Communication method and device based on quantum key, equipment, medium and program product

Abstract

The invention provides a communication method, device and equipment based on a quantum key, a medium and a program product, and relates to the field of network technology and security technology. The method comprises the steps that a first secret key obtaining request sent by a sending end is received, and the first secret key obtaining request carries the size of a data packet to be sent and predetermined identity information of a receiving end; determining a first quantum key pool according to the identity information of the receiving end; according to the size of the to-be-sent data packet, a first target quantum key is obtained from a first quantum key pool, and the first target quantum key is used by the sending end to encrypt the to-be-sent data packet; and returning a first key acquisition response to the sending end, the first key acquisition response carrying the key state information of the first quantum key pool and the first target quantum key. According to the invention, the security of the communication process can be ensured, and the use efficiency of the quantum key can be improved.

Description

Background Art

[0002] Quantum key distribution (QKD) is a technology that uses quantum mechanics to securely generate and share encryption keys. It is used to generate secure quantum keys between two or more physical nodes. The two communicating parties use quantum keys to securely transmit information once and for all, which can effectively counter the threats brought by the development of quantum computing technology. Since video data packets are not of fixed length and video conferencing is duplex communication, it often involves the issue of how the two communicating parties can synchronize quantum keys. Therefore, the current level of application of quantum security technology in video conferencing is far from mature.

[0003] In the related art, key management devices often generate a large number of quantum keys with fixed bit lengths and corresponding quantum key identifiers, and the communication terminals corresponding to the key management devices tend to use the same quantum key for encryption at the same time. The key is reused, and it is impossible to achieve one-time one-key, making it difficult to ensure the security of the communication process. At the same time, since the length of the generated quantum key is fixed, the length of the video data packet actually generated may not reach the length of the quantum key. Using a quantum key for each encryption may result in a waste of quantum keys.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a communication method, apparatus, device, medium and program product based on quantum key, which at least to some extent overcomes the problems in the related art that the security of data packets cannot be guaranteed during transmission and a large amount of waste occurs during the use of quantum keys.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a communication method based on quantum keys is provided, including: receiving a first key acquisition request sent by a transmitting end, wherein the first key acquisition request carries the size of a data packet to be sent and predetermined identity information of a receiving end, and the receiving end is a terminal device communicating with the transmitting end; determining a first quantum key pool according to the identity information of the receiving end; acquiring a first target quantum key from the first quantum key pool according to the size of the data packet to be sent, wherein the first target quantum key is used by the transmitting end to encrypt the data packet to be sent; and returning a first key acquisition response to the transmitting end, wherein the first key acquisition response carries key state information of the first quantum key pool and the first target quantum key, and the key state information is used to enable the receiving end to acquire a second target quantum key from a corresponding second quantum key pool.

[0008] In some embodiments, before determining the first quantum key pool according to the identity information of the receiving end, the method further includes: generating multiple quantum key pools according to the identity information of multiple sending ends, the identity information of multiple receiving ends, and the communication direction between each sending end and each receiving end, wherein the communication direction between each sending end and each receiving end is used to identify the corresponding quantum key pool.

[0009] In some embodiments, obtaining a first target quantum key from the first quantum key pool according to the size of the data packet to be sent includes: obtaining a key start bit of the first quantum key pool; and determining the first target quantum key according to the length of the data packet to be sent and the key start bit of the first quantum key pool.

[0010] In some embodiments, after determining the first target quantum key according to the length of the data packet to be sent and the key start bit of the first quantum key pool, the method further includes: updating the key start bit of the first quantum key pool; judging whether the difference between the length of the first quantum key pool and the updated key start bit is greater than the maximum length of the data packet to be sent; if not, updating the key in the first quantum key pool, and updating the first summary according to the updated key, wherein the first summary is a hash value obtained by calculating the key of the first quantum key pool according to a preset hash algorithm.

[0011] According to another aspect of the present disclosure, a communication method based on quantum keys is also provided, including: receiving a second key acquisition request sent by a receiving end, wherein the second key acquisition request carries key state information of a first quantum key pool and a length of a first target quantum key sent by a sending end; determining a second quantum key pool according to the key state information of the first quantum key pool, and matching the key state information of the first quantum key pool with the key state information of the second quantum key pool; if the key state information matches, acquiring a second target quantum key from the second quantum key pool, wherein the first target quantum key is the same as the second target quantum key, and the second target quantum key is used by the receiving end to decrypt a received encrypted data packet; and returning a second key acquisition response to the receiving end, wherein the second key acquisition response carries the second target quantum key.

[0012] In some embodiments, the key state information of the first quantum key pool includes: an identifier of the first quantum key pool and a first summary, wherein the first summary is a hash value obtained by calculating the key of the first quantum key pool according to a preset hash algorithm.

[0013] In some embodiments, determining a second quantum key pool according to the key state information of the first quantum key pool, and matching the key state information of the first quantum key pool with the key state information of the second quantum key pool includes: determining the second quantum key pool according to an identifier of the first quantum key pool; calculating the key in the second quantum key pool according to a preset hash algorithm to obtain a second summary; matching the first summary with the second summary, and determining whether to obtain a second target quantum key from the second quantum key pool according to the matching result.

