoT devices. As a result, in the actual scenarios of data generation and consumption, user devices or IoT devices are not completely protected by quantum security, resulting in the security of the entire communication process cannot be fully guaranteed.

[0003] In addition, since user devices and IoT devices are usually mobile, have complex and diverse environments, and have simple and economical equipment, the existing QKD technology has the following problems when applied to these devices:

[0004] Deploying dedicated fiber and optical equipment on user equipment or IoT devices will result in high costs for end users.

[0005] The installation and use of dedicated optical fibers and optical equipment limits the mobility of equipment and brings inconvenience to users.

[0006] In summary, the existing QKD technology has shortcomings in realizing quantum key distribution of user devices or IoT device terminals, and brings great cost burden and inconvenience to end users in practical applications. Summary of the invention

[0007] To solve the above problems, the present application discloses a quantum security communication method integrating QKD and global quantum security, comprising the following steps:

[0008] Establishing communication connections for quantum security devices belonging to the same basic service area according to network topology planning, wherein the quantum security devices belonging to the same basic service area include quantum security terminals, access base stations, key centers and border base stations, the quantum security terminals are connected to the access base stations, the key centers are connected to the access base stations in communication, and the access base stations are connected to the border base stations in communication;

[0009] Establishing a QKD key distribution channel and a classical communication channel between two basic service areas that need to communicate, wherein the QKD key distribution channel is respectively connected to the boundary base stations of the two basic service areas, and symmetric quantum keys are distributed to the two boundary base stations through the QKD key distribution channel;

[0010] When quantum security terminals belonging to the same basic service area communicate with each other, they send communication data encrypted by quantum security keys through the local network; and use the access base station to relay the quantum security key used to encrypt the communication data to the receiving end;

[0011] When quantum security terminals communicate between basic service areas, the sender uses its own quantum security key to encrypt data and sends the encrypted ciphertext to the receiver through the classical communication channel between the basic service areas; at the same time, the sender encrypts the quantum security key used for encryption and forwards it to the corresponding access base station, which is decrypted by the access base station and forwarded to the border base station at the sender, and then encrypted by the border base station and forwarded to the border base station at the receiver. Among them, the key used by the border base station to encrypt the quantum security key is a symmetric quantum key distributed and successfully verified through the QKD key distribution channel.

[0012] The process of distributing symmetric quantum keys to the two boundary base stations through the QKD key distribution channel includes:

[0013] The sender sends a series of polarized photons to the receiver through a quantum channel, where each photon represents a bit of the key.

[0014] The receiver measures each received photon using its own randomly chosen basis state;

[0015] A verification process is performed between the sender and the receiver, and the parts that are consistent with the verification are retained as the distributed symmetric quantum key.

[0016] The steps of performing the verification process between the sender and the receiver include:

[0017] The sender and receiver compare their respective selected ground states through a classical channel. During the comparison process, the information corresponding to the part where the ground state comparison is consistent is used as the key.

[0018] The process of the access base station relaying the quantum security key for encryption to the receiving end includes:

[0019] The sending end uses the paired session key between it and the access base station to encrypt the quantum security key used to encrypt data to form a key relay data ciphertext, and sends the key relay data ciphertext and the key index of the session key to the corresponding access base station;

[0020] The access base station determines the corresponding session key according to the key index and decrypts the key relay data ciphertext to obtain the quantum security key;

[0021] When the access base station determines that the receiving terminal belongs to itself according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the receiving terminal; when it is determined that the receiving terminal belongs to the same basic service area and does not belong to itself according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the access base station to which the receiving terminal belongs, and then forwarded to the receiving terminal by the access base station; when it is determined that the receiving terminal does not belong to the basic service area according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the corresponding boundary base station in the basic service area, and forwarded by the boundary base station to the boundary base station of the receiving terminal, and then forwarded to the access base station of the receiving terminal by the boundary base station of the receiving terminal, and then forwarded to the corresponding receiving terminal by the access base station of the receiving terminal.

[0022] The paired session key between the transmitter and the access base station is a quantum random number key.

[0023] The network access identification includes network location information and device identification information.

