Cooperative control method and system for quantum key output in quantum secret communication network

Abstract

The invention provides a quantum key output cooperative control method in a quantum secret communication network, and the method is completed through the mutual cooperation of a quantum service support system, a key management control system, a key management device and a quantum key application device. In the method, a quantum service support system registers a device ID and an account opening package of a quantum key application device, generates control strategy information and issues the control strategy information to a key management control system. According to the method, a quantum key output control strategy is generated based on the device ID and the account opening package of the quantum key application device, so that the key output rate, frequency and total quantity are accurately controlled; the problem caused by secret key application based on session information in the prior art is avoided.

Description

Technical Field

[0001] The present invention relates to the field of quantum communication, and in particular to a collaborative control method and system for quantum key output in a quantum secure communication network. Background Art

[0002] Quantum secure communication is a communication method based on the principles of quantum mechanics, "Heisenberg uncertainty principle" and "quantum non-copyability principle", which ensures communication security through the characteristics of quantum states. According to the definition of quantum secure communication network architecture, such as Figure 1 As shown, the quantum secure communication network is composed of a quantum key distribution network (QKDN) and a user network. The QKDN is composed of a QKD quantum layer (quantum key distribution) that provides key distribution capabilities, a key management layer (KM) that provides key input, output, relay, storage and life cycle management, a QKDN (quantum key distribution network) control layer that provides configuration control, routing control, access control, session and policy control, and a QKDN network management system that provides network element management and orchestration functions at each layer. The user network is composed of a user key application implemented by the QKDN key and a network management system that provides user network element management. The user key application obtains the quantum key through the KM layer of the above-mentioned QKDN and provides quantum security enhanced communication services for the user network.

[0003] In addition to the above systems, the business support system (QBSS) is also an important part of the quantum secure communication network, which is used to support the daily operation activities and various business processes of the quantum secure communication network. The quantum secure communication network is a network that generates and distributes secure quantum keys for both parties in the user network communication.

[0004] According to the existing technology, key output control is mainly completed by the interaction between the key application device (APP) and the key management device (KM). The process is as follows: Figure 2 The specific steps include the following steps.

[0005] Step 1: The KM initially configures the local key output rate and the total key output; Step 2: The APP actively initiates authentication and access to the network, and the APP applies to create a session and applies for a key based on the session information; Step 3: The KM receives the key application instruction from the APP, calculates the current APP key output rate (the average key output rate in the past 10 seconds), and determines whether the session output rate is less than the rate allowed by the policy. And determine whether the total key output of the session is less than the total key output allowed by the policy. If it is not, the KM replies to the APP that the key acquisition failed this time and informs the reason for the failure. If it is yes, the KM provides the key to the APP and continues the subsequent processing; Step 4: The APP accepts the key and related information replied by the KM and destroys the session; and Step 5: End the key output this time.

[0006] The above key output control mainly has the following problems: Problem 1, as shown in step 2, the APP applies for the key based on the session information. In some key application devices, the key application is encapsulated. Each time the key is applied, a new session is created, and the session is destroyed immediately after the key is obtained. In this case, the application device bypasses the control described in step 3 by repeatedly creating new sessions, making the method of controlling the key output based on the session completely invalid. There is a lack of an effective method for controlling the key output. Problem 2, as shown in step 3, the rate control of key output, the current program uses the average output rate of the past 10 seconds as the current rate, and compares it with the set rate threshold to control whether the key output is allowed this time. However, the key application interval set by the current quantum key application APP device is relatively long, such as 1-24 hours or longer, so the current rate calculated by the current program is basically 0. Even if the maximum total amount of keys allowed to be output by the policy is set to 1, because 0<1, the key can still be allowed to be output, and no key output rate control effect can be achieved. There is a lack of an effective method for controlling the key output rate. Question 3: The existing control methods are only implemented on KM and key application devices. With the development of large-scale key distribution networks and the standardization of quantum key distribution network architecture, there is a lack of an overall, coordinated control system for key output on the system. Summary of the invention

