Key negotiation method, system and device and electronic equipment

Abstract

The invention discloses a key negotiation method, system and device and electronic equipment. The method comprises the following steps: obtaining a quantum key generated by a quantum key service platform; key negotiation processing is carried out on the quantum key through a border gateway protocol, a target key corresponding to the first router device is generated, and the target key is a key obtained after key negotiation is carried out on the first router device and a second router device through the border gateway protocol; the first router equipment and the second router equipment are any router equipment in a network forwarding layer; a quantum key library is determined according to the target key, and the quantum key library is a key database obtained after key negotiation is carried out on all router devices in a network forwarding layer through a border gateway protocol. According to the invention, the technical problems of low point-to-point key negotiation efficiency, high cost and complex network protocol due to limited application of a quantum key distribution technology in related technologies are solved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a key negotiation method, system, device and electronic device. Background Art

[0002] The breakthrough progress of quantum technology, especially QKD technology (Quantum Key Distribution), is increasingly becoming a key cornerstone for ensuring the security of information transmission. QKD technology uses the principles of quantum mechanics, especially the non-cloning of quantum states and the uncertainty of measurement results, to provide a theoretically unbreakable key distribution mechanism, ensuring the security of information transmission between communicating parties. It is especially suitable for industries such as finance, government affairs, and transportation that have extremely high security requirements.

[0003] At present, in the application scenarios of quantum keys, the localized construction of QKDN (Quantum Key Distribution Network) is mostly adopted, that is, each node in the network is required to directly connect with the quantum device to obtain and distribute quantum keys. Although this method can achieve the distribution of quantum keys, it has obvious disadvantages. First, the high construction cost and complex network structure limit the widespread application of quantum keys, especially in large-scale communication networks; secondly, the key negotiation mechanism in related technologies, such as the IKE protocol (Internet Key Exchange) based on IPSEC (Internet Protocol Security), can only achieve point-to-point key negotiation, which is inefficient, especially when the network scale is expanded, it will significantly increase the computing load of network equipment, and also increase the complexity of key negotiation and the difficulty of operation; finally, the maintenance of BGP protocol (Border Gateway Protocol) and IKE protocol in the communication network at the same time increases the complexity of network protocols, which is not conducive to the stable operation and maintenance of the network.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a key negotiation method, system, device and electronic device to at least solve the technical problems of low efficiency, high cost and complex network protocol of point-to-point key negotiation due to the limited application of quantum key distribution technology in related technologies.

[0006] According to one aspect of an embodiment of the present application, a key negotiation method is provided, including: obtaining a quantum key generated by a quantum key service platform; performing key negotiation processing on the quantum key through a border gateway protocol to generate a target key corresponding to a first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any router devices in a network forwarding layer; determining a quantum key library according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

[0007] Optionally, obtaining the quantum key generated by the quantum key service platform includes: determining a pre-charged key of the first router device, wherein the pre-charged key is used to represent a key pre-agreed between the first router device and the quantum key service platform; determining a first quantum key in the quantum key corresponding to the first router device based on the pre-charged key; and obtaining the first quantum key from the quantum key service platform through the border gateway protocol.

[0008] Optionally, key negotiation processing is performed on the quantum key through the border gateway protocol to generate a target key corresponding to the first router device, including: using an asymmetric encryption algorithm to generate a first public key and a first private key corresponding to the first router device; sending the first public key to the second router device through the border gateway protocol, and receiving a second public key sent by the second router device through the border gateway protocol, wherein the second public key is a public key generated by the second router device using the asymmetric encryption algorithm; and encrypting the first quantum key according to the second public key to obtain the target key.

[0009] Optionally, performing key negotiation processing on the quantum key through the border gateway protocol to generate a target key corresponding to the first router device also includes: obtaining a second quantum key corresponding to the second router device, wherein the second quantum key is a quantum key obtained from a quantum key service platform based on a pre-charged key of the second router device; determining a first eigenvalue based on the first quantum key, and determining a second eigenvalue based on the second quantum key, the first eigenvalue is used to represent a public value calculated by the first router device based on the first quantum key, and the second eigenvalue is used to represent a public value calculated by the second router device based on the second quantum key; sending the first eigenvalue to the second router device through the border gateway protocol, and the second router device generates a first key based on the first eigenvalue; and sending the second eigenvalue to the first router device through the border gateway protocol, and the first router device generates a second key based on the second eigenvalue; determining the target key based on the first key and the second key.

[0010] Optionally, the method also includes: distributing the quantum key to the first router device through a controller in the network operation control layer.

[0011] Optionally, the method also includes: determining a newly added instance of the first router device; generating a quantum key request corresponding to the first router device based on the newly added instance; the controller sends the quantum key to the first router device based on the quantum key request, and binds the quantum key to the newly added instance of the first router device.

[0012] Optionally, the method further includes: generating an update request corresponding to the first router device through a border gateway protocol, wherein the update request includes routing group attributes and routing update information of the first router device; and re-performing a key negotiation operation between the first router device and the second router device based on the update request.

[0013] According to another aspect of an embodiment of the present application, a key agreement system is also provided, including: a quantum key service layer, a network operation control layer and a network forwarding layer, wherein the quantum key service layer includes a quantum key service platform, and the quantum key service platform is used to generate a quantum key; the network operation control layer includes a controller and a route reflector, and the controller is used to send the quantum key to a router device in the network forwarding layer; the network forwarding layer is used to perform key agreement processing on the quantum key through the border gateway protocol, and generate a target key corresponding to the first router device, wherein the target key is a key obtained after the first router device and the second router device perform key agreement through the border gateway protocol, and the first router device and the second router device are any one of the router devices in the network forwarding layer; a quantum key library is determined according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key agreement through the border gateway protocol.

