Self-distribution type global quantum security encryption device and communication system

Abstract

The invention discloses a self-distribution type global quantum security encryption device and system. The quantum encryption area of the encryption device can initiate a self-distribution process, so that the generated key generated by the quantum key generation area of the encryption device is distributed to the opposite-end quantum security encryption device, and after the encryption device successfully shares the generated key with the opposite-end quantum security encryption device, the quantum security encryption device can initiate the self-distribution process. Quantum secure communications may be performed directly based on the generated key without relying on key relaying. The quantum keys of the encryption device can be managed and stored in a unified manner through the quantum key area of the encryption device, so that the security of the quantum keys is ensured.

Description

Technical Field

[0001] The present application relates to the field of information security and quantum encryption technology, and in particular to a self-distributed global quantum security encryption device and system. Background Art

[0002] With the rapid development of information technology, data encryption technology has become an important means to ensure information security. In recent years, the global quantum security encryption system, as a cutting-edge quantum security encryption technology, has attracted much attention due to its theoretically unbreakable characteristics. The global quantum security encryption system is based on the global quantum security service and implements a series of security operations such as encryption, relay, key generation and distribution. Under this framework, all encryption terminals must continue to rely on the global quantum security service if they want to conduct global quantum security communications. The global quantum security service covers two core components: the access base station and the key center: the access base station is responsible for the access, authentication, authorization and key relay of the global quantum security terminal, ensuring that the global quantum security terminal legally and securely accesses the global quantum security encryption system; while the key center focuses on the generation, management and distribution of quantum keys, providing unpredictable and highly secure keys for both parties in communication.

[0003] However, despite the extremely high security of the global quantum security encryption system, it faces a series of challenges in practical applications. In particular, in certain specific situations, the continued dependence of the global quantum security encryption system on the global quantum security service has become an issue that cannot be ignored. For example, in extreme environments such as remote areas, oceans, and space, the long physical distance between the global quantum security terminal and the global quantum security service often leads to severe limitations on communication quality, resulting in a significant increase in the delay between the two communicating parties. Similarly, even in a conventional environment, if the connection stability between the communicating parties and the global quantum security service is insufficient, the communication delay will be greatly increased.

[0004] Faced with such a difficult problem, if we continue to unconditionally rely on global quantum security services for communication, as communication delays continue to accumulate, not only will the protection of quantum security encryption be out of the question, it may also cause serious communication delay problems, which will greatly affect the user experience.

[0005] Therefore, how to ensure the stable operation and efficiency of quantum secure communication between the two communicating parties in scenarios with high communication delays has become a technical challenge that needs to be solved urgently. Summary of the invention

[0006] The present application provides a self-distributed global quantum security encryption device and system, which is used to ensure the stable operation and efficiency of quantum secure communication between the communicating parties even in scenarios with high communication delays.

[0007] In a first aspect, the present application provides a self-distributed global quantum security encryption device, the device comprising: a business area, a quantum encryption area, a quantum key generation area, a quantum key area, a communication area and a verification area; wherein the verification area is respectively connected to the business area, the quantum encryption area and the communication area, and the quantum encryption area is respectively connected to the quantum key generation area and the quantum key area;

[0008] The service area is used to provide user service functions and manage and store service data;

[0009] The quantum key generation area is used to generate true random numbers based on the principles of quantum mechanics as a generated key;

[0010] The quantum key area is used to store and manage quantum keys; wherein the quantum keys include the generated keys;

[0011] The verification area is used to isolate different areas connected to the verification area and to implement data transfer between the different areas;

[0012] The communication area is used to complete external network communication;

[0013] The quantum encryption zone is used to initiate the self-distribution process of the generated key, and to provide quantum encryption and decryption services based on the generated key when performing quantum secure communication with the peer quantum secure encryption device;

[0014] The self-distribution process includes:

[0015] Based on the generated key stored in the quantum key area, determine the generated key index; pass the generated self-distribution request to the communication area through the verification area, so that the communication area relays the self-distribution request to the quantum security encryption device at the other end through the global quantum security network; wherein the self-distribution request carries the generated key index; and, through the verification area, obtain a self-distribution response from the communication area; wherein the self-distribution response is sent to the communication area by the quantum security encryption device at the other end through the global quantum security network, and the self-distribution response carries the generated key index; based on the generated key index, obtain the generated key from the quantum key area; pass the generated key to the communication area through the verification area, so that the communication area relays the generated key to the quantum security encryption device at the other end through the global quantum security network.

[0016] In a second aspect, the present application also provides a self-distributed global quantum secure encryption communication system, the system comprising a self-distributed global quantum secure encryption device for accessing the global quantum secure network as described above and a peer quantum secure encryption device accessed to the global quantum secure network;

[0017] The peer quantum security encryption device is used to receive a self-distribution request relayed by the self-distributed global quantum security encryption device through a global quantum security network; generate a self-distribution response based on a generated key index carried in the self-distribution request; send the self-distribution response to the self-distributed global quantum security encryption device through the global quantum security network; receive a generated key relayed by the self-distributed global quantum security encryption device through the global quantum security network; save the generated key, so as to perform quantum secure communication with the self-distributed global quantum security encryption device based on the generated key.

[0018] The beneficial effects of this application are as follows:

[0019] 1. Since the quantum encryption area of ​​the encryption device can initiate a self-distribution process, the generated key generated by the quantum key generation area of ​​the encryption device is distributed to the quantum security encryption device at the other end, so that after the encryption device successfully shares the generated key with the quantum security encryption device at the other end, it can directly perform quantum secure communication based on the generated key without relying on key relay.

[0020] 2. The quantum key area of ​​the encryption device can uniformly manage and store the quantum key of the encryption device, thereby ensuring the security of the quantum key.

[0021] 3. The verification area is used to isolate the business area, quantum encryption area and communication area, thereby preventing direct communication and data exchange between these areas. This isolation design effectively avoids the potential impact of external network data on the business area and quantum encryption area, and improves the security of the entire device. In particular, the separate isolation of the quantum encryption area is a strong guarantee for the security of quantum keys. Through isolation, the risk of illegal access or tampering of quantum keys can be further reduced, ensuring the smooth progress and security of quantum communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 A schematic diagram of the structure of a self-distributed global quantum security encryption device provided in an embodiment of the present application;

[0024] Figure 2 A schematic diagram of the workflow of a specific self-distributed global quantum secure encryption device provided in an embodiment of the present application;

[0025] Figure 3 A schematic diagram of the workflow of a specific self-distributed global quantum secure encryption device in the access phase provided in an embodiment of the present application;

[0026] Figure 4 A schematic diagram of the workflow of a specific self-distributing global quantum secure encryption device in the self-distribution stage provided in an embodiment of the present application;

[0027] Figure 5 A schematic diagram of a workflow for sending business data during the communication phase of a specific self-distributed global quantum secure encryption device provided in an embodiment of the present application;

[0028] Figure 6 A schematic diagram of a workflow of a specific self-distributed global quantum secure encryption device receiving business data during the communication phase provided in an embodiment of the present application;

[0029] Figure 7 A schematic diagram of a workflow for sending business data during the communication phase of a specific self-distributed global quantum secure encryption device provided in an embodiment of the present application;

[0030] Figure 8 A structural diagram of a self-distributed global quantum secure encryption communication system provided for this application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0032] The global quantum security encryption system can support secure and efficient quantum communication between any quantum security terminals connected to the encryption system, regardless of their geographical location. A core of the global quantum security encryption system is to use the access base station as a communication hub to connect the quantum security terminal to the global quantum security encryption system, and to achieve key relay between the global quantum security terminals connected to the global quantum security encryption system.