[0014] According to another aspect of the present disclosure, a communication device based on quantum key is also provided, including: a first key acquisition request receiving module, used to receive a first key acquisition request sent by a sending end, wherein the first key acquisition request carries the size of a data packet to be sent and the identity information of a predetermined receiving end, and the receiving end is a terminal device communicating with the sending end; a first quantum key pool determining module, used to determine a first quantum key pool according to the identity information of the receiving end; a first target quantum key acquisition module, used to obtain a first target quantum key from the first quantum key pool according to the size of the data packet to be sent, wherein the first target quantum key is used by the sending end to encrypt the data packet to be sent; a first key acquisition response returning module, used to return a first key acquisition response to the sending end, wherein the first key acquisition response carries the key state information of the first quantum key pool and the first target quantum key, and the key state information is used to enable the receiving end to obtain a second target quantum key from a corresponding second quantum key pool.

[0015] According to another aspect of the present disclosure, a communication device based on quantum key is also provided, including: a second key acquisition request receiving module, used to receive a second key acquisition request sent by a receiving end, wherein the second key acquisition request carries key state information of a first quantum key pool and a length of a first target quantum key sent by a sending end; a key state information matching module, used to determine a second quantum key pool according to the key state information of the first quantum key pool, and match the key state information of the first quantum key pool with the key state information of the second quantum key pool; a second target quantum key acquisition module, used to obtain a second target quantum key from the second quantum key pool if the key state information matches consistently, wherein the first target quantum key is the same as the second target quantum key, and the second target quantum key is used by the receiving end to decrypt a received encrypted data packet; a second key acquisition response returning module, used to return a second key acquisition response to the receiving end, wherein the second key acquisition response carries the second target quantum key.

[0016] According to another aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned quantum key-based communication methods by executing the executable instructions.

[0017] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the quantum key-based communication method described in any one of the above is implemented.

[0018] According to another aspect of the present disclosure, a computer program product is also provided, including a computer program, wherein when the computer program is executed by a processor, the computer program implements any one of the above-mentioned quantum key-based communication methods.

[0019] The quantum key-based communication method, apparatus, device, medium and program product provided in the embodiments of the present disclosure, after receiving the first key acquisition request sent by the sender, determines the first quantum key pool according to the identity information of the receiving end carried therein, and then obtains the first target quantum key from the first quantum key pool according to the size of the data packet to be sent, and carries it in the first key acquisition response and returns it to the sender, so that the sender encrypts the data packet to be sent by the first target quantum key and sends the encrypted data packet to the receiving end; after receiving the second key acquisition request sent by the receiving end, determines the second quantum key pool according to the key state information of the first quantum key pool carried therein, and matches it with the key state information of the second quantum key pool, if the matching results are consistent, obtains the second target quantum key from the second quantum key pool, and carries it in the second key acquisition response, so that the receiving end decrypts the encrypted data packet by the second target quantum key. The embodiments of the present disclosure can improve the efficiency of quantum key use while ensuring the security of the communication process.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0022] Figure 1 A schematic diagram of an exemplary application system architecture to which a data packet transmission method in the related art can be applied is shown;

[0023] Figure 2 A schematic diagram of an exemplary application system architecture to which the quantum key-based communication method in the embodiments of the present disclosure can be applied is shown;

[0024] Figure 3 A flow chart of a communication method based on quantum key in an embodiment of the present disclosure is shown;

[0025] Figure 4 A flow chart of another communication method based on quantum key in an embodiment of the present disclosure is shown;

[0026] Figure 5 A schematic diagram showing device interaction in a quantum key-based communication system in an embodiment of the present disclosure is shown;

[0027] Figure 6 A signaling flow chart of a communication method based on quantum keys in an embodiment of the present disclosure is shown;

[0028] Figure 7 A schematic diagram of a communication device based on quantum key in an embodiment of the present disclosure is shown;

[0029] Figure 8 A schematic diagram of another communication device based on quantum key in an embodiment of the present disclosure is shown;

[0030] Fig. 9 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0031] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0032] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0033] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0034] Figure 1 FIG. 1 shows an exemplary application system architecture diagram to which a data packet transmission method in the related art can be applied. Figure 1 As shown, the system architecture may include a first communication terminal 101 , a second communication terminal 102 , a first key management device 201 , and a second key management device 202 .

[0035] In one embodiment of the present disclosure, in a video conferencing scenario, the first communication terminal 101 and the second communication terminal 102 are responsible for encrypting and decrypting the video / voice streams, specifically, by obtaining the quantum key K to encrypt the data and passing the quantum key identifier to the other party; the first key management device 201 and the second key management device 202 are responsible for generating, managing and distributing quantum keys, and ensuring the secure transmission of quantum keys through optical fiber connections.

[0036] In one embodiment of the present disclosure, the first key management device 201 and the second key management device 202 generate a large number of quantum keys K with fixed bit lengths and corresponding quantum key identifiers through quantum key distribution QKD technology, wherein the length of the quantum key K is the same as the size of the maximum video / voice data packet.