[0014] According to another aspect of the embodiment of the present application, a key negotiation device is further provided, including: an acquisition module, used to acquire a quantum key generated by a quantum key service platform; a negotiation module, used to perform key negotiation processing on the quantum key through a border gateway protocol, and generate a target key corresponding to a first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any one of the router devices in the network forwarding layer; a determination module, used to determine a quantum key library according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

[0015] According to another aspect of the embodiments of the present application, an electronic device is provided, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned key negotiation method.

[0016] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned key negotiation method by running the computer program.

[0017] According to another aspect of the embodiments of the present application, a computer program product is also provided, including computer instructions, which implement the above-mentioned key negotiation method when executed by a processor.

[0018] In an embodiment of the present application, a quantum key generated by a quantum key service platform is obtained; a key negotiation process is performed on the quantum key through a border gateway protocol to generate a target key corresponding to a first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through a border gateway protocol, and the first router device and the second router device are any router devices in a network forwarding layer; a quantum key library is determined according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through a border gateway protocol, thereby achieving the purpose of improving the efficiency of key negotiation based on quantum key distribution technology and border gateway protocol, thereby achieving the technical effect of efficiently, economically and securely performing quantum key negotiation and distribution in a large-scale communication network, thereby solving the technical problems of low efficiency, high cost and complex network protocol of point-to-point key negotiation due to the limited application of quantum key distribution technology in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a hardware structure diagram of a computer terminal for implementing a key negotiation method according to an embodiment of the present application;

[0021] Figure 2 is a flow chart of a key negotiation method according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of the architecture of a quantum key agreement system according to an embodiment of the present application;

[0023] Figure 4It is a structural diagram of a key negotiation device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] First, some nouns or terms that appear in the process of explaining the embodiments of the present application are subject to the following explanations:

[0027] BGP (Border Gateway Protocol): A dynamic routing protocol used to exchange routing information between different ASs (Autonomous Systems). In the backbone network of the Internet, BGP is the most important routing protocol used to determine the optimal transmission path for data packets.

[0028] BGP Community attribute: An optional, transparent attribute in BGP that is used to classify and mark routes to facilitate the implementation of specific routing policies. The community attribute consists of one or more labels and can be recognized and processed by AS boundary routers.

[0029] IKE (Internet Key Exchange): Internet Key Exchange Protocol, based on ISAKMP (Internet Security Association and Key Management Protocol), uses UDP (User Datagram Protocol) for transmission, and is mainly used in IPSec (Internet Protocol Security) protocol to negotiate and establish security associations, automatically exchange and manage keys.

[0030] Asymmetric encryption algorithm: An encryption algorithm that uses different keys for encryption and decryption. A typical example is the RSA algorithm, which is widely used in data security transmission, digital signature and other fields.

[0031] DH algorithm (Diffie-Hellman): An algorithm that allows two parties to securely share keys in public communications. It is based on the difficulty of the discrete logarithm problem and is used for key negotiation. It is an important component of establishing a secure communication channel.

[0032] RSA algorithm: A public key encryption algorithm based on the problem of prime factorization of large numbers, widely used in data encryption and digital signatures.

[0033] National Secret SM2: A domestically produced asymmetric encryption algorithm approved by the China National Cryptography Administration. Compared with RSA, it has significant advantages in signing speed and key generation speed, and is more suitable for encryption needs within China.

[0034] QKD (quantum key distribution): It is a key technology in quantum communication that realizes secure key distribution based on the principles of quantum mechanics (such as quantum state non-cloning and quantum entanglement) to ensure that the keys used by both communicating parties cannot be eavesdropped or copied.

[0035] QKDN (Quantum Key Distribution Network): A network consisting of multiple quantum key distribution nodes connected by quantum links. It is used to distribute quantum keys between different nodes and is the infrastructure for realizing quantum communication.

[0036] In order to solve the problem of poor efficiency of quantum key negotiation in the related art, the embodiment of the present application provides a key negotiation method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is described below.

[0037] The key agreement method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a key negotiation method. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0038] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0039] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the key negotiation method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned key negotiation method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0040] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0041] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0042] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0043] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of a key negotiation method. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] Figure 2 is a flowchart of a key negotiation method according to an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0045] Step S202, obtaining the quantum key generated by the quantum key service platform.

[0046] In the above step S202, the quantum key service platform, as the generation and distribution center of the quantum key, can generate physical true random numbers as quantum keys through the quantum key distribution network (QKDN). Furthermore, the controller in the network operation control layer is centrally connected to the platform to ensure that the quantum key can be reasonably distributed to each router device in the network.

[0047] It should be noted that the acquisition of quantum keys can be performed immediately after the device is restarted, or can be performed at a fixed time through a timer. Specific strategies include, for example, the time interval, quantity, and number of bits for obtaining the key, so as to adapt to different network requirements and security levels.

[0048] Step S204: performing key negotiation processing on the quantum key through the border gateway protocol to generate a target key corresponding to the first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any router devices in the network forwarding layer.