[0033] During the access process, when a quantum security terminal accesses an access base station, the access base station will assign a network access identifier to the terminal, which is a unique terminal identifier for the entire global quantum security encryption system to identify the terminal. The network access identifier carries information about the country, operator, region, cell, access base station, and terminal. With this network access identifier, the terminal can be identified in the global quantum security encryption system through this network access identifier within the time range that the terminal has this identifier. Subsequently, the quantum security terminal can apply for services and request resources from the global quantum security encryption system through the access base station.

[0034] During the key relay process, the encryption end will relay the key through the encryption end access base station through the global quantum security network to the access base station of the decryption end, and then the decryption end access base station will forward the key to the decryption end, so as to ensure that a symmetric quantum security key is formed between the encryption end and the decryption end, and encryption and decryption communication can be achieved. The global quantum security network also includes a key center, which mainly distributes keys, i.e. quantum keys, to quantum security terminals connected to the global quantum security network.

[0035] Although the global quantum security encryption system has extremely high security, it faces a series of challenges in practical applications. In particular, in certain specific situations, the continued dependence of the global quantum security encryption system on the global quantum security service has become an issue that cannot be ignored. For example, in extreme environments such as remote areas, oceans, and space, the long physical distance between the global quantum security terminal and the global quantum security service often leads to severe limitations on communication quality, resulting in a significant increase in the delay between the two communicating parties. Similarly, even in a conventional environment, if the connection stability between the communicating parties and the global quantum security service is insufficient, the communication delay will be greatly increased.

[0036] Faced with such a difficult problem, if we continue to unconditionally rely on global quantum security services for communication, as communication delays continue to accumulate, not only will the protection of quantum security encryption be out of the question, it may also cause serious communication delay problems, which will greatly affect the user experience.

[0037] Based on this, the present application provides a self-distributed global quantum security encryption device and system, which can be used to ensure the stable operation and efficiency of quantum secure communication between the communicating parties even in scenarios with high communication delays.

[0038] Embodiment 1:

[0039] Figure 1A schematic diagram of the structure of a self-distributed global quantum security encryption device provided in an embodiment of the present application, the device comprising: a business area 110, a quantum encryption area 120, a quantum key generation area 130, a quantum key area 140, a communication area 150 and a verification area 160; wherein the verification area 160 is respectively connected to the business area 110, the quantum encryption area 120 and the communication area 150, and the quantum encryption area 120 is respectively connected to the quantum key generation area 130 and the quantum key area 140;

[0040] The service area 110 is used to provide user service functions and manage and store service data;

[0041] The quantum key generation area 130 is used to generate true random numbers based on the principles of quantum mechanics as a generated key;

[0042] The quantum key area 140 is used to store and manage quantum keys; wherein the quantum keys include the generated keys;

[0043] The verification area 160 is used to isolate different areas connected to the verification area 160 and to implement data transmission between the different areas;

[0044] The communication area 150 is used to complete external network communication;

[0045] The quantum encryption zone 120 is used to initiate the self-distribution process of the generated key, and to provide quantum encryption and decryption services based on the generated key when performing quantum secure communication with the peer quantum secure encryption device;

[0046] The self-distribution process includes:

[0047] Based on the generated key stored in the quantum key area 140, determine the generated key index; pass the generated self-distribution request to the communication area 150 through the verification area 160, so that the communication area 150 relays the self-distribution request to the quantum security encryption device at the other end through the global quantum security network; wherein the self-distribution request carries the generated key index; and, through the verification area 160, obtain a self-distribution response from the communication area 150; wherein the self-distribution response is sent by the quantum security encryption device at the other end to the communication area 150 through the global quantum security network, and the self-distribution response carries the generated key index; based on the generated key index, obtain the generated key from the quantum key area 140; pass the generated key to the communication area 150 through the verification area 160, so that the communication area 150 relays the generated key to the quantum security encryption device at the other end through the global quantum security network.

[0048] In some specific application scenarios, such as in the working area or inside the factory, in the mountainous field environment, and in the scenario of operating equipment in the control room, the full realization of quantum secure communication often requires relying on the access base station in the global quantum secure encryption system to relay the key. However, this method is greatly limited by the communication quality and available bandwidth between the global quantum security terminal and the service. Especially in the case where there may be long-distance relays, the delay problem of key transmission is particularly prominent. For scenarios with high communication delay requirements, this delay may seriously hinder the effective implementation of global quantum secure communication, making it impossible for communication to serve normal work. Based on this, in the present application, a self-distributed global quantum secure encryption device 100 (referred to as encryption device 100) is provided. The encryption device 100 can still use the original key relay method to perform quantum secure communication with the peer quantum secure encryption device connected to the global quantum security network without special communication requirements. The peer quantum security encryption device may be a global quantum security terminal without self-distribution capability, such as a global quantum security all-in-one machine, a global quantum security privacy computer, etc., or a self-distributing global quantum security encryption device with self-distribution capability like the encryption device 100. In special scenarios with high communication delay requirements, the encryption device 100 may not need to rely on key relay, but can use the self-distribution mechanism to distribute the generated quantum key to the peer quantum security encryption device, and then based on the self-generated quantum key, directly perform quantum security communication with the peer quantum security encryption device 100 without key relay.

[0049] In order to realize the above functions, the encryption device 100 mainly includes a business area 110, a quantum encryption area 120, a quantum key generation area 130, a quantum key area 140, a communication area 150 and a verification area 160. These areas exchange data through a specific connection method, wherein the verification area 160 is connected to the business area 110, the quantum encryption area 120 and the communication area 150 as a hub to ensure the security and isolation of data transmission. The quantum encryption area 120 is connected to the quantum key generation area 130 and the quantum key area 140 to support the generation, management and distribution of keys.

[0050] The following is an introduction to each area:

[0051] A. Business area 110.

[0052] The service area 110 is a user service system area in the encryption device 100, which is mainly responsible for providing user service functions, managing and storing service data. The service area 110 can be various communication system devices, such as remote control devices, Internet of Things devices, robots, industrial machines, drones, etc.

[0053] B. Quantum key generation area 130.

[0054] The quantum key generation area 130 is a functional module designed based on the principles of quantum mechanics. Its core task is to generate true random numbers, which will serve as the basis for generating keys. Due to the uncertainty principle of quantum mechanics, the generated random numbers have extremely high randomness and unpredictability, thereby ensuring the security of the generated keys.

[0055] C. Quantum key area 140.

[0056] The quantum key area 140 is responsible for storing and managing all quantum keys required by the encryption device 100. The quantum key includes the generated key obtained through the quantum key generation area 130. Of course, the quantum key may also include other keys that may be obtained through other means. For example, before the encryption device 100 is enabled, the pairing key pre-configured in the quantum key area 140 is used for encrypted communication between the encryption device 100 and the access base station; for another example, after the encryption device 100 is enabled, the key center distributes a supplementary key for supplementing the pairing key. The quantum key area 140 has a high degree of security and confidentiality, and can ensure the security of the key during storage and transmission.

[0057] D. Verification area 160.