[0037] In one embodiment of the present disclosure, when video or voice stream encryption is required, the first communication terminal 101, as a sending end, obtains a quantum key K, uses the obtained quantum key K to encrypt the video / voice stream, and sends the encrypted data and the identifier of the quantum key K to the second communication terminal 102. After receiving the identifier of the quantum key K, the second communication terminal 102 requests the corresponding quantum key K from the second key management device 202.

[0038] In one embodiment of the present disclosure, the first communication terminal 101 and the second communication terminal 102 are likely to use the same quantum key for encryption at the same time, the key is reused, and one-time one-key is not implemented. At the same time, taking the size range of the video packet to be transmitted as 150KB to 200KB as an example, at this time, the length of each quantum key is fixed to 200KB, and one quantum key is used for each encryption, which is likely to cause a waste of quantum keys.

[0039] Figure 2 FIG. 1 shows an exemplary application system architecture diagram to which the communication method based on quantum key in the embodiment of the present disclosure can be applied. Figure 2 As shown, the system architecture may include a first communication terminal 101, a second communication terminal 102, a first key management device 201, a second key management device 202, a first quantum key pool 2011 and a second quantum key pool 2022.

[0040] In one embodiment of the present disclosure, the above system can be applied to one-time-one-pad scenarios such as quantum secret talk, quantum voice or video conferencing.

[0041] In one embodiment of the present disclosure, the first key management device 201 and the second key management device 202 have built-in quantum key pool strategies, which determine the generation of different quantum key pools according to the communicating parties and the communication direction, and the length of each quantum key pool is fixed.

[0042] In one embodiment of the present disclosure, the first key management device 201 and the second key management device 202 generate a first quantum key pool 2011 and a second quantum key pool 2022 based on a quantum key pool strategy, wherein the first quantum key pool 2011 is identified as a direction of the first communication terminal 101→the second communication terminal 102, and the first quantum key pool 2011 is identified as a direction of the second communication terminal 102→the second communication terminal 102. That is, the key pool strategy is adopted to specify different senders and receivers and different communication directions, and quantum keys in different quantum key pools are used to avoid the communication parties from using the same key obtained from the same key pool to encrypt data packets during duplex communication.

[0043] In one embodiment of the present disclosure, based on the quantum key pool strategy, the communicating parties synchronize the quantum key based on the key pool identifier, summary, start bit, key length and other parameters, so as to realize the generation of quantum keys of corresponding sizes based on the size of the voice / video data packet, rather than using the maximum data packet length to generate a fixed-length quantum key, which is more flexible and improves the efficiency of quantum key use.

[0044] It should be noted that the first key management device 201 and the second key management device 202 may refer to two different key management devices or the same key management device, and may be configured according to actual needs, which is not specifically limited in the embodiments of the present disclosure.

[0045] It should be noted that the first communication terminal 101 and the second communication terminal 102 are only exemplary. The embodiment of the present disclosure may also include several communication terminals, which is not specifically limited in the present disclosure. Accordingly, according to the quantum key pool strategy, the key management device side may generate several quantum key pools according to the identity information and communication direction of each communication terminal, and the embodiment of the present disclosure also does not specifically limit the number of quantum key pools.

[0046] Figure 3 A flow chart of a communication method based on quantum key in an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the method comprises the following steps:

[0047] S302, receiving a first key acquisition request sent by a sending end, wherein the first key acquisition request carries the size of a data packet to be sent and predetermined identity information of a receiving end, and the receiving end is a terminal device communicating with the sending end.

[0048] In one embodiment of the present disclosure, the sending end obtains the identity information of the receiving end in advance, carries the identity information of the receiving end and the size of the data packet to be sent in a first key acquisition request, and sends the first key acquisition request to the key management device. The size of the data packet to be sent is the size of the pure data portion after removing all header information.

[0049] S304: Determine a first quantum key pool according to the identity information of the receiving end.

[0050] In one embodiment of the present disclosure, the identifier of each quantum key pool is the communication direction of the two communication devices. Therefore, when the identity information of the sender and the identity information of the receiver, as well as the communication direction of sending a data packet from the sender to the receiver, are known, the first quantum key pool can be determined.

[0051] S306, obtaining a first target quantum key from a first quantum key pool according to the size of the data packet to be sent, wherein the first target quantum key is used by the transmitting end to encrypt the data packet to be sent.

[0052] In one embodiment of the present disclosure, a first target quantum key may be obtained from a first quantum key pool according to the size of a packet to be sent, wherein the length of the first target quantum key is consistent with the size of the data packet to be sent.

[0053] S308, returning a first key acquisition response to the sending end, wherein the first key acquisition response carries key state information of the first quantum key pool and the first target quantum key, and the key state information is used to enable the receiving end to obtain the second target quantum key from the corresponding second quantum key pool.