[0049] In the above step S204, the first router device uses the acquired quantum key to perform key negotiation with the second router device using a key negotiation algorithm (such as an asymmetric encryption algorithm or a DH algorithm). Specifically, for an asymmetric encryption algorithm, the first router device sends the generated public key to the second router device through the BGP extended group attribute, and after receiving the public key, the second router device generates a working key (target key) using the quantum key and the public key of the first router device. For the DH algorithm, the first router device and the second router device use the quantum key as part of the private key, calculate their respective eigenvalues, and exchange these eigenvalues ​​between devices through BGP, and finally calculate the same working key through the DH algorithm. This method combines the generation of quantum keys with the routing update mechanism of the BGP protocol, realizes key negotiation while publishing routes, improves the efficiency of key negotiation, and also ensures the security of keys.

[0050] Step S206, determining a quantum key library according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

[0051] In the above step S206, when all router devices in the network forwarding layer have completed key negotiation through the BGP protocol, they store their generated target keys in the database to form a quantum key library. This database becomes a historical record of quantum key negotiation between all devices in the entire network, facilitating key management and updating, while ensuring the independence and security of keys between different services and different routes.

[0052] Through the above steps S202 to S206, the purpose of improving the efficiency of key negotiation based on quantum key distribution technology and border gateway protocol is achieved, thereby achieving the technical effect of efficient, economical and secure quantum key negotiation and distribution in large-scale communication networks, thereby solving the technical problems of low efficiency, high cost and complex network protocol of point-to-point key negotiation due to the limited application of quantum key distribution technology in related technologies. The following is a detailed description.

[0053] Figure 3 is a schematic diagram of the architecture of a quantum key negotiation system according to an embodiment of the present application, such as Figure 3 As shown in the figure, the system includes a quantum key service layer, a network operation control layer, and a network forwarding layer. The details are as follows:

[0054] The quantum key service layer consists of the quantum key distribution network (QKDN) and the quantum key service platform. The quantum key distribution network is responsible for generating physical true random numbers, namely quantum keys, through QKD technology. These keys are quantum secure and can be used for encrypted communications. As an interface layer, the quantum key service platform provides quantum key services for the entire operating network, including key generation, storage, and distribution.

[0055] The network operation control layer includes the SDN (Software Defined Networking) controller and the RR (Route Reflector). The SDN controller is responsible for the policy control and management of the entire network. It connects with the quantum key service platform, obtains the quantum key and distributes the key to the devices in the network forwarding layer according to the network policy. The RR route reflector is used to reflect routing information between BGP peers, so that BGP peers do not have to directly establish a full peer-to-peer connection, simplifying the network structure and expanding the key negotiation function on this basis.

[0056] The network forwarding layer is composed of multiple router devices (such as R1, R2, and R3) in the network. After receiving the quantum key and key negotiation strategy, these router devices can negotiate with each other to generate working keys. The working key is used to encrypt and decrypt service messages to ensure the security of communication. Router devices negotiate keys through BGP extended community attributes, achieving the synchronization of route publishing and key negotiation, and improving network efficiency and security.

[0057] In this architecture, the quantum key service platform is centrally connected to the SDN controller, which reduces the need for direct communication between each device in the network and the quantum key service platform, reduces costs, and improves security. The SDN controller and RR route reflector work together to simplify the complexity of key distribution and network management. The router devices in the network forwarding layer perform key negotiation through BGP protocol extensions, and each route or each VPN instance uses a different key, thereby enhancing the confidentiality and integrity of data transmission in the network.

[0058] Optionally, obtaining the quantum key generated by the quantum key service platform includes: determining a pre-charged key of the first router device, wherein the pre-charged key is used to represent a key pre-agreed between the first router device and the quantum key service platform; determining a first quantum key in the quantum key corresponding to the first router device based on the pre-charged key; and obtaining the first quantum key from the quantum key service platform through the border gateway protocol.

[0059] In the embodiment of the present application, in order to further enhance the security and flexibility of key management, the concept of pre-charged key is introduced. The pre-charged key is a key pre-agreed between the first router device and the quantum key service platform, which is used to identify and control the acquisition process of the quantum key to enhance the security of the entire system and the flexibility of key management. The details are as follows:

[0060] Specifically, when the first router device establishes a connection with the quantum key service platform, it will determine a pre-filled key. This key can be generated when the device is started, or updated periodically through an agreement between the two parties, and securely transmitted to the quantum key service platform through the Border Gateway Protocol (BGP). Among them, the pre-filled key does not participate in the direct communication encryption process, but serves as an agreed identifier between the quantum key service platform and the first router device to ensure the correct distribution of the quantum key.

[0061] When the first router device needs a quantum key, it interacts with the quantum key service platform based on the pre-filled key. The quantum key service platform maintains a key pool containing multiple quantum keys. The pre-filled key plays the role of an index in this process, helping the quantum key service platform determine which quantum keys should be matched with the first router device. After that, the first quantum key is carried and sent to the first router device through the extended community attribute of the BGP protocol.

[0062] It should be noted that the BGP protocol was originally used to exchange network reachability information between autonomous systems (AS). In the above process, the BGP protocol was given a new function, namely the acquisition and distribution of quantum keys. Specifically, the first router device uses the extended group attribute in the BGP message to carry the pre-filled key information to request the quantum key from the quantum key service platform. After receiving the request, the quantum key service platform determines the first quantum key based on the identifier of the pre-filled key, and sends it to the first router device through the response message of the BGP protocol. This method simplifies the transmission process of the quantum key while maintaining the security of communication.

[0063] In summary, the introduction of pre-charged keys provides a safer and more flexible method for acquiring and managing quantum keys. While maintaining the advantages of the original solution, it improves the overall security and management efficiency of the system and is an important means of building a quantum secure communication network.