[0024] In the scheme of this application, for quantum security terminals deployed in the same basic service area, the quantum security keys distributed by the key center are used to encrypt communication data to ensure the security of communication. Between basic service areas, quantum security keys are relayed by border base stations, and symmetric quantum keys are distributed between basic service areas using QKD key distribution channels to encrypt the relayed quantum security keys. This process ensures the security of cross-service area communications and makes the network topology highly adaptable. End-to-end encrypted communication between quantum security terminals is achieved, effectively protecting the privacy of user data. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the structure of the basic service area in the embodiment of the present application;

[0026] Figure 2 This is a timing diagram of quantum security terminal communication within the same basic service area in an embodiment of the present application;

[0027] Figure 3 This is a timing diagram of quantum security terminal communication between basic service areas in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0029] Embodiment: A quantum security communication method integrating QKD and global quantum security, comprising the following steps:

[0030] According to the network topology planning, communication connections are established for quantum security devices belonging to the same basic service area, where Figure 1 As shown, the quantum security equipment belonging to the same basic service area includes a quantum security terminal, an access base station, a key center and a border base station, the quantum security terminal is connected under the access base station, the key center is connected to the access base station in communication, and the access base station is connected to the border base station in communication;

[0031] A basic service area is a physical coverage area that contains a certain number of quantum security terminals, one or more access base stations, a key center, and at least one border base station;

[0032] The quantum security terminal is a user device used to process user data and encrypt the communication data according to the quantum security key; wherein the quantum security key is a quantum random number generated by a quantum true random number generator (QRNG); the access base station is a bridge connecting the quantum security terminal and the key center and the border base station, responsible for managing the access of the terminal, the relay and forwarding of the key; the key center is responsible for generating and managing the quantum key; the border base station is located at the edge of the basic service area and is used to relay the quantum security key between the basic service areas;

[0033] Establishing a QKD key distribution channel and a classical communication channel between two basic service areas that need to communicate, wherein the QKD key distribution channel is respectively connected to the boundary base stations of the two basic service areas, and symmetric quantum keys are distributed to the two boundary base stations through the QKD key distribution channel;

[0034] Specifically, two border base stations may be connected using optical fiber or other suitable quantum channels; QKD devices may be installed on the two border base stations, and these devices may be capable of key distribution through quantum channels; and the QKD devices may be configured to implement key generation, transmission, and reception functions;

[0035] like Figure 1 As shown, when quantum security terminals belonging to the same basic service area communicate with each other, they send communication data encrypted by quantum security keys through the local network; and use the access base station to relay the quantum security key used to encrypt the communication data to the receiving end; using quantum security keys to encrypt communication data can provide theoretically unbreakable security. The randomness of quantum keys and the quantum non-cloning theorem guarantee the absolute security of the keys;

[0036] like Figure 3As shown, when the quantum security terminals between the basic service areas communicate, the sender uses its own quantum security key to encrypt the data, and sends the encrypted ciphertext to the receiver through the classical communication channel between the basic service areas; at the same time, the sender encrypts the quantum security key used for encryption and forwards it to the corresponding access base station, which is decrypted by the access base station and forwarded to the border base station of the sender, and then encrypted by the border base station and forwarded to the border base station of the receiver, wherein the key used by the border base station to encrypt the quantum security key is a symmetric quantum key that is distributed and successfully verified through the QKD key distribution channel.

[0037] The sending end uses quantum security keys to encrypt data, ensuring the security of data during transmission. The border base station uses symmetric quantum keys distributed and successfully verified through the QKD key distribution channel to encrypt quantum security keys, further enhancing the security of keys during transmission. Although data is transmitted through classical communication channels, end-to-end secure communication is achieved because quantum security keys are used for encryption. Quantum security keys are securely relayed through access base stations and border base stations, ensuring the security of keys during transmission across service areas.

[0038] In a specific solution, the process of distributing symmetric quantum keys to the two boundary base stations through the QKD key distribution channel includes:

[0039] The sender sends a series of polarized photons to the receiver through a quantum channel, where each photon represents a bit of the key.

[0040] The receiver measures each received photon using its own randomly chosen basis state;

[0041] A verification process is performed between the sender and the receiver, and the parts that are consistent with the verification are retained as the distributed symmetric quantum key.

[0042] The steps of performing the verification process between the sender and the receiver include:

[0043] The sender and receiver compare their respective selected ground states through a classical channel. During the comparison process, the information corresponding to the part where the ground state comparison is consistent is used as the key.

[0044] Exemplarily, sender A generates a series of polarized photons, and the polarization state of each photon represents a key bit (0 or 1);

[0045] Sender A randomly selects two polarization bases (e.g., horizontal / vertical and + / x) to send photons.