[0058] The verification area 160 is a key connection area in the encryption device 100, which is responsible for isolating different areas connected to the verification area 160 (such as the business area 110, the quantum encryption area 120 and the communication area 150) and realizing data transfer between these areas.

[0059] In one example, the verification area 160 can also perform security verification on the transmitted data, thereby ensuring the integrity and security of the data during the transmission process through strict verification mechanisms and access control.

[0060] For example, the verification area 160 can perform detailed format verification on the business data transmitted from the business area 110 to the quantum encryption area 120. For the business data of serial communication, it will frame the data packet according to the serial communication protocol, check the frame header, frame tail and check bit, and ensure the integrity and correctness of the data packet; and for the business data of Ethernet communication, the verification area 160 will check the MAC address, IP address, port number and data payload one by one according to the Ethernet frame format, and eliminate any data packets that do not meet the standards or have abnormalities. Through such a frame processing and format verification mechanism, the risk of data leakage or system crash caused by incorrect or damaged data format can be effectively avoided.

[0061] For another example, when data flows from the communication area 150 to the quantum encryption area 120, the verification area 160 not only needs to perform a format check of the data for quantum secure encryption communication to ensure that the data has been pre-processed according to the standards of quantum encryption communication, but also conducts an in-depth protocol check to verify whether the data complies with the pre-configured quantum secure communication protocol. By comparing every detail of the protocol standard with the actual data packet, the verification area 160 can accurately identify and filter out any illegal data that attempts to bypass the security mechanism, effectively preventing potential security threats.

[0062] In addition, the verification area 160 also has powerful data conversion and protocol adaptation capabilities. It can perform necessary format conversion or protocol upgrades on the verified data according to the needs of the data destination, ensuring that the data can be seamlessly connected to the processing system of the quantum encryption area 120, realizing cross-regional data interoperability and efficient processing.

[0063] In addition, the verification area 160 also undertakes rule-based labeling and filtering tasks. Through in-depth analysis of the data content, combined with preset business rules and security policies, the verification area 160 can label each piece of data with corresponding security labels (such as sensitivity level, encryption requirements, etc.) and perform corresponding filtering operations based on these labels. For data that does not comply with security policies or business rules, the verification area 160 will directly refuse to allow it to enter the quantum encryption area 120, thereby blocking potential security risks at the forefront and ensuring the security and stability of the entire encrypted communication link.

[0064] E. Communication area 150.

[0065] The communication area 150 is an area responsible for completing external network communications. Through the communication area 150, data interaction between the encryption device 100 and other quantum security devices can be realized. For example, the encryption device 100 communicates with the access base station, and after the encryption device 100 distributes the self-generated generation key to the quantum security encryption device at the opposite end, the encryption device 100 communicates with the quantum security encryption device at the opposite end. The communication area 150 has powerful data transmission and processing capabilities and can support high-speed and stable quantum security communications. Among them, the communication area 150 can adopt various communication methods, such as Ethernet communication, serial communication, infrared communication, shortwave communication, etc.

[0066] F. Quantum encryption area 120.

[0067] The quantum encryption area 120 is the core encryption function area in the encryption device 100. It is responsible for initiating the self-distribution process of generating keys and providing quantum encryption and decryption services when conducting quantum secure communication with the peer quantum secure encryption device.

[0068] The working mechanism of the self-distribution process is as follows:

[0069] The quantum encryption area 120 determines the generated key index according to the generated key stored in the quantum key area 140. For example, by performing a hash calculation on the generated key, the determined hash value is determined as the generated hash index.

[0070] Then the quantum encryption area 120 constructs a self-distribution request. The self-distribution request carries the generated key index. The self-distribution request is passed to the communication area 150 through the verification area 160. For example, the verification area 160 performs a security check on the self-distribution request. After determining that the self-distribution request passes the security check, the verification area 160 passes the self-distribution request to the communication area 150.

[0071] After receiving the self-distribution request, the communication area 150 can relay the self-distribution request to the quantum security encryption device at the other end through the global quantum security network. In this process, the communication area 150 can first send the self-distribution request to the access base station (referred to as the first access base station) to which the encryption device 100 accesses, and the first access base station queries and determines the route based on the network access identifier of the quantum security encryption device at the other end carried in the self-distribution request, and then relays the self-distribution request to the access base station (referred to as the second access base station) to which the quantum security encryption device at the other end accesses. Among them, the first access base station and the second access base station may be the same access base station or different access base stations. The second access base station sends the self-distribution request to the quantum security encryption device at the other end.

[0072] In a possible implementation, the quantum encryption area 120 of the encryption device 100 can encrypt the self-distribution request based on the pairing key symmetric with the first access base station stored in the quantum key area 140 to ensure the security of the self-distribution request during transmission. Then, the encrypted self-distribution request is transmitted to the communication area 150 through the verification area 160, and then the communication area 150 sends the encrypted self-distribution request to the first access base station. After receiving the encrypted self-distribution request, the first access base station can decrypt the encrypted self-distribution request based on the same pairing key to obtain a plaintext self-distribution request and relay the self-distribution request.

[0073] Based on the above embodiment, the peer quantum security encryption device can receive the self-distribution request relayed by the encryption device 100. If the peer quantum security encryption device agrees to the self-distribution request, that is, agrees to directly perform quantum security communication with the encryption device 100 based on the generated key self-generated by the encryption device 100, then a self-distribution response containing the same generated key index can be generated based on the generated key index carried in the self-distribution request to request the encryption device 100 to distribute the generated key corresponding to the generated key index to the peer quantum security encryption device. Then, the self-distribution response is reversely relayed to the encryption device 100 through the global quantum security network.

[0074] In a possible implementation, the quantum secure encryption communication between the peer quantum secure encryption device and the second access base station is based on the symmetric pairing key between the communicating parties. For details, reference may be made to the process of encrypting and transmitting the self-distribution request between the encryption device 100 and the first access base station based on the pairing key between the communicating parties, which will not be described in detail here.

[0075] The communication area 150 of the encryption device 100 can obtain the self-distributed response of the peer quantum security encryption device through the global quantum security network relay through the first access base station. Then, the self-distributed response is transmitted to the quantum encryption area 120 through the verification area 160. For example, the verification area 160 performs a security check on the self-distributed response, and after determining that the self-distributed response passes the security check, the verification area 160 transmits the self-distributed response to the quantum encryption area 120.

[0076] In a possible implementation, the first access base station may encrypt the received self-distributed response based on a paired key symmetric with the encryption device 100. Then the encrypted self-distributed response is sent to the communication area 150 of the encryption device 100. After receiving the encrypted self-distributed response, the communication area 150 of the encryption device 100 may pass the encrypted self-distributed response to the quantum encryption area 120 through the verification area 160. The quantum encryption area 120 decrypts the received encrypted self-distributed response based on the symmetric key paired with the first access base station stored in the quantum key area 140 to obtain a self-distributed response in plain text.

[0077] When the quantum encryption zone 120 obtains the self-distribution response, it can obtain the corresponding generated key from the quantum key zone 140 based on the generated key index carried in the self-distribution response. Then, the generated key is transmitted to the communication zone 150 through the verification zone 160, so that the communication zone 150 relays the generated key to the peer quantum security encryption device through the global quantum security network.

[0078] It should be noted that the process in which the communication area 150 relays the generated key to the quantum security encryption device at the other end through the global quantum security network is similar to the process in which the communication area 150 relays the self-distribution request to the quantum security encryption device at the other end through the global quantum security network, and will not be described in detail here.