[0064] In the above step S204, key negotiation processing is performed on the quantum key through the border gateway protocol to generate a target key corresponding to the first router device, including: using an asymmetric encryption algorithm to generate a first public key and a first private key corresponding to the first router device; sending the first public key to the second router device through the border gateway protocol, and receiving a second public key sent by the second router device through the border gateway protocol, wherein the second public key is a public key generated by the second router device using the asymmetric encryption algorithm; encrypting the first quantum key according to the second public key to obtain the target key.

[0065] In the embodiment of the present application, an asymmetric encryption algorithm (such as the national encryption SM2) can be used to perform key negotiation between the first router device and the second router device. The specific process can be as follows:

[0066] First, the first router device (R1) obtains the first quantum key from the quantum key service platform. The quantum key is a random sequence generated based on the principle of quantum physics, which has extremely high security and unpredictability. Then, an asymmetric encryption algorithm (such as the national secret SM2 algorithm) is used to generate a pair of public and private key pairs corresponding to the first router device, namely the above-mentioned first public key and first private key, wherein the first private key is securely stored on R1, and the first public key is used for subsequent key distribution. It should be noted that in the national secret SM2 algorithm, the generation of the first private key can be participated in by converting some bits of the first quantum key into parameters required by the algorithm (such as points on an elliptic curve). Specifically, the first 64 bits (or part) of the first quantum key can be used to generate a prime number p that meets the algorithm requirements, and the last 64 bits (or another part) can generate another prime number q. These two prime numbers p and q are used to generate an asymmetric key pair. For the second router device R2, it also uses similar steps to generate its own second public key and second private key.

[0067] Secondly, R1 will carry the generated first public key through the BGP extended community attribute and send it to its BGP peer, such as the second router device R2. At the same time, R2 will also send its generated second public key to R1 through the same mechanism. Through the BGP protocol, the public keys of the two devices can be transmitted in the network, while the private keys are securely retained in each device and are not transmitted over the network.

[0068] After receiving the second public key from R2, R1 will use the second public key to encrypt part or all of the first quantum key to generate the target key. Specifically, the first quantum key is used as information or key, and the second public key is used as the key in the encryption process. Due to the characteristics of the asymmetric encryption algorithm, only the corresponding private key (in this case, R2's private key) can decrypt this information and obtain the target key. In this process, part or all of the first quantum key is converted into ciphertext and sent to R2 through the BGP protocol. After receiving the ciphertext, R2 uses its own private key to decrypt it to obtain the target key.

[0069] It should be noted that in key negotiation based on asymmetric encryption algorithms, the quantum key library composed of the target key includes at least fields such as key type, owner (i.e. router device ID), public key and private key. Each device (such as a router) needs to store its own private key and the public keys of other devices communicating with it for encryption and decryption of communications.

[0070] In the above process, the generation of quantum keys and the use of asymmetric encryption algorithms ensure the security and privacy of the key negotiation process. The extended community attribute of the BGP protocol is used as a communication channel to securely exchange public keys and key seeds, avoiding the complexity and inefficiency of the point-to-point negotiation method of traditional key negotiation protocols (such as IKE), and achieving efficient key negotiation and distribution.

[0071] In the above step S204, the quantum key is negotiated through the border gateway protocol to generate a target key corresponding to the first router device, which also includes: obtaining a second quantum key corresponding to the second router device, wherein the second quantum key is a quantum key obtained from the quantum key service platform according to the pre-charged key of the second router device; determining a first characteristic value according to the first quantum key, and determining a second characteristic value according to the second quantum key, the first characteristic value is used to represent the public value calculated by the first router device according to the first quantum key, and the second characteristic value is used to represent the public value calculated by the second router device according to the second quantum key; sending the first characteristic value to the second router device through the border gateway protocol, and the second router device generates a first key according to the first characteristic value; and sending the second characteristic value to the first router device through the border gateway protocol, and the first router device generates a second key according to the second characteristic value; determining the target key according to the first key and the second key.

[0072] In the embodiment of the present application, the DH algorithm may also be used to perform key negotiation between the first router device and the second router device. The specific process may be as follows:

[0073] First, at the beginning of key negotiation, the first router device (R1) and the second router device (R2) obtain quantum keys from the quantum key service platform, namely the first quantum key and the second quantum key mentioned above, respectively. These quantum keys are used as the private keys of R1 and R2 in the DH algorithm. It should be noted that R2 is similar to R1 in that both obtain quantum keys from the quantum key service platform, but this process is independent, that is, R2 needs to obtain the second quantum key based on its own pre-injected key.

[0074] Secondly, R1 uses the first quantum key (as its own private key K1) and a pre-agreed public parameter (large prime number p and base g) to calculate its first eigenvalue A, with the formula A=g^K1 mod p. Similarly, R2 uses the second quantum key (as its own private key K2) and the same public parameter to calculate the second eigenvalue B, with the formula B=g^K2mod p. These eigenvalues ​​are public and can be safely transmitted on the network, because even if a third party knows the eigenvalues ​​A and B, it cannot derive the private keys K1 and K2 unless it can crack the prime factorization of the large integer p.

[0075] R1 sends the calculated first eigenvalue A to R2 through the extended community attribute of the BGP protocol. After receiving A, R2 combines its own second quantum key (K2) and uses the calculation formula K12=A^K2mod p in the DH algorithm to generate the first key K12. Here, K12 is the shared private key calculated by R2.

