Quantum encryption communication system between local area networks

Abstract

The invention discloses a quantum encryption communication system between local area networks, and the system comprises a first quantum security switch and a second quantum security switch which are connected through a common channel; the first quantum security switch is connected with at least one first terminal device through a first local area network, the second quantum security switch is connected with at least one second terminal device through a second local area network, and the first quantum security switch performs quantum encryption on sent data of the first terminal device. Decrypting the quantum encrypted data received by the first terminal device; and the second quantum security switch performs quantum encryption on the sent data of the second terminal equipment and decrypts the quantum encrypted data received by the second terminal equipment, so as to realize quantum encrypted communication between the first terminal equipment in the first local area network and the second terminal equipment in the second local area network. Communication data are encrypted by using a quantum key through the quantum security switch, so that the leakage risk of communication information is greatly reduced.

Description

Technical Field

[0001] The present invention belongs to the field of quantum communication technology, and more specifically, the present invention relates to a quantum encryption communication system between local area networks. Background Art

[0002] In traditional network encryption technology, key acquisition relies on public or shared key systems, requiring computation after data exchange. This system presents significant potential risks, as key security relies on computational complexity. With today's rapidly advancing computing power, computational complexity no longer poses a significant barrier to cracking. Furthermore, the key update process is complex and computationally intensive, requiring significant time, with updates taking as long as minutes.

[0003] Quantum cryptography uses quantum particles to carry and transmit information. Based on the fundamental physical properties of quantum mechanics, it enables unclonable and eavesdrop-proof quantum key transmission between users. This technology enables real-time key distribution and updates, fundamentally guaranteeing the security of key transmission. Quantum secure switches utilize the secure keys provided by quantum key distribution systems to encrypt information.

[0004] Application number 202010217557.6, patent name: A high-speed key switching quantum security switch based on quantum cryptography technology. The key reuse in this technical solution has the problem of low security, and if the key pool rotation algorithm and the key number update rules are leaked, eavesdroppers can easily crack the password, posing a huge risk of data information leakage. Summary of the Invention

[0005] The present invention provides a quantum encryption communication system between local area networks, aiming to improve the above-mentioned problems.

[0006] The present invention is implemented as follows: a quantum encryption communication system between local area networks, the system comprising:

[0007] A first quantum security switch and a second quantum security switch are connected via a public channel; the first quantum security switch is connected to at least one first terminal device via a first local area network, and the second quantum security switch is connected to at least one second terminal device via a second local area network.

[0008] The first quantum security switch performs quantum encryption on the data sent by the first terminal device and decrypts the quantum encrypted data received by the first terminal device; the second quantum security switch performs quantum encryption on the data sent by the second terminal device and decrypts the quantum encrypted data received by the second terminal device, so as to realize quantum encrypted communication between the first terminal device in the first local area network and the second terminal device in the second local area network.

[0009] Furthermore, the quantum secure switch includes:

[0010] An encryption and decryption control unit, a key management and control unit connected to the encryption and decryption control unit, the key management and control unit is connected to the master key pool and the sub-key pool, the master key pool is connected to the sub-key pool, and the key management and control unit is connected to the corresponding quantum key distribution device;

[0011] The encryption and decryption control unit is used to issue a quantum key application instruction to the key management and control unit. The key management and control unit reads the quantum key from the corresponding sub-key pool based on the quantum key application instruction and returns it to the encryption and decryption control unit. The encryption and decryption control unit encrypts the sent data or decrypts the received quantum encrypted data based on the obtained quantum key. The master key pool is used to supplement the quantum keys of each sub-key pool, and the master key pool supplements the quantum keys through the corresponding quantum key distribution device.

[0012] Furthermore, when a terminal device in the current local area network performs quantum encryption communication with terminal devices in n other local area networks, n master key pools are set in the quantum security switch in the current local area network. The i-th master key pool is used to store the quantum key required when the terminal device in the local area network performs quantum encryption communication with the terminal device in the i-th local area network. The current local area network is the first local area network or the second local area network.

[0013] Furthermore, when the first terminal device communicates with the second terminal, the first quantum secure switch and the second quantum secure switch respectively establish a subkey pool for the first device terminal and the second device terminal currently in the communication state, for storing the quantum key used for encrypting the communication data between the two parties.