[0007] In order to solve the above problems, the present invention provides a collaborative control method for quantum key output in a quantum secure communication network, wherein the collaborative control method for quantum key output is completed by the cooperation of a quantum business support system, a key management control system, a key management device and a quantum key application device, and the method comprises the following specific steps: Step 1, the quantum business support system registers the device ID and account opening package of the quantum key application device, generates control strategy information and sends it to the key management control system; Step 2, the key management control system receives the control strategy of the quantum key application device from the quantum business support system, adds the control strategy of the quantum key application device to the database, and sends it to the key management device; Step 3, the key management device receives the control strategy of the quantum key application device from the key management control system, and locally saves the control strategy; Step 4, the quantum key application device actively initiates authentication to the key management device, creates a session, and initiates a key application based on the device ID of the quantum key application device; and Step 5: the key management device receives a key application instruction from the quantum key application device, queries the control strategy of the quantum key application device, and controls the provision of a key to the quantum key application device based on the control strategy.

[0008] In one embodiment, in step 5, when querying the control policy of the quantum key application device, the single key application amount, the remaining number of times in the package and the remaining output amount information within the policy period are obtained from the package information, and it is judged whether the key length applied by the quantum key application device this time is not greater than the single key amount permitted in the control policy of the quantum key application device, whether the remaining number of the package of the quantum key application device is greater than zero, and whether the remaining key amount in the package is greater than the key length applied this time. If the above judgments are all affirmative, the key management device outputs the key to the quantum key application device, and the quantum key application device saves the key; otherwise, the key management device outputs failure, and the key management device sends the reason for the failure to the quantum key application device.

[0009] In one implementation, the key management device outputs keys to the quantum key application device according to the rate value of the package of the quantum key application device.

[0010] In one embodiment, after the key management device outputs a key to the quantum key application device once, the key management device records the number of remaining key outputs and the total remaining output of the quantum key application device package, and then the key management device sends the package remaining quantity information of the quantum key application device to the key management and control system.

[0011] In one embodiment, in step 1, the control strategy information includes the device ID of the quantum key application device, the strategy execution period, the upper limit of the number of times the key is allowed to be output to the quantum key application device within the period, the upper limit of the total amount of keys allowed to be output to the quantum key application device within the period, the upper limit of the rate of key output to the quantum key application device within the period, and the upper limit of the length of a single key allowed to be output to the quantum key application device within the period.

[0012] In one embodiment, the control system includes a quantum business support system, a key management control system, a key management device and a quantum key application device.

[0013] In one implementation, the quantum business support system centrally manages the status of the quantum key application devices within its scope, registers the device ID and account opening package of the quantum key application devices, generates device key output control policy information of the quantum key application devices, and promptly sends the control policy information to the key management and control system.

[0014] In one embodiment, the quantum business support system periodically queries the key management and control system for key output control policy usage and remaining information of the quantum key application device; saves and updates in real time the remaining key output times and the remaining key amount in the package of the quantum key application device in the system.

[0015] In one implementation, the key management and control system receives the control policy margin information from the key management device and updates and saves it; and forwards the control policy margin update information to the quantum business support system.

[0016] In one implementation, the key management device receives status information of the quantum key application device from the key management and control system, and after the quantum key application device is shut down, promptly prohibits providing key output services to the quantum key application device; after the quantum key application device is turned on, the key output service is normally provided to the quantum key application device.

[0017] In the prior art, key output control is mainly completed by direct interaction between the quantum key application device APP and the key management device KM, which cannot achieve precise control effects and is difficult to meet the requirements of standardized quantum communication network architecture. There is a lack of an overall, effective collaborative control method and control system for key output. The present invention provides a collaborative control method and system for quantum key output. The system comprehensively considers the standardized quantum key distribution network architecture, combines the quantum business support system QBSS (quantum busyness system), the key management control system KMC (key manage control), the key management device KM (key manage) and the quantum key application device APP, and provides a set of overall, systematic control methods and systems.

[0018] In the method of the present invention, the control information includes the APP device ID, the policy execution cycle (supporting year, month, day, hour, minute, and second), the upper limit of the number of key outputs allowed to the APP within the cycle, the upper limit of the total amount of keys allowed to be output to the APP within the cycle, the upper limit of the key output rate allowed to the APP within the cycle, the upper limit of the length of a single key allowed to be output to the APP within the cycle, etc., support configuration packages, and accurately control the key output amount based on the package configuration information. Therefore, in the method of the present invention, a quantum key output control strategy is generated based on the device ID of the quantum key application device and the account opening package, so as to accurately control the key output rate, frequency, and total amount; avoiding the problems caused by applying for keys based on session information in the prior art. At the same time, the control method and the system record the key output rate, frequency, and key amount log information within the cycle can also be used as the billing basis of QBSS, meeting the standardization and industrialization requirements of quantum communication networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 This is a schematic diagram of the quantum secure communication network architecture;

[0021] Figure 2 It is a schematic diagram of a quantum key output control method in the prior art;

[0022] Figure 3 This is a schematic diagram of the system structure of the quantum key output control of the present invention.