[0054] In one embodiment of the present disclosure, after receiving the first key acquisition response returned by the key management device, the sending end encrypts the data packet to be sent according to the first target quantum key carried therein, and sends the encrypted data packet and the key state information of the first quantum key pool to the receiving end. For example, in a video conferencing scenario, an encryption method for indefinite-length video or voice streams based on quantum key encryption is implemented, while the efficiency of using quantum keys is improved, and one-time one-key is implemented.

[0055] As can be seen from the above, after receiving the first key acquisition request sent by the sender, the first quantum key pool is determined according to the identity information of the receiving end carried therein, and then the first target quantum key is obtained from the first quantum key pool according to the size of the data packet to be sent, and the first target quantum key is carried in the first key acquisition response and returned to the sender, so that the sender encrypts the data packet to be sent by the first target quantum key and sends the encrypted data packet to the receiving end. The disclosed embodiment can improve the efficiency of quantum key use while ensuring the security of the communication process.

[0056] In one embodiment of the present disclosure, before the above S304, the method further includes: generating multiple quantum key pools according to identity information of multiple senders, identity information of multiple receiveers, and communication directions between each sender and each receiveer, wherein the communication direction between each sender and each receiveer is used to identify the corresponding quantum key pool.

[0057] In one embodiment of the present disclosure, the above S306 includes: obtaining a key start bit of a first quantum key pool; and determining a first target quantum key according to the length of the data packet to be sent and the key start bit of the first quantum key pool.

[0058] In one embodiment of the present disclosure, after the above S306, the method further includes: updating the key start bit of the first quantum key pool; judging whether the difference between the length of the first quantum key pool and the updated key start bit is greater than the maximum length of the data packet to be sent; if not, updating the key in the first quantum key pool, and updating the first summary according to the updated key, wherein the first summary is a hash value obtained by calculating the key of the first quantum key pool according to a preset hash algorithm.

[0059] In one embodiment of the present disclosure, the quantum key pool strategy refers to generating different quantum key pools according to the identity information and communication direction of the communicating parties. The length of each quantum key pool can be fixed to a preset length (for example, 100MB), and then the quantum key pool is hashed according to a preset hash algorithm to generate a corresponding digest, which is used to determine whether the key pool is the same or has been updated. At the same time, the position used by the current key, that is, the starting position, can also be known, and the initial value is 0.

[0060] In one embodiment of the present disclosure, in a video conference scenario, taking the quantum key length of 180KB as an example, after the quantum key is taken away, the start position is gradually shifted back to 180KB. If the largest data packet among the multiple data packets to be sent is less than 200KB, when the difference between the quantum key pool length and the start position is less than or equal to 200KB, the quantum key in the quantum key pool is updated.

[0061] In one embodiment of the present disclosure, the quantum key pool structure managed by the key management device may be shown in the following table:

[0062] Table 1

[0063] Quantum key pool identification Quantum key length Quantum Key Pool Summary Start bit Communication device 1 → Communication device 2 100MB The hash value of the key pool 0 Communication device 2 → Communication device 1 100MB The hash value of the key pool 0

[0064] It should be noted that the identifier, length, summary and start bit of the above-mentioned quantum key pool are used as key state information of the key pool, which only plays an exemplary role and is set according to actual conditions. The embodiments of the present disclosure do not make specific limitations on this.

[0065] Figure 4 A flow chart of another communication method based on quantum key in an embodiment of the present disclosure is shown as follows: Figure 4 As shown, the method comprises the following steps:

[0066] S402: Receive a second key acquisition request sent by a receiving end, wherein the second key acquisition request carries key state information of a first quantum key pool and a length of a first target quantum key sent by a sending end.

[0067] In one embodiment of the present disclosure, a receiving end receives key state information of a first quantum key pool and a length of a first target quantum key sent by a sending end, carries the information in a second key acquisition request, and sends the information to a key management device to request acquisition of a second target quantum key.

[0068] S404: Determine a second quantum key pool according to the key state information of the first quantum key pool, and match the key state information of the first quantum key pool with the key state information of the second quantum key pool.

[0069] In one embodiment of the present disclosure, the second quantum key pool for obtaining the second target quantum key can be determined by the identifier of the first quantum key pool. At this time, the key state information of the first quantum key pool needs to be matched with the key state information of the second quantum key pool to ensure that the two quantum key pools are synchronized, thereby ensuring that the obtained target quantum keys are the same.

[0070] S406: If the key state information matches, a second target quantum key is obtained from a second quantum key pool, wherein the first target quantum key is the same as the second target quantum key, and the second target quantum key is used by the receiving end to decrypt the received encrypted data packet.

[0071] In one embodiment of the present disclosure, the second target quantum key can be obtained from the second quantum key pool according to information such as the length of the first target quantum key and the start bit of the first quantum key pool.

[0072] S408, returning a second key acquisition response to the receiving end, wherein the second key acquisition response carries the second target quantum key.

[0073] In one embodiment of the present disclosure, the second target quantum key is carried in a second key acquisition response and returned to the receiving end, so that the receiving end decrypts the encrypted data packet according to the second target quantum key to obtain a plaintext data packet.