[0076] At the same time, R2 sends the second eigenvalue B to R1 through the BGP protocol. After receiving B, R1 combines its own first quantum key (K1) to calculate K21=B^K1 mod p to obtain the second key K21.

[0077] In the quantum key negotiation process based on the DH algorithm, the keys K12 and K21 obtained by R1 and R2 through independent calculations should theoretically be exactly the same. This is because the design of the DH algorithm ensures that as long as the prime number p, base number g and the private key generated by both parties are correct, the calculated shared keys will be consistent. However, in practical applications, in order to absolutely ensure the consistency and security of the keys calculated by both parties, a key comparison confirmation can be performed through a secure classical communication channel.

[0078] In an embodiment of the present application, the inherent security of the BGP protocol can be utilized to carry key confirmation information through the BGP extended group attribute, and asymmetric encryption or existing BGP authentication mechanisms can be used to protect this information. For example, R1 can use R2's public key to encrypt a HASH value of R1's target key, and then send the encrypted string to R2 as part of the BGP extended group attribute. After R2 receives the encrypted string, it uses its own private key to decrypt the HASH value and compares it with the HASH value of R2's target key to confirm the consistency of the key. If R1 and R2 confirm that K12 and K21 are completely consistent after comparison through the classical communication channel, then this shared key is accepted by both parties as the target key and is used to encrypt and decrypt service messages between R1 and R2. If the keys are inconsistent, both parties need to re-execute the key negotiation process to ensure that a reliable and secure communication channel can be established.

[0079] It should be noted that in the key negotiation based on the DH algorithm, the quantum key library composed of the target key includes at least fields such as the source router, the destination router and the shared private key Kmn. A separate shared private key is generated between each pair of communication devices. The private key is calculated by the DH algorithm and is used to encrypt and decrypt the communication between them.

[0080] The entire key negotiation process based on the DH algorithm utilizes the quantum security characteristics of quantum keys to enhance the security of traditional DH algorithms. Quantum keys are obtained through quantum communication technology at the physical layer, ensuring the initial security of private keys. Then, the DH algorithm performs calculations based on the quantum keys to generate a key shared by both parties. Even if this process is monitored by a third party, due to the security design of the DH algorithm, the third party cannot directly derive the shared key K12 from the eigenvalues ​​A and B. Finally, through the mechanism of extending group attributes in the BGP protocol, the shared key calculated by the DH algorithm can be securely negotiated between network devices, realizing the effective combination of quantum security and traditional network protocols.

[0081] It should be noted that the DH algorithm itself does not provide a direct authentication mechanism. Therefore, in practical applications, it is usually necessary to combine it with other authentication methods (such as digital signatures) to ensure the identity of the communicating parties and the integrity of the key negotiation process to prevent man-in-the-middle attacks.

[0082] Optionally, the method further includes: distributing the quantum key to the first router device through a controller in the network operation control layer. Specifically, for example, determining a newly added instance of the first router device; generating a quantum key request corresponding to the first router device according to the newly added instance; the controller sends the quantum key to the first router device according to the quantum key request, and binds the quantum key to the newly added instance of the first router device.

[0083] In the embodiment of the present application, the concept of SDN (Software Defined Networking) is embodied, that is, the control plane of the network is separated from the data plane, so that the control plane can centrally manage and allocate resources, including quantum keys. As the core of the control plane, the controller is responsible for dynamically allocating quantum keys to devices in the data plane (such as routers) according to the network status and security policy, ensuring that each communication instance can obtain an independent and secure key. The specific process can be as follows:

[0084] First, when the network operation control layer detects that a new service instance (for example, a new VPN or routing instance) needs to be created for the first router device (R1), the controller (such as the SDN controller) generates a quantum key request based on the newly added instance of R1. The quantum key request contains necessary information about R1 and its newly added instance, such as device ID, instance ID, required key type (asymmetric or DH), key length and other parameters. The controller is responsible for coordinating the resources of the entire network, so it needs to properly manage the distribution of keys to ensure that each instance has its own exclusive security key.

[0085] This is the trigger point for quantum key distribution. The creation of a business instance means that a new communication channel or service will be enabled, and a new quantum key is required to ensure the security of communication.

[0086] Secondly, the controller sends the quantum key request to the quantum key service platform, which generates a suitable quantum key based on the request. The generated quantum key is then sent to R1 by the controller through a secure communication channel, such as the extended community attribute of the BGP protocol. In this process, the controller acts as an intermediary between the quantum key service platform and R1, ensuring the secure transmission of the key.

[0087] Finally, after receiving the quantum key, R1 binds it to the newly added service instance. This means that the quantum key is designated to protect the communication security of this instance. The binding process may involve creating a new entry in R1's key management database, containing relevant information such as the key type, owner (R1), the key itself, instance ID, etc. Once the binding is completed, the quantum key can be used for subsequent key negotiation, such as asymmetric encryption algorithm or DH algorithm negotiation, to generate a working key or a shared key.

[0088] In this way, network operators can achieve efficient management and distribution of quantum keys without increasing the burden on network equipment, thereby improving the overall security and operation and maintenance efficiency of the network. At the same time, the dynamic binding mechanism of quantum keys can adapt to dynamic changes in the network, such as the creation of new instances and the deletion of old instances, ensuring the flexibility and responsiveness of key management.

[0089] Optionally, the method further includes: generating an update request corresponding to the first router device through a border gateway protocol, wherein the update request includes routing group attributes and routing update information of the first router device; and re-performing a key negotiation operation between the first router device and the second router device based on the update request.