[0023] Figure 4 It is a schematic diagram of the key output control method of the present invention;

[0024] Figure 5 It is a schematic diagram of the process of controlling key output by the quantum key management device of the present invention;

[0025] Figure 6 It is a schematic diagram of key parameters of the quantum key output control strategy of the present invention;

[0026] Figure 7 This is a schematic diagram of the quantum application device APP activation process of the present invention;

[0027] Figure 8 It is a schematic diagram of the key output strategy issuance process of the quantum application device of the present invention;

[0028] Fig. 9 It is a schematic diagram of the key output control flow of the quantum application device of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the technical solutions in the present application, the present invention will be further described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work should belong to the scope of protection of the present application. The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0030] Embodiment 1 Cooperative control method of quantum key output in a quantum secure communication network of the present invention

[0031] The present invention provides a collaborative control method for quantum key output in a quantum secure communication network. The method is based on a device ID and a key output control strategy to accurately control the key output rate, frequency and total amount.

[0032] like Figure 3As shown, the method of the present invention is a control system based on the quantum key output of the present invention. The control system of the present invention includes four parts: quantum business support system QBSS (quantum busyness system), key management control system KMC (keymanage control), key management device KM (key manage) and quantum key application device APP (Application). The QBSS centrally manages the status of APP devices within the scope, registers APP device IDs, opens account packages, and generates APP device key output control policy information; the QBSS sends the control policy information to KMC in a timely manner; the QBSS provides the KMC with the APP device ID to query the APP key output control policy information; the QBSS regularly queries KMC for APP key output control policy usage and balance information; saves and updates the remaining key output times and key remaining amount in the APP device package in the system in real time. And provide web business display. The QBSS receives information such as the application device (APP) control policy balance reported by KMC. Statistical key output control strategy. Regularly count the APP device key output log records in the system for key output billing charges of the billing system.

[0033] The KMC manages the APP status within its scope. The KMC receives the APP device control policy information from the QBSS and can save it locally. According to the APP and KM mounting relationship, the information is sent to a specific KM device. The KMC receives the control policy balance information from the KM device and updates and saves it. The control policy balance update information is forwarded to the QBSS. The control policy information is automatically updated to the KM and QBSS at the beginning of a new policy cycle.

[0034] The KM receives APP status information from the KMC, and after the APP device is shut down, promptly prohibits providing key output services to the APP; after the APP device is turned on, it provides key output services to the APP normally. The KM receives the APP key output control policy information within the scope from the KMC and saves it; the KM responds to the key application of the APP and outputs the key to the APP. The KM controls the quantum key output process based on the policy information; the KM counts the remaining control policy information of the APP within the scope. After successfully outputting a key to the APP once, the control policy information remainder information is updated in time, and the remainder information is reported to the KMC.

[0035] The APP actively applies for the key output service from the KM, and the APP receives the key output success or failure information sent by the KM. The APP cancels the relevant session information after the key output service application is completed. The three parts work together to complete the key output control.

[0036] like Figure 4 and 5 As shown, the collaborative control method of quantum key output in a quantum secure communication network of the present invention includes a collaborative control method of quantum key output in a quantum secure communication network, wherein the collaborative control method of quantum key output is completed by the cooperation of a quantum business support system QBSS, a key management control system KMC, a key management device KC and a quantum key application device APP, and the method includes the following specific steps:

[0037] Step 1: The quantum business support system QBSS registers the device ID and account opening package of the quantum key application device APP, generates control strategy information and sends it to the key management control system KMC;

[0038] Step 2: The key management and control system KMC receives the control policy of the quantum key application device APP from the quantum business support system QBSS, adds the control policy of the quantum key application device APP to the database, and sends it to the key management device KM;

[0039] Step 3, the key management device KM receives the control strategy of the quantum key application device APP from the key management control system KMC, and saves the control strategy locally;