[0046] After receiving the photon, receiver B randomly selects its own measurement basis (horizontal / vertical and + / x) to measure the polarization state of each photon;

[0047] After the communication is completed, the sender discloses the ground state used when sending each photon to the receiver B through the classical communication channel;

[0048] Receiver B compares its own measurement basis and only retains the photon measurement results whose measurement basis is consistent with the basis state sent by sender A;

[0049] The process of the access base station relaying the quantum security key for encryption to the receiving end includes:

[0050] The sending end uses the paired session key between it and the access base station to encrypt the quantum security key used to encrypt data to form a key relay data ciphertext, and sends the key relay data ciphertext and the key index of the session key to the corresponding access base station;

[0051] The access base station determines the corresponding session key according to the key index and decrypts the key relay data ciphertext to obtain the quantum security key;

[0052] When the access base station determines that the receiving terminal belongs to itself according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the receiving terminal; when it is determined that the receiving terminal belongs to the same basic service area and does not belong to itself according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the access base station to which the receiving terminal belongs, and then forwarded to the receiving terminal by the access base station; when it is determined that the receiving terminal does not belong to the basic service area according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the corresponding boundary base station in the basic service area, and forwarded by the boundary base station to the boundary base station of the receiving terminal, and then forwarded to the access base station of the receiving terminal by the boundary base station of the receiving terminal, and then forwarded to the corresponding receiving terminal by the access base station of the receiving terminal.

[0053] The paired session key between the transmitter and the access base station is a quantum random number key, which is generated by a quantum random number generator and has true randomness, making encryption more secure.

[0054] The network access identification includes network location information and device identification information, and the corresponding quantum security device can be quickly located through the network location information and the device identification information.

[0055] Exemplary:

[0056] Suppose there are two places, A and B, both of which have many enterprises and users, and quantum secure communication needs to be achieved between A and B, as well as within A and B.

[0057] First, a QKD key distribution node is built between locations A and B respectively, and QKD keys are distributed to the communication nodes between the two locations. There is a quantum channel and a classical channel between the two locations. The quantum channel is used to transmit photons, and the classical channel is used for classical network communication.

[0058] Sending photons:

[0059] A sends a series of polarized photons to B through a quantum channel, where each photon represents a bit of the key.

[0060] Measuring Photons:

[0061] Site B uses its own randomly selected basis state to measure each received photon. If the measurement basis selected by site B is consistent with the basis state used by site A when sending, site B can accurately measure the polarization of the photon and identify the bit value; if the selected basis state is inconsistent, the measurement result will be random.

[0062] Public ground state comparison:

[0063] Sites A and B compare their chosen basis states through a classical channel, but do not disclose the measurement results. Only if the basis states match will the bit be retained as part of the key; the part where the basis states do not match will be discarded.

[0064] Through this process, a symmetric quantum security key pool is established between A and B, which can provide quantum security keys for quantum secure encryption transmission between A and B.

[0065] Secondly, a global quantum security network is built in locations A and B. A global quantum security network includes access base stations, key centers, border base stations and other operation and maintenance systems.

[0066] The global quantum security boundary base station is used to realize secure communication between the global quantum security network, that is, the communication between A and B, while the access base station is used to realize the control and management of each terminal accessing the quantum security network. The key center provides quantum security keys for terminal devices accessing this quantum security network.

[0067] The border base station uses the session keys distributed by QKD to A and B as the quantum security key pool to realize key relay between A and B.

[0068] The border base stations at A and B access the key pool distributed by QKD to perform key consistency detection and synchronization to ensure the consistency of key usage on both sides. After the border base stations at A and B have synchronized the keys distributed by QKD, the border base stations at A and B have the session key and can perform key relay.

[0069] Next, all user terminals, business systems, IoT devices, etc. that require quantum secure communication are connected to the access base station of the global quantum security service through the global quantum security terminal.

[0070] As a device for encrypting and decrypting user data, the global quantum security terminal can directly accompany user devices to use quantum secure encrypted communications in different occasions and venues. The terminal device is mobile and can use quantum secure encrypted communications in any place where the network is accessible.

[0071] At this point, all terminal devices that have joined the quantum security service can conduct quantum security communication with other quantum security terminals after completing authentication and authorization, regardless of whether there is a symmetric quantum security key between the two terminals.

[0072] At the same time, the global quantum security terminal has a device isolation function, which not only protects the secure transmission of data, but also protects the device from network attacks. In this way, the information is fully protected during the entire process of information interaction.

[0073] Finally, when the user terminal's quantum security key is insufficient, it can request additional keys from the access base station. The access base station assigns a key center to the terminal. The key center has a quantum security key generation function, which can generate quantum security keys for this terminal and distribute them to the terminal.