[0074] As can be seen from the above, after receiving the second secret key acquisition request sent by the receiving end, the embodiment of the present disclosure determines the second quantum key pool according to the key state information of the first quantum key pool carried therein, and matches it with the key state information of the second quantum key pool. If the matching results are consistent, the second target quantum key is obtained from the second quantum key pool and carried in the second key acquisition response, so that the receiving end can decrypt the encrypted data packet through the second target quantum key. The embodiment of the present disclosure can improve the efficiency of quantum key use while ensuring the security of the communication process.

[0075] In one embodiment of the present disclosure, the key state information of the first quantum key pool includes: an identifier of the first quantum key pool and a first summary, wherein the first summary is a hash value obtained by calculating the key of the first quantum key pool according to a preset hash algorithm.

[0076] In one embodiment of the present disclosure, the above S404 includes: determining a second quantum key pool according to an identifier of the first quantum key pool; calculating the key in the second quantum key pool according to a preset hash algorithm to obtain a second summary; matching the first summary with the second summary, and determining whether to obtain a second target quantum key from the second quantum key pool according to the matching result.

[0077] In one embodiment of the present disclosure, the hash algorithm may be, for example, SHA-256 or SHA-3, to map data of any length to a hash value of a fixed length, and has the ability to resist collision and anti-image attacks. The key management device may pre-set a hash algorithm, and in the initial state, calculate the quantum key pool by using the preset hash algorithm to obtain the hash value corresponding to the quantum key pool, so as to ensure that the communicating parties can verify whether the key pools they use are consistent and have not been tampered with.

[0078] In one embodiment of the present disclosure, the key state information of the first quantum key pool may further include a start bit of the first quantum key pool, so that the second key management device obtains a second target quantum key from the second quantum key pool according to the start bit of the first quantum key pool and the length of the first target quantum key, and ensures that the second target quantum key is the same as the first target quantum key.

[0079] exist Figure 2 On the basis of Figure 5 A schematic diagram of device interaction for implementing a quantum key-based communication system in an embodiment of the present disclosure is shown. Figure 5 As shown, the following steps are included:

[0080] ① The first communication terminal 101 (ie, the sending end) first determines that the size of the data packet is n bits, and sends a first key acquisition request to the first key management device 201. The first key acquisition request carries a requirement that the quantum key length is n bits.

[0081] ② The first key management device 201 returns a first target quantum key of n bits, an identifier of the first quantum key pool, a summary and a start bit parameter to the first communication terminal 101 according to the quantum key pool strategy.

[0082] ③ The first communication terminal 101 adopts a one-time one-pad method to encrypt the data packet to be sent using the first target quantum key to obtain an encrypted data packet, and sends the encrypted data packet as well as the identifier, summary, start bit parameter of the first quantum key pool and the length of the first target quantum key to the second communication terminal 102 (i.e., the receiving end).

[0083] ④ The second communication terminal 102 sends a second key acquisition request to the second key management device 202, where the second key acquisition request carries the identifier, summary, start bit parameter of the first quantum key pool and the length of the first target quantum key.

[0084] ⑤ The second key management device 202 performs a key pool identifier matching and digest authentication process according to the received key state information. On the premise that both the matching and the authentication are passed, the second key management device 202 generates a second target quantum key from the second quantum key pool based on the start bit of the first quantum key pool and the length of the first target quantum key, and returns the second target quantum key to the second communication terminal 102, so that the second communication terminal 102 decrypts the encrypted data packet according to the second target quantum key to obtain the plaintext of the data packet.

[0085] Figure 6 A signaling flow chart of a communication method based on quantum keys in an embodiment of the present disclosure is shown as follows: Figure 6 As shown, the method comprises the following steps:

[0086] S601, the first terminal device (ie, the sender) generates a data packet of a preset size to be sent, for example, in a video conferencing scenario, generates a voice or video data packet of size n as part of a voice or video stream.

[0087] S602, the first terminal device sends a first key acquisition request to the first key management device, where the first key acquisition request carries the identity information of the second terminal device (ie, the recipient) and the length n of the quantum key (the same as the size of the data packet to be sent).

[0088] S603: The first key management device determines a first quantum key pool based on the quantum key pool strategy and according to the identity information of the second terminal device.

[0089] S604: The first key management device calculates the keys in the first quantum key pool according to a preset hash algorithm based on the quantum key pool strategy to generate a digest M of the first quantum key pool.

[0090] S605: The first key management device generates a first target quantum key K according to the current starting position N of the first quantum key pool and the length n of the quantum key.

[0091] S606: After taking away the first target quantum key K, the first key management device is updated to obtain an updated start bit N' of the first quantum key pool.

[0092] S607: The first key management device returns a first key acquisition response to the first terminal device, where the first key acquisition response carries an identifier A, a digest M, a start bit N, and a first target quantum key K of the first quantum key pool.

[0093] S608: The first terminal device encrypts the data packet to be sent according to the first target quantum key K to obtain an encrypted data packet.

[0094] S609: The first terminal device sends an encrypted data packet, key state information of the first quantum key pool, and the length n of the first target quantum key K to the second terminal device.

[0095] In one embodiment of the present disclosure, the key state information of the first quantum key pool may include but is not limited to: an identifier A, a digest M, and a start bit N of the first quantum key pool.