[0040] Step 4: The quantum key application device APP actively initiates authentication to the key management device KM, creates a session, and initiates a key application based on the device ID of the quantum key application device APP;

[0041] Step 5: The key management device KM receives the key application instruction from the quantum key application device APP, queries the control strategy of the quantum key application device APP, and controls the provision of keys to the quantum key application device APP based on the control strategy. For example, the KM receives the key application instruction from the APP, queries the control strategy of the APP, and obtains the single key application quantity, the remaining number of times in the package, and the remaining output quantity information. Comprehensive comparison and judgment determine that the length of the APP key application this time is less than the upper limit of the single key application length of the APP control strategy, the remaining number of times of the package is greater than 0, and the APP key application quantity this time is less than the upper limit of the remaining key quantity of the APP control strategy. KM provides the key to the APP device and updates the remaining quantity and remaining number of APP information to KMC and QBSS step by step. If the judgment is no, KM replies to the APP to obtain the reason for the failure of the key application. The quantum key application device APP accepts the key and related failure information replied by KM and ends the key output this time.

[0042] like Figure 6As shown, the present invention provides a control strategy information for quantum key output. The control strategy information includes APP device ID, strategy execution period (supporting year, month, day, hour, minute, and second), the upper limit of the number of times keys are allowed to be output to APP within the period, the upper limit of the total amount of keys allowed to be output to APP within the period, the upper limit of the rate at which keys are allowed to be output to APP within the period, the upper limit of the length of a single key allowed to be output to APP within the period, and other information. It is used to ensure that the coordinated control method effectively controls the key output rate, frequency, and total amount. The quantum key output control strategy: is generated by the QBSS based on the APP device ID and the account opening package. The KM controls the key output rate, frequency, and total amount of keys according to the key output control strategy. The KM controls the key output process as follows Figure 4 shown.

[0043] Example 2: Starting and stopping the quantum application device APP of the present invention

[0044] like Figure 7 As shown, the present invention provides a process for controlling the startup and shutdown of an application device APP, which mainly includes: 1) QBSS registers APP information for startup / shutdown, QBSS sends the startup / shutdown instruction of the APP to KMC, KMC receives the startup / shutdown instruction of the APP from QBSS, and then determines whether the APP has been activated. If not, it replies to QBSS with a startup / shutdown failure instruction; if it has been activated, KMC modifies the status of the QAPP in the configuration file to startup or shutdown (startup allows establishment of a session, shutdown does not allow), and replies to QBSS with a startup / shutdown success instruction. QBSS receives the startup / shutdown result from KMC.

[0045] Example 3 The key output strategy of the present invention is issued

[0046] like Figure 8 As shown, the present invention provides a process for solving the key output policy issuance process. The process mainly includes: 1) QBSS registers the control policy information of the APP (including output rate, number of outputs, total output, single key output length, etc.), QBSS sends the control policy information of the APP to KMC, KMC receives the control policy information of the APP from QBSS, KMC adds the control policy information of the APP in the database, KMC replies to QBSS control policy issuance instruction, and QBSS receives KMC control policy saving result. After KMC saves the control policy information of the APP, KMC sends the control policy information of the APP to KM, and KM receives and saves the APP control policy information sent by KMC. The key restriction policy includes information such as the upper limit of the number of key applications, the total amount of keys applied, and the upper limit of the key output rate. After receiving the key restriction policy, KMC performs persistent storage.

[0047] Embodiment 4 Key output control of the present invention

[0048] like Fig. 9 As shown, the present invention provides a key output control process. The process mainly includes: APP initiates a key output request, queries the key output restriction policy corresponding to the device according to the quantum key application device identifier (such as device ID), and further obtains the permitted single key output amount (length), the remaining number of times and the remaining output amount information of the billing policy package from the key output policy. 1) Single key output amount limit, when the key length of this application is greater than the single key output amount (length) permitted in the policy, directly reply to the quantum key application device that the key output failed, and the reason for the failure is: the key length of this application is greater than the single key output amount (length) permitted in the policy; otherwise, enter the subsequent process. 2) Key output total amount and key output number limit, judge that the remaining number of times of the package of the APP is greater than 0, and the remaining key amount is greater than 0; if one of the values ​​is not greater than 0, the output fails, KM sends the reason for the output failure to APP, and APP receives the reason for the output failure sent by KM. If both values ​​are greater than 0, KM performs key output according to the rate value of the package of the APP; APP receives the key output by KM and saves it, and this output ends. After completing one output, KM records the remaining key output times and the remaining total output of the APP. KM sends the remaining amount of the APP package to KMC. KMC receives the remaining amount of the APP package and saves it in the database. It reports the remaining amount of the APP package to QBSS regularly or in real time. QBSS receives and saves the remaining amount of the APP package, and the statistical process ends.