[0074] When user a in location A needs to conduct quantum secure communication with user c in location A, since both user a and user c are connected to the same global quantum secure network, their keys are distributed by the key center of the global quantum secure network, so user a and user c can directly conduct quantum secure communication based on the global quantum secure network. Key relay is directly provided by the global quantum secure network in location A.

[0075] When user a in place A needs to conduct quantum secure communication with user b in place B, user a first encrypts the data using its own quantum secure key to obtain a ciphertext and sends it to the network. The ciphertext directly reaches user b through the network. Secondly, user a informs the access base station of the global quantum secure network of the encrypted key. The access base station takes out the encryption key and forwards it to the border base station. The border base station encrypts the encryption key using the quantum key distributed by QKD and sends it to the border base station in place B. The border base station in place B receives the relay key message from the border base station in place A, decrypts it using the quantum key distributed by QKD to obtain the encryption key, and then forwards the encryption key to the access base station in place B. The access base station in place B encrypts the encryption key using the global quantum secure key according to the purpose and sends it to user b. After user b obtains the key and ciphertext, it decrypts it to obtain the plaintext.

[0076] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A quantum security communication method integrating QKD and global quantum security, characterized in that: The following steps are involved: Establishing communication connections for quantum security devices belonging to the same basic service area according to network topology planning, wherein the quantum security devices belonging to the same basic service area include quantum security terminals, access base stations, key centers and border base stations, the quantum security terminals are connected to the access base stations, the key centers are connected to the access base stations in communication, and the access base stations are connected to the border base stations in communication; Establishing a QKD key distribution channel and a classical communication channel between two basic service areas that need to communicate, wherein the QKD key distribution channel is respectively connected to the boundary base stations of the two basic service areas, and symmetric quantum keys are distributed to the two boundary base stations through the QKD key distribution channel; When quantum security terminals belonging to the same basic service area communicate with each other, they send communication data encrypted by quantum security keys through the local network; and use the access base station to relay the quantum security key used to encrypt the communication data to the receiving end; When quantum security terminals communicate between basic service areas, the sender uses its own quantum security key to encrypt data and sends the encrypted ciphertext to the receiver through the classical communication channel between the basic service areas; at the same time, the sender encrypts the quantum security key used for encryption and forwards it to the corresponding access base station, which is decrypted by the access base station and forwarded to the border base station at the sender, and then encrypted by the border base station and forwarded to the border base station at the receiver. Among them, the key used by the border base station to encrypt the quantum security key is a symmetric quantum key distributed and successfully verified through the QKD key distribution channel.

2. The method according to claim 1, characterized in that The process of distributing symmetric quantum keys to the two boundary base stations through the QKD key distribution channel includes: The sender sends a series of polarized photons to the receiver through a quantum channel, where each photon represents a bit of the key. The receiver measures each received photon using its own randomly chosen basis state; A verification process is performed between the sender and the receiver, and the parts that are consistent with the verification are retained as the distributed symmetric quantum key.

3. The method according to claim 2, characterized in that The steps of performing the verification process between the sender and the receiver include: The sender and receiver compare their respective selected ground states through a classical channel. During the comparison process, the information corresponding to the part where the ground state comparison is consistent is used as the key.

4. The method according to claim 1, characterized in that: The process of the access base station relaying the quantum security key for encryption to the receiving end includes: The sending end uses the paired session key between it and the access base station to encrypt the quantum security key used to encrypt data to form a key relay data ciphertext, and sends the key relay data ciphertext and the key index of the session key to the corresponding access base station; The access base station determines the corresponding session key according to the key index and decrypts the key relay data ciphertext to obtain the quantum security key; When the access base station determines that the receiving terminal belongs to itself according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the receiving terminal; when the access base station determines that the receiving terminal belongs to the same basic service area and does not belong to itself according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the access base station to which the receiving terminal belongs, and then the access base station forwards it to the receiving terminal; when the access base station determines that the receiving terminal does not belong to the basic service area according to the network access identification information of the receiving terminal, the quantum security key is forwarded to the corresponding boundary base station in the basic service area, and the boundary base station forwards it to the boundary base station of the receiving terminal, and then forwarded to the access base station of the receiving terminal through the boundary base station of the receiving terminal, and then forwarded to the corresponding receiving terminal by the access base station of the receiving terminal.

5. The method according to claim 4, characterized in that The paired session key between the transmitter and the access base station is a quantum random number key.

6. The method according to claim 1, characterized in that The network access identification includes network location information and device identification information.

Images