[0079] Once the encryption device 100 successfully shares the generated key through the self-distribution process based on the above embodiment and the peer quantum secure encryption device, they can directly perform quantum secure communication based on the generated key without the need for key relay via an access base station in the global quantum secure network.

[0080] In one example, the quantum encryption area 120 is specifically used to obtain the first business data to be sent to the peer quantum security encryption device by the business area 110 through the verification area 160; obtain the encryption key based on the generated key stored in the quantum key area 140; perform quantum encryption on the first business data based on the encryption key to obtain the encrypted first business data; send the encrypted first business data to the communication area 150 through the verification area 160, so that the communication area 150 directly sends the encrypted first business data to the peer quantum security encryption device;

[0081] The quantum encryption area 120 is specifically used to receive the encrypted second business data from the communication area 150 through the verification area 160; wherein the encrypted second business data is directly sent to the communication area 150 by the peer quantum security encryption device; based on the generated key stored in the quantum key area 140, a decryption key is obtained; based on the decryption key, the encrypted second business data is quantum decrypted to obtain the second business data; and the second business data is sent to the business area 110 through the verification area 160.

[0082] When the encryption device 100 performs quantum secure communication with the peer quantum secure encryption device, the quantum encryption zone 120 plays a core role. The following is an explanation of two key communication scenarios:

[0083] Scenario 1: Sending scenario.

[0084] When the business area 110 of the encryption device 100 has business data (referred to as first business data) to be sent to the quantum secure encryption device of the other end, the business area 110 can send the first business data to the quantum encryption area 120 through the verification area 160. When the quantum encryption area 120 receives the first business data, it can obtain the encryption key based on the generated key stored in the quantum key area 140. Then, based on the encryption key, the first business data is quantum encrypted to obtain the encrypted first business data. Then, through the verification area 160, the encrypted first business data is sent to the communication area 150, so that the communication area 150 directly sends the encrypted first business data to the quantum secure encryption device of the other end.

[0085] Once the peer quantum secure encryption device receives the encrypted first business data, it can distribute the generated key obtained based on the above embodiment, and perform quantum decryption on the encrypted first business data to obtain the plaintext first business data.

[0086] Scenario 2: Receiving scenario.

[0087] When the peer quantum security encryption device has business data (referred to as second business data) to be sent to the encryption device 100, the peer quantum security encryption device can distribute and obtain the generated key based on the above embodiment, and perform quantum encryption on the second business data to obtain the encrypted second business data. Then, the encrypted second business data is directly sent to the encryption device 100.

[0088] Once the communication area 150 of the encryption device 100 receives the encrypted second business data, it can pass the second business data to the quantum encryption area 120 through the verification area 160. The quantum encryption area 120 can decrypt the received encrypted second business data based on the generated key stored in the quantum key area 140 to obtain the second business data in plain text. Then, the second business data is passed to the business area 110 of the encryption device 100 through the verification area 160.

[0089] The beneficial effects of this application are as follows:

[0090] 1. Since the quantum encryption area 120 of the encryption device 100 can initiate a self-distribution process, the generated key generated by the quantum key generation area 130 of the encryption device 100 is distributed to the peer quantum security encryption device, so that after the encryption device 100 successfully shares the generated key with the peer quantum security encryption device, it can directly perform quantum secure communication based on the generated key without relying on key relay.

[0091] 2. The quantum key area 140 of the encryption device 100 can be used to uniformly manage and store the quantum key of the encryption device 100, thereby ensuring the security of the quantum key.

[0092] 3. The verification area 160 is used to isolate the business area 110, the quantum encryption area 120 and the communication area 150, respectively, thereby preventing direct communication and data exchange between these areas. This isolation design effectively avoids the potential impact of external network data on the business area 110 and the quantum encryption area 120, and improves the security of the entire device. In particular, the separate isolation of the quantum encryption area 120 is a strong guarantee for the security of the quantum key. Through isolation, the risk of illegal access or tampering of the quantum key can be further reduced, ensuring the smooth progress and security of quantum communication.

[0093] Embodiment 2:

[0094] In this application, if the encryption device 100 wants to communicate with the peer quantum security encryption device, the prerequisite is that both have successfully accessed the global quantum security network. Therefore, after the encryption device 100 is powered on, it will automatically send an access request to the access base station in the global quantum security network to request access to the global quantum security network and obtain the authority to conduct quantum secure communication with the devices in the global quantum security network. Only when it is determined that the global quantum security network has been successfully accessed, the subsequent self-distribution process will be carried out.

[0095] In one example, in order to achieve secure access, the quantum encryption zone 120 in the encryption device 100 is not only responsible for initiating the self-distribution process of generating keys to support quantum secure communication, but also has the function of actively initiating access to the access base station in the global quantum secure network. Exemplarily, the quantum encryption zone 120 initiates an access request to the access base station by using the pairing key symmetrical to the access base station stored in the quantum key zone 140. Among them, before the encryption device 100 is enabled, the encryption device 100 has formed a symmetric pairing key with the access base station in a preset manner. The pairing key is used to encrypt the access request when the quantum encryption zone 120 initiates the access request to ensure the security of the access request during transmission. At the same time, the access base station also uses this pairing key to decrypt the received access request and perform subsequent authentication and verification operations. Once the quantum encryption zone 120 can obtain the access success response sent by the access base station, it is determined that the encryption device 100 has successfully accessed the global quantum secure network.

[0096] Specifically, when access to the global quantum security network is required, the quantum encryption area 120 will perform quantum encryption on a constructed access request based on the pairing key stored in the quantum key area 140 to ensure that it is not intercepted or tampered with by an unauthorized third party during the transmission process. The access request contains the identification information of the access base station that the quantum encryption area 120 wishes to access, and the parameter information of the encryption key used for authentication or authorization.

[0097] The quantum encryption section 120 sends the encrypted access request to the communication section 150 of the encryption device 100 through the verification section 160 of the encryption device 100. The communication section 150 sends the encrypted access request to the access base station.

[0098] After receiving the encrypted access request sent by the encryption device 100, the access base station decrypts it using the same pairing key as the encryption device 100. After decryption, the access base station authenticates and verifies the parameter information in the access request.

[0099] It should be noted that the specific process of the access base station authenticating and verifying the parameter information in the access request can refer to the process of the existing access base station authenticating and verifying the global quantum security terminal, and will not be described in detail here.

[0100] If the encryption device 100 passes the authentication of the access base station, the access base station will generate an access success response. Among them, the access success response contains the unique identity of the encryption device 100 in the global quantum security network (recorded as the network access identity), which is the necessary credential for the encryption device 100 to communicate and operate in the global quantum security network. Then, based on the pairing key symmetric with the encryption device 100, the access success response is encrypted and sent to the encryption device 100.

[0101] After receiving the encryption access success response, the communication area 150 of the encryption device 100 will transmit the encryption access success response to the quantum encryption area 120 through the verification area 160.

[0102] The quantum encryption area 120 receives the encrypted access success response, obtains the stored pairing key from the quantum key area 140, and decrypts the encrypted access success response based on the same pairing key to obtain the access success response. After the quantum encryption area 120 receives the access success response carrying the network access identifier, it indicates that the encryption device 100 has successfully accessed the global quantum security network.