[0096] S610: The second terminal device sends a second key acquisition request to the second key management device, where the second key acquisition request carries an identifier A, a digest M, a start bit N, and a length n of the first target quantum key K of the first quantum key pool.

[0097] S611: The second key management device determines a second quantum key pool based on the quantum key pool strategy and according to the identifier A of the first quantum key pool.

[0098] S612: The second key management device calculates the keys in the second quantum key pool according to a preset hash algorithm based on the quantum key pool strategy, generates a summary M1 of the second quantum key pool, and matches M1 with M.

[0099] S613: If the matching results are consistent, the second key management device generates a second target quantum key K1 according to the starting position N of the first quantum key pool and the length n of the first target quantum key K, wherein the second target quantum key K1 is the same as the first target quantum key K.

[0100] S614: The second key management device returns a second key acquisition response to the second terminal device, where the second key acquisition response carries the second target quantum key K1.

[0101] S615, the second terminal device decrypts the encrypted data packet according to the second target quantum key K1 to obtain the plaintext of the data packet.

[0102] It should be noted that the above-mentioned first terminal device as a transmitting end and the second terminal device as a receiving end only play an exemplary role. The communication direction or communication device can be changed according to actual conditions, and the embodiments of the present disclosure do not make specific limitations on this.

[0103] It should be noted that the local key management device of the first terminal device as the first key management device and the local key management device of the second terminal device as the second key management device are only exemplary. In actual situations, the two terminal devices may correspond to different key management devices or the same key management device. At the same time, each key management device may correspond to one or more terminal devices, and the embodiments of the present disclosure do not specifically limit this.

[0104] In one embodiment of the present disclosure, based on the quantum key pool strategy, the key pool identifier of the first terminal device → the second terminal device is clarified, and the key pool identifier of the second terminal device → the first terminal device is clarified, and duplex encrypted communication between the two communicating parties is achieved based on the key pool identifier without interfering with each other. At the same time, the key pool is authenticated by using a hash method to prevent the key pools of the two communicating parties from being out of sync, which leads to encryption and decryption failures of the two communicating parties.

[0105] In one embodiment of the present disclosure, in a video conferencing scenario, a first terminal device video conferencing device generates a quantum key request based on a quantum key pool identifier, a quantum key pool start bit, and a quantum key length (i.e., the size of a voice or video data packet), and obtains a quantum key from a key management device corresponding to the first terminal device (i.e., a first key management device), thereby achieving variable-length quantum key acquisition.

[0106] In one embodiment of the present disclosure, if the difference between the length of the first quantum key pool and N' is less than or equal to the size of the largest data packet in the data packets to be sent, the first quantum key pool is updated.

[0107] In one embodiment of the present disclosure, if the first quantum key pool has been updated, the second quantum key pool corresponding to the identifier of the first quantum key pool may be updated accordingly to ensure synchronization of the two quantum key pools.

[0108] Based on the same inventive concept, the embodiments of the present disclosure also provide a communication device based on quantum keys, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0109] Figure 7 A schematic diagram of a communication device based on quantum key in an embodiment of the present disclosure is shown, Figure 7 As shown, the device includes: a first key acquisition request receiving module 701, a first quantum key pool determining module 702, a first target quantum key acquisition module 703 and a first key acquisition response returning module 704.

[0110] Among them, the first key acquisition request receiving module 701 is used to receive the first key acquisition request sent by the sending end, wherein the first key acquisition request carries the size of the data packet to be sent and the predetermined identity information of the receiving end, and the receiving end is a terminal device communicating with the sending end; the first quantum key pool determination module 702 is used to determine the first quantum key pool according to the identity information of the receiving end; the first target quantum key acquisition module 703 is used to obtain the first target quantum key from the first quantum key pool according to the size of the data packet to be sent, wherein the first target quantum key is used by the sending end to encrypt the data packet to be sent; the first key acquisition response returning module 704 is used to return the first key acquisition response to the sending end, wherein the first key acquisition response carries the key state information of the first quantum key pool and the first target quantum key, and the key state information is used to enable the receiving end to obtain the second target quantum key from the corresponding second quantum key pool.

[0111] As can be seen from the above, after receiving the first key acquisition request sent by the sender, the first quantum key pool is determined according to the identity information of the receiving end carried therein, and then the first target quantum key is obtained from the first quantum key pool according to the size of the data packet to be sent, and the first target quantum key is carried in the first key acquisition response and returned to the sender, so that the sender encrypts the data packet to be sent by the first target quantum key and sends the encrypted data packet to the receiving end. The disclosed embodiment can improve the efficiency of quantum key use while ensuring the security of the communication process.

[0112] In one embodiment of the present disclosure, the device further includes: a quantum key pool generating module 705, configured to generate multiple quantum key pools according to identity information of multiple senders, identity information of multiple receivers, and communication directions between each sender and each receiver, wherein the communication direction between each sender and each receiver is used to identify the corresponding quantum key pool.