[0090] In the embodiment of the present application, the update request corresponding to the first router device is generated by the Border Gateway Protocol (BGP), which is a key part of the key update and dynamic key negotiation mechanism. This process enables the key to be updated in time when the network status changes or the key life cycle ends to maintain the security of communication. The details are as follows:

[0091] When the network environment of the first router device (R1) changes, such as adding a new route, modifying the route attribute, or the quantum key life cycle expires and needs to be updated, R1 will generate an update request. This update request contains the route group attribute and route update information, and is sent to other devices in the network, including the second router device (R2) through the BGP protocol. Among them, the group attribute in the update request can be a custom security group attribute, which may contain key negotiation related information, such as key type, key ID, key negotiation status, etc. The route update information reflects the changes in the network topology and can trigger the re-negotiation of key negotiation to adapt to the latest network environment.

[0092] After receiving the update request from R1, R2 will parse the routing group attributes and routing update information carried in it. If the group attributes indicate that the key needs to be renegotiated, R2 will start a new key negotiation process with R1 based on the information in the update request. If the key is negotiated based on an asymmetric encryption algorithm, R2 may need to resend or receive the public key and encrypt and decrypt the private key information based on the new public key. If the key is negotiated based on the DH algorithm, R2 and R1 may need to recalculate the eigenvalue and calculate the shared key based on the new eigenvalue.

[0093] During the renegotiation process, R1 and R2 will use the latest quantum key for key derivation. In this way, even if the previous quantum key is intercepted, the new key negotiation result is still based on the new quantum key, thereby maintaining the security of communication. The mechanism of re-negotiation of keys, combined with the extended community attribute of the BGP protocol, enables network devices to dynamically adapt to changes in the network environment without affecting normal routing updates, and timely update and negotiate new keys, thereby enhancing the flexibility and security of quantum secure communication networks. This mechanism is particularly important in large-scale networks because it allows network operators to maintain and update the key system of the entire network without interrupting services. For example, if R1 needs to update the key with R2, it will send an Update message containing the BGP community attribute, which may contain a specific key update identifier. After receiving this message, R2 will trigger the key negotiation process and recalculate the key using an asymmetric encryption algorithm or DH algorithm through the public key or feature value carried by BGP. During the entire process, the routing update and key negotiation between R1 and R2 are carried out synchronously, ensuring the continuity and security of network communication.

[0094] In this way, the BGP protocol is endowed with additional key management functions, allowing traditional network protocols to be seamlessly integrated with quantum key distribution technology to jointly build a quantum network communication environment that is both efficient and secure.

[0095] It should be noted that the BGP community attribute is a mechanism for classifying and marking routes. It is an optional, transparent attribute of any length. By attaching one or more labels to a route, specific processing of the route is achieved. Community attributes are divided into custom community attributes and recognized community attributes. Each autonomous system (AS) can freely define and use community attributes to meet its specific needs.

[0096] The format of the Community attribute is represented by a 32-bit number, usually composed of two 16-bit numbers, called the high bit and the low bit. The high bit usually represents the Autonomous System Number (ASN), and the low bit is the custom Community value. ASN: Value represents a specific Community value.

[0097] A combination of multiple Community attributes. A route can carry multiple Community attributes at the same time, which can be expressed by separating them with commas. Each Community attribute can have different meanings and functions. When processing and matching Community attributes, logical operators can be used to combine them. Common logical operators are AND, OR, and NOT. By flexibly combining and matching Community attributes, more complex routing policies and controls can be implemented. A maximum of 32 community attributes can be configured in one command.

[0098] In the embodiments of the present application, security group attributes are customized, and their formats and delivery strategies are redefined to meet the special needs of quantum key negotiation. The security group attributes identify information in the TLV (Type-Length-Value) format, with 12 bits in the upper 12 bits and 20 bits in the lower 20 bits, allowing key negotiation data to be securely exchanged between network devices. Among them, the first 8 bits of the upper 12 bits represent the message type: the key negotiation type has 3 bits in total; it is used to negotiate keys between devices. The first bit is the key negotiation message type, and the second and third bits are the message negotiation message subtype (negotiation sequence number).

[0099] In the key negotiation message, there are two message types: 10100000 and 11000000. Among them, 10100000 represents the first active sending of the negotiation message, and 11000000 represents a response message. For the negotiation message, when the first router device (such as R1) needs to negotiate the key with the second router device (such as R2), it will send a BGP extended community attribute with this message type. This message contains the key information required to initiate the negotiation, such as R1's public key or the characteristic value A in the DH algorithm. When R2 receives such a message, it will understand that this is the beginning of the negotiation process, so it will prepare to respond and perform subsequent key calculations. For the response message, when R2 receives the negotiation message from R1, it will generate its own response based on the information in the message, such as sending its own public key or the calculated characteristic value B, and encapsulate it in the response message and send it back through the BGP protocol. The message type carried in this response message tells R1 that this is a response to the negotiation initiation, so that R1 can continue to perform the next step of key negotiation.

[0100] The design of these two message types ensures the orderly and correct transmission of information during the key negotiation process. By including these binary-coded message types in the BGP extended community attributes, router devices can identify the negotiation stage, thereby correctly executing the response operations and ultimately completing the negotiation and generation of keys. This mechanism simplifies the complexity of the traditional key negotiation process, allowing quantum key negotiation to be more efficient and secure within the framework of traditional network protocols.