[0049] It is easy for those skilled in the art to understand that, under the premise of no conflict, the above-mentioned advantageous methods can be freely combined and superimposed.

[0050] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention shall be included in the protection scope of the present invention. The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and variations can be made without departing from the technical principles of the present invention, and these improvements and variations should also be regarded as the protection scope of the present invention.

Claims

1. A method for cooperative control of quantum key output in a quantum secure communication network, characterized in that: The collaborative control method of quantum key output is completed by the cooperation of a quantum business support system, a key management control system, a key management device and a quantum key application device, and the method includes the following specific steps: Step 1: The quantum business support system registers the device ID and account opening package of the quantum key application device, generates control strategy information and sends it to the key management and control system; Step 2, the key management and control system receives the control policy of the quantum key application device from the quantum business support system, adds the quantum key application device control policy to the database, and sends it to the key management device; Step 3, the key management device receives the control policy of the quantum key application device from the key management control system and stores the control policy locally; Step 4: The quantum key application device actively initiates authentication to the key management device, creates a session, and initiates a key application based on the device ID of the quantum key application device; Step 5: The key management device receives a key application instruction from the quantum key application device, queries the control strategy of the quantum key application device, and controls the provision of keys to the quantum key application device based on the control strategy.

2. The method according to claim 1, characterized in that In step 5, when querying the control policy of the quantum key application device, the single key application amount, the remaining number of times in the package and the remaining output amount information within the policy period are obtained from the package information, and it is judged whether the key length applied by the quantum key application device this time is not greater than the single key amount permitted in the control policy of the quantum key application device, whether the remaining number of the package of the quantum key application device is greater than zero, and whether the remaining key amount in the package is greater than the key length applied this time. If the above judgments are all affirmative, the key management device outputs the key to the quantum key application device, and the quantum key application device saves the key; otherwise, the key management device outputs the key failure, and the key management device sends the failure reason to the quantum key application device.

3. The method according to claim 2, characterized in that The key management device outputs keys to the quantum key application device according to the rate value of the package of the quantum key application device.

4. The method according to claim 2, characterized in that: After the key management device outputs a key to the quantum key application device once, the key management device records the number of remaining key outputs and the total remaining output of the quantum key application device package, and then the key management device sends the package remaining quantity information of the quantum key application device to the key management and control system.

5. The method according to claim 1, characterized in that In step 1, the control strategy information includes the device ID of the quantum key application device, the strategy execution period, the upper limit of the number of times the key is allowed to be output to the quantum key application device within the period, the upper limit of the total amount of keys allowed to be output to the quantum key application device within the period, the upper limit of the rate of key output to the quantum key application device within the period, and the upper limit of the length of a single key allowed to be output to the quantum key application device within the period.

6. A control system for key output used in any one of the methods of claims 1 to 5, characterized in that: The control system includes a quantum business support system, a key management control system, a key management device and a quantum key application device.

7. The control system according to claim 6, characterized in that: The quantum business support system centrally manages the status of the quantum key application devices within its scope, registers the device ID and account opening package of the quantum key application devices, generates device key output control policy information of the quantum key application devices, and promptly sends the control policy information to the key management and control system.

8. The control system according to claim 7, characterized in that: The quantum business support system regularly queries the key management and control system for key output control strategy usage and remaining information of the quantum key application device; saves and updates in real time the remaining key output times and the remaining key amount in the package of the quantum key application device in the system.

9. The control system according to claim 6, characterized in that: The key management and control system receives the control policy margin information from the key management device and updates and saves it; and forwards the control policy margin update information to the quantum business support system.

10. The control system according to claim 6, characterized in that: The key management device receives the status information of the quantum key application device from the key management and control system, and promptly prohibits providing key output service to the quantum key application device after the quantum key application device is shut down; After the quantum key application device is turned on, a key output service is normally provided to the quantum key application device.

Images