[0113] In one embodiment of the present disclosure, the first target quantum key acquisition module 703 is further used to acquire a key start bit of the first quantum key pool; and determine the first target quantum key according to the length of the data packet to be sent and the key start bit of the first quantum key pool.

[0114] In one embodiment of the present disclosure, the device further includes: a first quantum key pool updating module 706, which is used to update the key start bit of the first quantum key pool; determine whether the difference between the length of the first quantum key pool and the updated key start bit is greater than the maximum length of the data packet to be sent; if not, update the key in the first quantum key pool, and update the first summary according to the updated key, wherein the first summary is a hash value obtained by calculating the key of the first quantum key pool according to a preset hash algorithm.

[0115] Figure 8 A schematic diagram of another communication device based on quantum key in an embodiment of the present disclosure is shown, Figure 8 As shown, the device includes: a second key acquisition request receiving module 801, a key state information matching module 802, a second target quantum key acquisition module 803 and a second key acquisition response returning module 804.

[0116] Among them, the second key acquisition request receiving module 801 is used to receive the second key acquisition request sent by the receiving end, wherein the second key acquisition request carries the key state information of the first quantum key pool and the length of the first target quantum key sent by the sending end; the key state information matching module 802 is used to determine the second quantum key pool according to the key state information of the first quantum key pool, and match the key state information of the first quantum key pool with the key state information of the second quantum key pool; the second target quantum key acquisition module 803 is used to obtain the second target quantum key from the second quantum key pool if the key state information matches consistently, wherein the first target quantum key is the same as the second target quantum key, and the second target quantum key is used by the receiving end to decrypt the received encrypted data packet; the second key acquisition response returning module 804 is used to return the second key acquisition response to the receiving end, wherein the second key acquisition response carries the second target quantum key.

[0117] In one embodiment of the present disclosure, the key state information of the first quantum key pool includes: an identifier of the first quantum key pool and a first summary, wherein the first summary is a hash value obtained by calculating the key of the first quantum key pool according to a preset hash algorithm.

[0118] In one embodiment of the present disclosure, the second target quantum key acquisition module 803 is further used to determine the second quantum key pool according to the identifier of the first quantum key pool; calculate the key in the second quantum key pool according to a preset hash algorithm to obtain a second summary; match the first summary and the second summary, and determine whether to obtain the second target quantum key from the second quantum key pool according to the matching result.

[0119] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0120] Refer to the following Fig. 9 The electronic device 900 according to this embodiment of the present disclosure is described. Fig. 9 The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0121] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0122] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present disclosure.

[0123] In one embodiment of the present disclosure, the processing unit 910 may perform the following steps: receiving a first key acquisition request sent by a transmitting end, wherein the first key acquisition request carries the size of a data packet to be sent and predetermined identity information of a receiving end, and the receiving end is a terminal device communicating with the transmitting end; determining a first quantum key pool according to the identity information of the receiving end; acquiring a first target quantum key from the first quantum key pool according to the size of the data packet to be sent, wherein the first target quantum key is used by the transmitting end to encrypt the data packet to be sent; returning a first key acquisition response to the transmitting end, wherein the first key acquisition response carries key state information of the first quantum key pool and the first target quantum key, and the key state information is used to enable the receiving end to acquire a second target quantum key from a corresponding second quantum key pool.

[0124] In one embodiment of the present disclosure, the processing unit 910 may perform the following steps: receiving a second key acquisition request sent by a receiving end, wherein the second key acquisition request carries key state information of a first quantum key pool and a length of a first target quantum key sent by a sending end; determining a second quantum key pool according to the key state information of the first quantum key pool, and matching the key state information of the first quantum key pool with the key state information of the second quantum key pool; if the key state information matches, acquiring a second target quantum key from the second quantum key pool, wherein the first target quantum key is the same as the second target quantum key, and the second target quantum key is used by the receiving end to decrypt a received encrypted data packet; and returning a second key acquisition response to the receiving end, wherein the second key acquisition response carries the second target quantum key.

[0125] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0126] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0127] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0128] The electronic device 900 may also communicate with one or more external devices 940 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or may communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0129] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0130] Based on the same inventive concept, a computer-readable storage medium is also provided in the embodiment of the present disclosure, on which a computer program is stored, and when the computer program is executed by a processor, any of the above-mentioned quantum key-based communication methods is implemented. Since the principle of solving the problem in the computer-readable storage medium embodiment is similar to that in the above-mentioned method embodiment, the implementation of the computer-readable storage medium embodiment can refer to the implementation of the above-mentioned method embodiment, and the repeated parts will not be repeated.