[0101] In the embodiments of the present application, key destruction is an important part of key lifecycle management, ensuring that the key can be removed from the system in a timely and secure manner when it is no longer needed, so as to prevent the key from being used or leaked without authorization.

[0102] For example, when a network administrator decides to stop using quantum secure communication or a quantum key reaches the end of its life cycle, the key encryption function can be turned off through the configuration interface of the network device or the automated management platform. This operation is usually for a specific communication instance or the entire device.

[0103] Once the key encryption function is turned off, the device will stop sending quantum key requests to the quantum key service platform. The key management module on the device will clear all key entries related to the turned-off key encryption function, including private keys, public keys, shared keys, and metadata related to these keys. This means that the device will no longer actively obtain new quantum keys, and existing keys will not be updated or replaced.

[0104] At the same time, after the key is destroyed, the network operation control layer (such as the SDN controller) will also update the network policy it manages to reflect the change in key status. For example, the controller may need to re-plan network traffic to bypass communication paths that are no longer encrypted with quantum keys.

[0105] In the embodiment of the present application, the BGP protocol and quantum key distribution technology are innovatively combined to achieve efficient negotiation and management of quantum keys. Through the centralized docking of the operator controller and the quantum key service platform, the BGP extended group attribute is used to carry key negotiation information, which not only avoids the high cost construction of the traditional QKDN network and the inefficient point-to-point negotiation of the IKE protocol, but also simplifies the network protocol, reduces the resource consumption of the equipment, and improves the operation and maintenance efficiency. The beneficial effect of this solution is that it can adapt to the dynamic changes of large-scale networks, support the architecture of separation of control and transmission, and make the acquisition, distribution, update and destruction of quantum keys automated and efficient, while enhancing communication security, especially in multi-point key negotiation and key anti-quantum security, and provides a feasible and economical solution for building a quantum secure communication network.

[0106] According to an embodiment of the present application, a key negotiation system is provided, including: a quantum key service layer, a network operation control layer and a network forwarding layer, wherein the quantum key service layer includes a quantum key service platform, and the quantum key service platform is used to generate a quantum key; the network operation control layer includes a controller and a route reflector, and the controller is used to send the quantum key to a router device in the network forwarding layer; the network forwarding layer is used to perform key negotiation processing on the quantum key through a border gateway protocol, and generate a target key corresponding to a first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any one of the router devices in the network forwarding layer; a quantum key library is determined according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

[0107] It should be noted that the above key agreement system is used to execute Figure 2 The key negotiation method shown in the figure, therefore the relevant explanations in the above key negotiation method are also applicable to the key negotiation system and will not be repeated here.

[0108] According to an embodiment of the present application, a key negotiation device is provided. It should be noted that the key negotiation device of the embodiment of the present application can be used to execute the key negotiation method provided in the embodiment of the present application. The key negotiation device provided in the embodiment of the present application is introduced below.

[0109] Figure 4 is a structural diagram of a key agreement device provided according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0110] An acquisition module 40 is used to acquire the quantum key generated by the quantum key service platform;

[0111] A negotiation module 42 is used to perform key negotiation processing on the quantum key through the border gateway protocol to generate a target key corresponding to the first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any router devices in the network forwarding layer;

[0112] The determination module 44 is used to determine the quantum key library according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

[0113] Through the acquisition module 40, negotiation module 42 and determination module 44 in the above-mentioned key negotiation device, the purpose of improving the key negotiation efficiency based on quantum key distribution technology and border gateway protocol is achieved, thereby achieving the technical effect of efficient, economical and secure quantum key negotiation and distribution in large-scale communication networks, and further solving the technical problems of low efficiency, high cost and complex network protocol of point-to-point key negotiation due to the limited application of quantum key distribution technology in related technologies.

[0114] In the key agreement device provided in the embodiment of the present application, the acquisition module is also used to determine the pre-charged key of the first router device, wherein the pre-charged key is used to represent the key pre-agreed between the first router device and the quantum key service platform; determine the first quantum key corresponding to the first router device in the quantum key based on the pre-charged key; the first router device obtains the first quantum key from the quantum key service platform through the border gateway protocol.

[0115] In the key agreement device provided in the embodiment of the present application, the negotiation module is also used to generate a first public key and a first private key corresponding to the first router device using an asymmetric encryption algorithm; send the first public key to the second router device through the border gateway protocol, and receive the second public key sent by the second router device through the border gateway protocol, wherein the second public key is a public key generated by the second router device using the asymmetric encryption algorithm; encrypt the first quantum key according to the second public key to obtain the target key.

[0116] In the key negotiation device provided in the embodiment of the present application, the negotiation module is also used to determine a second quantum key corresponding to the second router device, wherein the second quantum key is a quantum key obtained from the quantum key service platform based on the pre-charged key of the second router device; determine a first characteristic value based on the first quantum key, and determine a second characteristic value based on the second quantum key, the first characteristic value is used to represent the public value calculated by the first router device based on the first quantum key, and the second characteristic value is used to represent the public value calculated by the second router device based on the second quantum key; send the first characteristic value to the second router device through the border gateway protocol, and the second router device generates a first key based on the first characteristic value; and send the second characteristic value to the first router device through the border gateway protocol, and the first router device generates a second key based on the second characteristic value; determine the target key based on the first key and the second key.

[0117] In the key agreement device provided in the embodiment of the present application, a processing module 46 is also included, which is used to distribute the quantum key to the first router device through the controller in the network operation control layer.