[0103] At this time, the encryption device 100 can use its network access ID to conduct key relay communication with the peer quantum encryption device 100 in the global quantum security network, and initiate a self-distribution process.

[0104] Embodiment 3:

[0105] In the process of quantum secure communication between the encryption device 100 and the peer quantum secure encryption device, the generated key distributed by the encryption device 100 for the first time will be continuously consumed. However, the generated key distributed for the first time is limited, and these generated keys will gradually be exhausted as the communication proceeds. Based on this, in order to ensure the stability and continuity of direct quantum secure communication between the encryption device 100 and the peer quantum secure encryption device, on the basis of the above embodiments, in this application, the encryption device 100 needs to supplement the generated key to the peer quantum secure encryption device in a timely manner, so that the communicating parties can continue quantum secure communication based on the supplemented generated key in a timely manner. In order to ensure the security of the subsequent distribution of the supplemented generated key to the peer quantum secure encryption device, the encryption device 100 can divide the generated key generated for the first time into an encryption key and a distribution key according to the key ratio corresponding to the generated key. Among them, the key ratio corresponding to the generated key represents the ratio between the encryption key and the distribution key in the generated key. The encryption key in the generated key is used for the encryption device 100 to encrypt the supplemented generated key when it distributes the supplemented generated key to the peer quantum secure encryption device next time. The distribution key is used to perform quantum encryption and decryption on the transmitted business data during quantum secure communication with the peer quantum security encryption device. Based on this, in the above embodiment, the encryption device 100 also carries the key ratio in the self-distribution request sent to the peer quantum security encryption device, so that after the peer quantum security encryption device obtains the generated key distributed by the encryption device 100, it determines which keys are encryption keys and which keys are distribution keys from the generated key according to the key ratio. The encryption device 100 and the peer quantum security encryption device can perform quantum encryption and decryption on the transmitted business data based on the distribution key, and the encryption device 100 can encrypt and supplement the generated key to the peer quantum security encryption device based on the encryption key.

[0106] It should be noted that the key ratio corresponding to the generated key can be pre-configured in the encryption device 100, or it can be dynamically determined based on the key amount of the distribution key currently required and the key amount required to encrypt the distribution key according to the pre-configured encryption ratio. No specific limitation is made here.

[0107] In one example, the key supplement process of the encryption device 100 can be initiated by the quantum encryption area 120 of the encryption device 100. Exemplarily, the quantum encryption area 120 is also used to monitor the remaining key amount of the generated key in the quantum key area 140; when it is determined that the generated key is insufficient based on the remaining key amount, the quantum key generation area 130 is called to generate a supplementary generated key and the supplementary generated key is saved to the quantum key area 140; based on the supplementary generated key stored in the quantum key area 140, a supplementary key index is determined; based on the encryption key stored in the quantum key area 140, the generated self-distributed supplement request is quantum encrypted; wherein the self-distributed supplementary request carries the supplementary key index and the key ratio corresponding to the supplementary generated key; through the verification area 160, the encrypted self-distributed supplementary request is transmitted to the communication area 150, so that the communication area 150 directly sends the encrypted self-distributed supplementary request to the peer quantum security encryption device; and, through The method comprises: obtaining an encrypted self-distributed supplementary response from the communication area 150 through the verification area 160; wherein the encrypted self-distributed supplementary response is directly sent to the communication area 150 by the peer quantum security encryption device; decrypting the encrypted self-distributed supplementary response based on the encryption key; obtaining the supplementary generation key from the quantum key area 140 based on the supplementary key index carried in the decrypted self-distributed supplementary response; quantum encrypting the supplementary generation key based on the encryption key to obtain the encrypted supplementary key; transmitting the encrypted supplementary key to the communication area 150 through the verification area 160, so that the communication area 150 directly sends the encrypted supplementary key to the peer quantum security encryption device, and the peer quantum security encryption device quantum encrypts the encrypted supplementary key based on the encryption key to obtain the supplementary generation key.

[0108] The following is an introduction to the process of the encryption device 100 supplementing the generation of a key for the peer quantum security encryption device:

[0109] During the process of quantum secure communication between the encryption device 100 and the peer quantum secure encryption device, the quantum encryption area 120 of the encryption device 100 monitors the remaining key amount of the generated key in the quantum key area 140. The quantum encryption area 120 can determine whether to initiate a key supplement process based on the remaining key amount. For example, the quantum encryption area 120 can monitor whether the remaining key amount of the generated key is lower than a preset key supplement threshold. If it is determined that the remaining key amount of the currently generated key is lower than the preset key supplement threshold, it is determined that the generated key is insufficient and needs to be supplemented.

[0110] The key replenishment threshold is determined based on multiple factors such as communication requirements, key usage rate, and key generation rate, and is not specifically limited here. For example, if you want to replenish the generated keys in a timely manner to avoid communication disconnection due to insufficient distribution of keys, you can set the key replenishment threshold to a larger value; if you want to avoid replenishing the generated keys too frequently, you can set the key replenishment threshold to a smaller value.

[0111] Once the quantum encryption zone 120 determines that the generated key is insufficient based on the remaining key amount of the generated key in the quantum key zone 140, the quantum encryption zone 120 can call the quantum key generation zone 130 of the encryption device 100 to enable the quantum key generation zone 130 to generate a supplementary generated key. The quantum encryption zone 120 will save the supplementary generated key in the quantum key zone 140 for subsequent use. At the same time, the quantum encryption zone 120 will also determine the corresponding supplementary key index based on the supplementary generated key so that these supplementary generated keys can be accurately referenced and identified in subsequent communications. For example, the quantum encryption zone 120 performs a hash calculation on the supplementary generated key and uses the determined hash value as the supplementary key index.

[0112] When the quantum encryption zone 120 obtains the supplementary key index, it generates a self-distribution supplement request. The self-distribution request carries the supplementary key index and the key ratio corresponding to the supplementary generated key. The key ratio corresponding to the supplementary generated key represents the ratio between the supplementary encryption key and the supplementary distribution key in the supplementary generated key.

[0113] Among them, the key ratio corresponding to the supplementary generated key can be pre-configured to the encryption device 100, or it can be dynamically determined based on the key amount of the distribution key required each time and the key amount required to encrypt the distribution key according to the pre-configured encryption ratio, and no specific limitation is made here.

[0114] Then, the quantum encryption area 120 performs quantum encryption on the self-distributed supplementary request based on the encryption key stored in the quantum key area 140 to obtain an encrypted self-distributed supplementary request. The encrypted self-distributed supplementary request will be sent directly to the peer quantum security encryption device by the communication area 150 through the verification area 160.

[0115] After receiving the encrypted self-distributed supplementary request, the peer quantum security encryption device can perform quantum decryption on the encrypted self-distributed supplementary request based on the same encryption key to obtain the self-distributed supplementary request in plain text. If it is determined that the encryption device 100 agrees to supplement the key generation, a self-distributed supplementary response is generated. The self-distributed supplementary response carries a supplementary key index. Then, based on the pre-distributed encryption key, the self-distributed supplementary response is encrypted to obtain an encrypted self-distributed supplementary response and the encrypted self-distributed supplementary response is directly sent to the communication area 150 of the encryption device 100.