[0131] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0132] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0133] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0134] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0135] Based on the same inventive concept, a computer program product is also provided in the embodiments of the present disclosure, including a computer program product, including: a computer program or an instruction, which implements any one of the quantum key-based communication methods in the above method embodiments when the computer program or the instruction is executed by the processor. Since the principle of solving the problem in the computer program product embodiment is similar to that in the above method embodiment, the implementation of the computer program product embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0136] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0137] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0138] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0139] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A communication method based on quantum key, characterized in that: include: Receiving a first key acquisition request sent by a sending end, wherein the first key acquisition request carries the size of a data packet to be sent and predetermined identity information of a receiving end, and the receiving end is a terminal device communicating with the sending end; Determining a first quantum key pool according to the identity information of the receiving end; According to the size of the data packet to be sent, obtaining a first target quantum key from the first quantum key pool, wherein the first target quantum key is used by the sending end to encrypt the data packet to be sent; Returning a first key acquisition response to the sending end, wherein the first key acquisition response carries the key state information of the first quantum key pool and the first target quantum key, and the key state information is used to enable the receiving end to obtain a second target quantum key from the corresponding second quantum key pool.

2. The communication method based on quantum key according to claim 1, characterized in that: Before determining the first quantum key pool according to the identity information of the receiving end, the method further includes: Multiple quantum key pools are generated according to the identity information of multiple senders, the identity information of multiple receivers, and the communication direction between each sender and each receiver, wherein the communication direction between each sender and each receiver is used to identify the corresponding quantum key pool.

3. The communication method based on quantum key according to claim 1, characterized in that: According to the size of the data packet to be sent, obtaining a first target quantum key from the first quantum key pool includes: Obtaining a key start bit of a first quantum key pool; A first target quantum key is determined according to the length of the data packet to be sent and the key start bit of the first quantum key pool.

4. The communication method based on quantum key according to claim 3, characterized in that: After determining the first target quantum key according to the length of the data packet to be sent and the key start bit of the first quantum key pool, the method further includes: Updating the key start bit of the first quantum key pool; Determining whether the difference between the length of the first quantum key pool and the updated key start bit is greater than the maximum length of the data packet to be sent; If not, the key in the first quantum key pool is updated, and the first summary is updated according to the updated key, wherein the first summary is a hash value obtained by calculating the key in the first quantum key pool according to a preset hash algorithm.

5. A communication method based on quantum key, characterized in that: include: Receiving a second key acquisition request sent by a receiving end, wherein the second key acquisition request carries key state information of a first quantum key pool and a length of a first target quantum key sent by a sending end; Determining a second quantum key pool according to the key state information of the first quantum key pool, and matching the key state information of the first quantum key pool with the key state information of the second quantum key pool; If the key state information matches, obtaining a second target quantum key from the second quantum key pool, wherein the first target quantum key is the same as the second target quantum key, and the second target quantum key is used by the receiving end to decrypt the received encrypted data packet; Returning a second key acquisition response to the receiving end, wherein the second key acquisition response carries the second target quantum key.

6. The communication method based on quantum key according to claim 5, characterized in that: The key state information of the first quantum key pool includes: an identifier of the first quantum key pool and a first summary, wherein the first summary is a hash value obtained by calculating the key of the first quantum key pool according to a preset hash algorithm.

7. The communication method based on quantum key according to claim 6, characterized in that: Determining a second quantum key pool according to the key state information of the first quantum key pool, and matching the key state information of the first quantum key pool with the key state information of the second quantum key pool, including: Determining a second quantum key pool according to an identifier of the first quantum key pool; Calculate the key in the second quantum key pool according to a preset hash algorithm to obtain a second summary; The first digest and the second digest are matched, and it is determined whether to obtain the second target quantum key from the second quantum key pool according to the matching result.

8. A communication device based on quantum key, characterized in that: include: A first key acquisition request receiving module, configured to receive a first key acquisition request sent by a sending end, wherein the first key acquisition request carries the size of a data packet to be sent and predetermined identity information of a receiving end, and the receiving end is a terminal device communicating with the sending end; A first quantum key pool determining module, configured to determine a first quantum key pool according to the identity information of the receiving end; A first target quantum key acquisition module, used to acquire a first target quantum key from the first quantum key pool according to the size of the data packet to be sent, wherein the first target quantum key is used by the sending end to encrypt the data packet to be sent; a first key acquisition response returning module, configured to return a first key acquisition response to the sending end, wherein the first key acquisition response carries the key state information of the first quantum key pool and the first target quantum key, and the key state information is used to enable the receiving end to obtain a second target quantum key from the corresponding second quantum key pool.

9. A communication device based on quantum key, characterized in that: include: A second key acquisition request receiving module, configured to receive a second key acquisition request sent by a receiving end, wherein the second key acquisition request carries key state information of a first quantum key pool and a length of a first target quantum key sent by a sending end; A key state information matching module, used to determine a second quantum key pool according to the key state information of the first quantum key pool, and match the key state information of the first quantum key pool with the key state information of the second quantum key pool; A second target quantum key acquisition module, configured to acquire a second target quantum key from the second quantum key pool if the key state information matches each other, wherein the first target quantum key is the same as the second target quantum key, and the second target quantum key is used by the receiving end to decrypt a received encrypted data packet; The second key acquisition response returning module is used to return a second key acquisition response to the receiving end, wherein the second key acquisition response carries the second target quantum key.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the quantum key-based communication method according to any one of claims 1 to 7 by executing the executable instructions.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the quantum key-based communication method described in any one of claims 1 to 7 is implemented.

12. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the quantum key-based communication method described in any one of claims 1 to 7.

Images