[0118] In the key agreement device provided in the embodiment of the present application, the processing module is also used to determine a newly added instance of the first router device; generate a quantum key request corresponding to the first router device according to the newly added instance; the controller sends the quantum key to the first router device according to the quantum key request, and binds the quantum key to the newly added instance of the first router device.

[0119] In the key negotiation device provided in the embodiment of the present application, the processing module is also used to generate an update request corresponding to the first router device through the border gateway protocol, wherein the update request includes the group attributes and routing update information of the first router device; and the key negotiation operation between the first router device and the second router device is re-performed according to the update request.

[0120] An embodiment of the present application also provides an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute and implement the above-mentioned key negotiation method.

[0121] It should be noted that the above electronic equipment is used to execute Figure 2 The key negotiation method shown, therefore the relevant explanations and instructions in the above key negotiation method are also applicable to the electronic device and will not be repeated here.

[0122] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored computer program, wherein a device where the non-volatile storage medium is located executes the above-mentioned key negotiation method by running the computer program.

[0123] It should be noted that the above non-volatile storage medium is used to execute Figure 2 The key negotiation method shown, therefore the relevant explanations in the above key negotiation method are also applicable to the non-volatile storage medium and will not be repeated here.

[0124] An embodiment of the present application also provides a computer program product, including computer instructions, which implement the above-mentioned key negotiation method when executed by a processor.

[0125] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The key negotiation method shown in the figure, therefore the relevant explanations and instructions in the above key negotiation method are also applicable to the computer program product and will not be repeated here.

[0126] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0127] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0128] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0129] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0130] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0131] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0132] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A key negotiation method, characterized in that: include: Obtain the quantum key generated by the quantum key service platform; Performing key negotiation processing on the quantum key through the border gateway protocol to generate a target key corresponding to the first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any router devices in the network forwarding layer; A quantum key library is determined according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

2. The method according to claim 1, characterized in that Obtain the quantum key generated by the quantum key service platform, including: Determine a pre-filled key of the first router device, wherein the pre-filled key is used to represent a key pre-agreed between the first router device and the quantum key service platform; Determining a first quantum key among the quantum keys corresponding to the first router device according to the pre-injected key; The first quantum key is obtained from the quantum key service platform through the border gateway protocol.

3. The method according to claim 2, characterized in that The quantum key is subjected to key negotiation processing through a border gateway protocol to generate a target key corresponding to the first router device, including: Generate a first public key and a first private key corresponding to the first router device using an asymmetric encryption algorithm; Sending the first public key to the second router device through the border gateway protocol, and receiving a second public key sent by the second router device through the border gateway protocol, wherein the second public key is a public key generated by the second router device using the asymmetric encryption algorithm; The first quantum key is encrypted according to the second public key to obtain the target key.

4. The method according to claim 2, characterized in that: The quantum key is subjected to key negotiation processing by using the border gateway protocol to generate a target key corresponding to the first router device, and further comprising: Acquire a second quantum key corresponding to the second router device, wherein the second quantum key is a quantum key acquired from the quantum key service platform according to a pre-injected key of the second router device; Determine a first eigenvalue according to the first quantum key, and determine a second eigenvalue according to the second quantum key, the first eigenvalue being used to represent a public value calculated by the first router device according to the first quantum key, and the second eigenvalue being used to represent a public value calculated by the second router device according to the second quantum key; The first characteristic value is sent to the second router device through the border gateway protocol, and the second router device generates a first key according to the first characteristic value; and the second characteristic value is sent to the first router device through the border gateway protocol, and the first router device generates a second key according to the second characteristic value; The target key is determined according to the first key and the second key.

5. The method according to claim 1, characterized in that: The method further comprises: The quantum key is distributed to the first router device through a controller in the network operation control layer.

6. The method according to claim 5, characterized in that The method further comprises: Determining a newly added instance of the first router device; generating a quantum key request corresponding to the first router device according to the newly added instance; The controller sends the quantum key to the first router device according to the quantum key request, and binds the quantum key to the newly added instance of the first router device.

7. The method according to claim 1, characterized in that The method further comprises: Generate an update request corresponding to the first router device through the border gateway protocol, wherein the update request includes a routing community attribute and routing update information of the first router device; A key negotiation operation is performed again between the first router device and the second router device according to the update request.

8. A key agreement system, characterized in that: include: Quantum key service layer, network operation control layer and network forwarding layer, among which, The quantum key service layer includes a quantum key service platform, and the quantum key service platform is used to generate quantum keys; The network operation control layer includes a controller and a route reflector, and the controller is used to send the quantum key to a router device in the network forwarding layer; The network forwarding layer is used to perform key negotiation processing on the quantum key through the border gateway protocol to generate a target key corresponding to the first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any router devices in the network forwarding layer; determine a quantum key library according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

9. A key agreement device, characterized in that: include: An acquisition module, used to acquire the quantum key generated by the quantum key service platform; A negotiation module, configured to perform key negotiation processing on the quantum key through a border gateway protocol to generate a target key corresponding to the first router device, wherein the target key is a key obtained after the first router device and the second router device perform key negotiation through the border gateway protocol, and the first router device and the second router device are any router devices in a network forwarding layer; A determination module is used to determine a quantum key library according to the target key, wherein the quantum key library is a key database obtained after all router devices in the network forwarding layer perform key negotiation through the border gateway protocol.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory, and is used to execute the key negotiation method described in any one of claims 1 to 7.

11. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the key negotiation method according to any one of claims 1 to 7 by running the computer program.

12. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the key negotiation method described in any one of claims 1 to 7 is implemented.

Images