[0116] At the same time, the encryption device 100 is also waiting for the self-distributed supplementary response from the peer quantum security encryption device. When the communication area 150 of the encryption device 100 receives the encrypted self-distributed supplementary response, it will pass it to the quantum encryption area 120 through the verification area 160. The quantum encryption area 120 again obtains the decryption key based on the encryption key stored in the quantum key area 140. Then, based on the decryption key, the encrypted self-distributed supplementary response is quantum decrypted to obtain the self-distributed supplementary request sent by the peer quantum security encryption device.

[0117] The quantum encryption area 120 obtains the supplementary generation key from the quantum key area 140 based on the supplementary key index carried in the decrypted self-distributed supplementary response. Then, the quantum encryption area 120 uses the encryption key stored in the quantum key area 140 to quantum encrypt these supplementary generation keys to obtain the encrypted supplementary key.

[0118] In a possible implementation, the encryption header of the encrypted supplementary key carries an offset indication of the encryption key, and the offset indication is used to prompt the peer quantum secure encryption device to locate the offset position of the locally stored encryption key.

[0119] The encrypted supplementary key obtained based on the above embodiment will be transmitted to the communication area 150 through the verification area 160, and will be directly sent by the communication area 150 to the quantum security encryption device at the other end.

[0120] After receiving these encrypted supplementary keys, the peer quantum secure encryption device will use the same encryption key to decrypt them, thereby obtaining the supplementary generation key distributed by the encryption device 100.

[0121] In a possible implementation, in order to quickly supplement a large number of distribution keys and reduce the encryption keys consumed in the key generation supplement process, in the present application, the quantum encryption area 120 of the encryption device 100 can use a preset expansion ratio to expand the encryption key, so as to perform quantum encryption on the supplemented generation key based on the expanded encryption key, thereby quickly supplementing a large number of distribution keys while consuming fewer encryption keys. Among them, the preset expansion ratio represents the length of data that can be encrypted by each 1-bit encryption key. The setting of this ratio can be adjusted according to actual needs to achieve optimal encryption efficiency and security. For example, if the expansion ratio is 10, then a 1-bit true random number will be expanded into a 10-bit key fragment.

[0122] In order to ensure that the peer quantum security encryption device can promptly understand the expansion requirements of the encryption key and make corresponding adjustments accordingly, the quantum encryption area 120 of the encryption device 100 specifically includes this preset expansion ratio in the constructed self-distributed supplementary request. In this way, when the peer quantum security encryption device receives the request, it can directly obtain the preset expansion ratio. Further, when the peer quantum security encryption device receives the encrypted supplementary key from the encryption device 100 according to the above embodiment, it can expand the encryption key stored by itself according to the received preset expansion ratio. Subsequently, the received encrypted supplementary key is quantum decrypted using these expanded encryption keys to obtain the supplementary generated key of the plaintext.

[0123] Based on the above embodiment, after the encryption device 100 successfully supplements the generated key to the peer quantum secure encryption device, the communicating parties can supplement their locally stored generated keys based on the supplemented generated keys. This includes supplementing the locally stored distribution keys and supplementing the locally stored encryption keys. Both communicating parties have more key resources available for subsequent quantum secure communications.

[0124] Embodiment 4:

[0125] The specific self-distributed global quantum security encryption device provided by this application is described below through specific embodiments. Figure 2 A schematic diagram of the workflow of a specific self-distributed global quantum security encryption device provided in an embodiment of the present application, the process mainly includes an access phase, a self-distribution phase, a communication phase, and a key supplement phase. Taking the self-distributed global quantum security encryption device as encryption device A and the peer quantum security encryption device as device B as an example, for each phase, the process includes:

[0126] Phase 1: Access phase.

[0127] Figure 3A schematic diagram of the workflow of a specific self-distributed global quantum secure encryption device during the access phase provided in an embodiment of the present application.

[0128] S301: Device A sends an encrypted access request to the first access base station in the global quantum security network based on a pairing key that is symmetric with the first access base station.

[0129] Before being activated, the device A has formed a symmetric pairing key with the first access base station in a preset manner.

[0130] S302: The first access base station uses the same pairing key to perform quantum decryption on the received encrypted access request.

[0131] S303: The first access base station performs access authentication on the device A based on the access request to determine whether the device A is a legitimate device and whether a global quantum security service can be provided for the device A.

[0132] S304: When the first access base station passes the access authentication of device A, the first access base station sends an access response to device A in an encrypted manner based on the pairing key symmetric with device A.

[0133] Among them, the access response carries the quantum security network identity assigned by the first access base station to device A, namely, the network access identifier A.

[0134] S305: Device A decrypts the received encrypted access response based on the pairing key symmetric with the first access base station to obtain a plaintext access response, determines that it has successfully accessed the global quantum secure network, and saves the network access identifier A.

[0135] Based on the above embodiment, after device A successfully accesses the global quantum security network and has its own quantum security network identity, it can perform quantum secure communication with other devices connected to the global quantum security network.

[0136] Phase 2: Self-distribution phase.

[0137] Figure 4 A schematic diagram of the workflow of a specific self-distributed global quantum secure encryption device in the self-distribution stage provided in an embodiment of the present application.

[0138] S401: The quantum encryption area of ​​device A calls its own quantum key generation module to generate a quantum true random number as a generated key, and stores it in the quantum key area;

[0139] S402: The quantum encryption zone performs a hash calculation on the generated key to obtain a hash value H, and uses the hash value as the generated key index.

[0140] S403: The quantum secure encryption zone initiates a self-distribution request, and based on the pairing key stored in the quantum key zone and symmetric with the first access base station, performs quantum encryption on the self-distribution request to obtain an encrypted self-distribution request.

[0141] Among them, the self-distribution request carries the network access identifier B of device B, the network access identifier A of device A, the generated key index, and the key ratio corresponding to the generated key. The key ratio corresponding to the generated key represents the ratio of the encryption key to the distribution key in the generated key. The distribution key is used to perform quantum encryption and decryption on the transmitted business data when performing quantum secure communication with device B. The encryption key is used to encrypt the supplementary generated key when distributing the supplementary generated key directly to device B next time.

[0142] S404: The quantum secure encryption zone sends the encrypted self-distribution request to the verification zone of device A.

[0143] S405: The verification area sends the encrypted self-distribution request to the communication area of ​​device A.

[0144] S406: The communication area sends the encrypted self-distribution request to the first access base station.

[0145] S407: The first access base station performs quantum decryption on the received encrypted self-distribution request based on a pairing key symmetric with the device A to obtain a plaintext self-distribution request.

[0146] S408: The first access base station queries and determines a route according to the network access identifier B of the device B carried in the self-distribution request, and relays the self-distribution request to the second access base station to which the device B accesses.

[0147] The first access base station and the second access base station may be the same access base station, or may be different access base stations.

[0148] S409: The second access base station receives the self-distribution request from device A, and uses a pairing key symmetric with device B to quantum encrypt the self-distribution request.

[0149] S410: The second access base station queries the link of device B according to the network access identifier B carried in the self-distribution request, and sends the encrypted self-distribution request obtained in S409 to device B.

[0150] S411: Device B performs quantum decryption on the received encrypted self-distribution request based on the pairing key symmetric with the second access base station to obtain a plaintext self-distribution request.

[0151] S412: If device B is willing to accept the self-distribution request of device A, it generates a self-distribution response message.

[0152] The self-distribution response message carries a generated key index, a network access identifier A and a network access identifier B.

[0153] S413: Device B uses a pairing key symmetric with the second access base station to encrypt and send a self-distribution response message to the second access base station.

[0154] S414: The second access base station performs quantum decryption on the received encrypted self-distributed response based on the pairing key symmetric with the device B to obtain a plaintext self-distributed response.

[0155] S415: The second access base station queries and determines a route according to the network access identifier A of the device A carried in the self-distribution response, and relays the self-distribution response to the first access base station.

[0156] S416: The first access base station receives the self-distributed response from device B, and uses a pairing key symmetric with device A to quantum encrypt the self-distributed response.

[0157] S417: The first access base station queries the link of device A according to the network access identifier A carried in the self-distribution response, and sends the encrypted self-distribution response obtained in S416 to device A.

[0158] S418: After receiving the encrypted self-distributed response, the communication area of ​​device A transmits the encrypted self-distributed response to the verification area of ​​device A.

[0159] S419: The verification area transmits the encrypted self-distributed response to the quantum encryption area.

[0160] S420: The quantum encryption area decrypts the encrypted self-distributed response based on the pairing key symmetric with the first access base station stored in the quantum key area to obtain a plaintext self-distributed response.

[0161] S421: The quantum encryption zone uses the generated key index carried in the self-distribution response to retrieve the stored generated key from the quantum key zone.

[0162] S422: The quantum secure encryption area performs quantum encryption on the generated key based on the pairing key symmetric with the first access base station stored in the quantum key area to obtain an encrypted generated key.

[0163] S423: The quantum secure encryption zone sends the encrypted generated key to the verification zone of device A.

[0164] S424: The verification area sends the encrypted generated key to the communication area of ​​device A.

[0165] S425: The communication area sends the encrypted generated key to the first access base station.

[0166] S426: The first access base station performs quantum decryption on the received encrypted generation key based on the pairing key that is symmetric with the device A to obtain a plaintext generation key.

[0167] S427: The first access base station relays the generated key to the second access base station to which device B accesses.

[0168] S428: The second access base station receives the generated key of device A, and uses a pairing key symmetric with device B to perform quantum encryption on the generated key.

[0169] S429: The second access base station sends the encrypted generated key obtained in S428 to device B.

[0170] S430: Device B performs quantum decryption on the received encrypted generation key based on the pairing key symmetric with the second access base station to obtain a plaintext generation key.

[0171] Once device A successfully shares the generated key with device B through the self-distribution process based on the above embodiment, they can directly perform quantum secure communication based on the generated key without the need for key relay via an access base station in the global quantum secure network.

[0172] Phase three: communication phase.

[0173] Figure 5 A schematic diagram of the workflow of sending business data during the communication phase of a specific self-distributed global quantum secure encryption device provided in an embodiment of the present application.

[0174] S501: The service area of ​​device A sends first service data to be sent to device B to the verification area of ​​device A.

[0175] S502: The verification area transmits the first business data to the quantum encryption area of ​​the device A.

[0176] S503: The quantum encryption area performs quantum encryption on the first business data based on the generated key stored in the quantum key area to obtain encrypted first business data.

[0177] S504: The quantum encryption area transmits the encrypted first business data to the verification area.

[0178] S505: The verification area transmits the encrypted first service data to the communication area of ​​device A.

[0179] S506: The communication area sends the encrypted first service data directly to device B.

[0180] S507: Device B may decrypt the received encrypted first service data based on the generated key distributed by device A to obtain the first service data.

[0181] Figure 6 A schematic diagram of the workflow of a specific self-distributed global quantum secure encryption device receiving business data during the communication phase provided in an embodiment of the present application.

[0182] S601: Device B performs quantum encryption on the second business data to be sent to device A based on the generated key distributed by device A to obtain the quantum encrypted second business data.

[0183] S602: Device B sends the encrypted second service data directly to device A.

[0184] S603: The communication area of ​​device A transmits the received encrypted second service data to the verification area of ​​device A.

[0185] S604: The verification area transmits the encrypted second business data to the quantum encryption area of ​​device A.

[0186] S605: The quantum encryption area performs quantum decryption on the encrypted second business data based on the generated key stored in the quantum key area to obtain the second business data in plain text.

[0187] S606: The quantum encryption area sends the second business data to the verification area.

[0188] S607: The verification area transmits the second service data to the service area.

[0189] Phase 4: Key supplement phase.

[0190] Figure 7 A schematic diagram of the workflow of sending business data during the communication phase of a specific self-distributed global quantum secure encryption device provided in an embodiment of the present application.

[0191] S701: The quantum encryption area of ​​device A monitors the remaining key amount of the generated key stored in the quantum key area. When it is determined that the generated key is insufficient based on the remaining key amount, the quantum key generation area of ​​device A is called to generate a supplementary generated key, and the supplementary generated key is saved in the quantum key area of ​​device A.

[0192] S702: The quantum encryption zone determines a supplementary key index based on the supplementary generated key stored in the quantum key zone.

[0193] S703: The quantum encryption area generates a self-distributed supplementary request, and based on the encryption key stored in the quantum key area, quantum encrypts the self-distributed supplementary request to obtain an encrypted self-distributed supplementary request.

[0194] The self-distributed supplementary request carries a supplementary key index, a key ratio corresponding to the supplementary generated key, and an expansion ratio.

[0195] S704: The quantum encryption area sends the encrypted self-distribution supplementary request to the verification area of ​​device A.

[0196] S705: The verification area sends the encrypted self-distribution supplementary request to the communication area of ​​the device A.

[0197] S706: The communication area sends the encrypted self-distribution supplement request directly to device B.

[0198] S707: Device B performs quantum decryption on the received encrypted self-distributed supplementary request based on the encryption key symmetric with device A to obtain the key ratio, expansion ratio and supplementary key index carried in the plaintext self-distributed supplementary response.

[0199] S708: Device B encrypts the generated self-distributed supplemental response and sends it to device A based on the encryption key symmetric with device A.

[0200] The self-distributed supplementary response carries a supplementary key index.

[0201] S709: The communication area of ​​device A transfers the received encrypted self-distribution supplemental response to the verification area.

[0202] S710: The verification area transmits the encrypted self-distributed supplementary response to the quantum encryption area.

[0203] S711: The quantum encryption area decrypts the encrypted self-distributed supplementary response based on the encryption key stored in the quantum key area to obtain a plaintext self-distributed supplementary response.

[0204] S712: The quantum encryption zone retrieves the supplementary generated key corresponding to the supplementary key index from the quantum key zone based on the supplementary key index carried in the self-distributed supplementary response.

[0205] S713: The quantum encryption area expands the encryption key stored in the quantum key area based on a preset expansion ratio to obtain an expanded encryption key, and based on the expanded encryption key, quantum encrypts the supplementary generated key to obtain an encrypted supplementary key.

[0206] S714: The quantum encryption zone transmits the encrypted supplementary key to the verification zone.

[0207] S715: The verification area transmits the encrypted supplementary key to the communication area.

[0208] S716: The communication area distributes the encrypted supplementary key directly to device B.

[0209] S717: Device B encrypts the encryption key based on the acquired preset expansion ratio to obtain an expanded encryption key, and based on the expanded encryption key, performs quantum decryption on the received encrypted supplementary key to obtain a supplementary generated key.

[0210] It should be noted that Figures 3 to 7 The quantum key generation area and quantum key area of ​​device A are omitted in the figure, and the functions performed by the quantum key generation area and quantum key area are reflected in the steps performed in the quantum encryption area.

[0211] Embodiment 5:

[0212] Based on the same inventive concept, this application also provides a self-distributed global quantum secure encryption communication system. Figure 8 A structure diagram of a self-distributed global quantum secure encryption communication system provided in the present application, the system comprising a self-distributed global quantum secure encryption device 81 connected to a global quantum secure network and a peer quantum secure encryption device 82 connected to the global quantum secure network for executing any one of the above embodiments 1-4;

[0213] The peer quantum security encryption device 82 is used to receive a self-distribution request relayed by the self-distributed global quantum security encryption device through a global quantum security network; generate a self-distribution response based on a generated key index carried in the self-distribution request; send the self-distribution response to the self-distributed global quantum security encryption device through the global quantum security network; receive a generated key relayed by the self-distributed global quantum security encryption device through the global quantum security network; save the generated key, so as to perform quantum secure communication with the self-distributed global quantum security encryption device based on the generated key.

[0214] It should be noted that the principle of solving the problem in the self-distributed global quantum secure encryption communication system is the same as the principle of solving the technical problem in the above-mentioned encryption device embodiment, and the repeated parts will not be repeated.

Claims

1. A self-distributed global quantum security encryption device, characterized in that: The device comprises: a business area, a quantum encryption area, a quantum key generation area, a quantum key area, a communication area and a verification area; wherein the verification area is respectively connected to the business area, the quantum encryption area and the communication area, and the quantum encryption area is respectively connected to the quantum key generation area and the quantum key area; The service area is used to provide user service functions and manage and store service data; The quantum key generation area is used to generate true random numbers based on the principles of quantum mechanics as a generated key; The quantum key area is used to store and manage quantum keys; wherein the quantum keys include the generated keys; The verification area is used to isolate different areas connected to the verification area and to implement data transfer between the different areas; The communication area is used to complete external network communication; The quantum encryption zone is used to initiate the self-distribution process of the generated key, and to provide quantum encryption and decryption services based on the generated key when performing quantum secure communication with the peer quantum secure encryption device; The self-distribution process includes: Based on the generated key stored in the quantum key area, determine the generated key index; pass the generated self-distribution request to the communication area through the verification area, so that the communication area relays the self-distribution request to the quantum security encryption device at the other end through the global quantum security network; wherein the self-distribution request carries the generated key index; and, through the verification area, obtain a self-distribution response from the communication area; wherein the self-distribution response is sent to the communication area by the quantum security encryption device at the other end through the global quantum security network, and the self-distribution response carries the generated key index; based on the generated key index, obtain the generated key from the quantum key area; pass the generated key to the communication area through the verification area, so that the communication area relays the generated key to the quantum security encryption device at the other end through the global quantum security network.

2. The device according to claim 1, characterized in that The quantum encryption area is specifically used to obtain the first business data to be sent to the peer quantum security encryption device in the business area through the verification area; and obtain the encryption key based on the generated key stored in the quantum key area; Based on the encryption key, quantum encrypt the first service data to obtain encrypted first service data; send the encrypted first service data to the communication area through the verification area, so that the communication area directly sends the encrypted first service data to the peer quantum security encryption device; The quantum encryption area is specifically used to receive the encrypted second business data from the communication area through the verification area; wherein the encrypted second business data is directly sent to the communication area by the peer quantum security encryption device; based on the generated key stored in the quantum key area, a decryption key is obtained; based on the decryption key, the encrypted second business data is quantum decrypted to obtain the second business data; and the second business data is sent to the business area through the verification area.

3. The device according to claim 1, characterized in that The quantum key also includes a pairing key that is symmetric with the access base station; The quantum encryption area is also used to initiate an access request to an access base station in the global quantum security network based on the pairing key stored in the quantum key area before initiating the self-distribution process of generating the key; and obtain an access success response returned by the access base station.

4. The device according to claim 1, characterized in that The self-distribution request also carries the key ratio corresponding to the generated key; the key ratio is the ratio between the encryption key and the distribution key in the generated key; the encryption key is used to encrypt the supplemented generated key when distributing the supplemented generated key directly to the peer quantum security encryption device next time; the distribution key is used to perform quantum encryption and decryption on the transmitted business data when performing quantum secure communication with the peer quantum security encryption device.

5. The device according to claim 4, characterized in that The quantum encryption area is further used to monitor the remaining key amount of the generated key in the quantum key area; when it is determined that the generated key is insufficient based on the remaining key amount, the quantum key generation area is called to generate a supplementary generated key and the supplementary generated key is saved in the quantum key area; Based on the supplementary generation key stored in the quantum key area, a supplementary key index is determined; based on the encryption key stored in the quantum key area, the generated self-distributed supplementary request is quantum encrypted; wherein the self-distributed supplementary request carries the supplementary key index and the key ratio corresponding to the supplementary generation key; through the verification area, the encrypted self-distributed supplementary request is transmitted to the communication area, so that the communication area directly sends the encrypted self-distributed supplementary request to the peer quantum security encryption device; and, through the verification area, an encrypted self-distributed supplementary response is obtained from the communication area; wherein the encrypted self-distributed supplementary response is directly transmitted to the peer quantum security encryption device. The invention further comprises the steps of: sending the encrypted self-distributed supplementary response to the communication zone; decrypting the encrypted self-distributed supplementary response based on the encryption key; obtaining the supplementary generation key from the quantum key zone based on the supplementary key index carried in the decrypted self-distributed supplementary response; quantum encrypting the supplementary generation key based on the encryption key to obtain the encrypted supplementary key; transmitting the encrypted supplementary key to the communication zone through the verification zone, so that the communication zone directly sends the encrypted supplementary key to the peer quantum security encryption device, and the peer quantum security encryption device quantum encrypts the encrypted supplementary key based on the encryption key to obtain the supplementary generation key.

6. The device according to claim 5, characterized in that The self-distribution supplementary request also carries a preset expansion ratio, where the preset expansion ratio indicates the length of data that can be encrypted by each 1-bit encryption key; The quantum encryption zone is specifically used to expand the encryption key based on the preset expansion ratio; based on the expanded encryption key, quantum encrypt the supplementary generated key to obtain the encrypted supplementary key.

7. The device according to claim 5, characterized in that The encryption header of the encrypted supplementary key carries an offset indication of the encryption key, and the offset indication is used to prompt the peer quantum security encryption device to locate the offset position of the locally stored encryption key.

8. The device according to claim 5, characterized in that The verification area is used to perform security verification on the transmitted data.

9. The device according to claim 1, characterized in that The quantum encryption area is specifically used to determine the generated key index based on the generated key stored in the quantum key area according to a preconfigured hash algorithm.

10. A self-distributed global quantum secure encryption communication system, characterized in that: The system comprises a self-distributed global quantum security encryption device connected to a global quantum security network as described in any one of claims 1 to 9 and a peer quantum security encryption device connected to the global quantum security network; The peer quantum security encryption device is used to receive a self-distribution request relayed by the self-distributed global quantum security encryption device through a global quantum security network; generate a self-distribution response based on a generated key index carried in the self-distribution request; send the self-distribution response to the self-distributed global quantum security encryption device through the global quantum security network; receive a generated key relayed by the self-distributed global quantum security encryption device through the global quantum security network; save the generated key, so as to perform quantum secure communication with the self-distributed global quantum security encryption device based on the generated key.

Images