[0014] Furthermore, the method for establishing the subkey pool is as follows:

[0015] The first quantum security switch and the second quantum security switch establish a unique communication identifier for the communication connection through negotiation, and respectively establish a sub-key pool based on the communication identifier. They simultaneously apply for a set amount N1 of quantum keys from their respective master key pools, delete the applied quantum keys from the master key pool, and simultaneously enter the corresponding sub-key pools in sequence.

[0016] The quantum keys in the master key pools of the first quantum security switch and the second quantum security switch are exactly the same, and the quantum keys are stored linearly in sequence, and N1 quantum keys are taken out from the master key pool in sequence.

[0017] Furthermore, the quantum encryption and decryption process of communication data based on the subkey pool is as follows:

[0018] When the sender sends a message Msg, the quantum secure switch at the sender extracts a quantum key of a set length from the corresponding subkey pool based on the communication identifiers of the two communicating parties to encrypt the message Msg, and sends the quantum encrypted message Msg1 and the quantum key information to the receiver. The quantum key information includes: the position identifier x of the first key in the key sequence that constitutes the quantum key and the key length l;

[0019] After the quantum security switch at the receiving end receives the encrypted information Msg1 and the quantum key information, the encryption and decryption control unit takes out the quantum key of the corresponding position and length from the subkey pool corresponding to the communication identifier to decrypt the quantum encrypted information Msg1, obtain the information Msg, and forward it to the corresponding terminal device.

[0020] Furthermore, if the number of quantum keys in the master key pool used for communication encryption between two local area networks is lower than the set threshold, the corresponding master key pool is supplemented with quantum keys. The supplementation process is as follows:

[0021] The quantum security switches in the two local area networks, through consensus, synchronously put the newly generated quantum keys of the corresponding quantum key distribution devices into their respective temporarily applied secondary key pools. The quantum security switches in the two local area networks perform consistency detection on the quantum keys in the two secondary key pools. If the detection is consistent, the two main key pools used for communication encryption between the two local area networks are locked, and the quantum keys in the secondary key pools are synchronously injected into the corresponding main key pool to unlock the main key pool.

[0022] Furthermore, the consistency check process of the quantum key in the secondary key pool is as follows:

[0023] The quantum security switches in the two local area networks calculate the check value of the quantum key in the local secondary key pool respectively and send it to each other. The quantum security switch will compare the check value obtained based on the quantum key in the local secondary key pool with the received check value. If the two are consistent, the quantum keys in the two secondary key pools are deemed to be consistent.

[0024] Furthermore, when the amount of quantum keys in the sub-key pool used to encrypt communication data between the first terminal device and the second terminal device is lower than a set quantity threshold, the first quantum security switch negotiates with the second quantum security switch to apply for a new quantum key from the master key pool to supplement the sub-key pool. The negotiation content includes: the starting position, length, and key check value of the newly applied key.

[0025] Furthermore, after the first terminal device and the second terminal device complete this round of communication, the first quantum security switch and the second quantum security switch put the remaining quantum keys in the corresponding sub-key pool into their respective temporarily applied secondary key pools, and detect the consistency of the quantum keys in the two secondary key pools. If the detection is consistent, they are synchronously injected into their respective main key pools, releasing the sub-key pool space and destroying the communication identifier of the communication connection.

[0026] The quantum encryption communication system between local area networks provided by the present invention designs a quantum security switch, which uses quantum keys to encrypt communication data through the quantum security switch, greatly reducing the risk of leakage of communication information. In addition, the quantum keys in the quantum security switch are updated quickly, and each quantum key used is a new and unused key. The one-time encryption method is strictly implemented, and the key is destroyed synchronously according to the standard process after use, which minimizes information leakage and greatly improves the security of encrypted communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic diagram of the structure of a quantum encryption communication system between local area networks provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The specific implementation methods of the present invention will be further explained in detail below by describing the embodiments with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0029] Figure 1 This is a schematic diagram of the structure of a quantum encryption communication system between local area networks provided by an embodiment of the present invention. For ease of explanation, only the parts related to the embodiment of the present invention are shown. The system includes:

[0030] A first quantum security switch and a second quantum security switch, the first quantum security switch and the second quantum security switch are connected through a public channel; the first quantum security switch is connected to at least one first terminal device through a first local area network, and the second quantum security switch is connected to at least one second terminal device through a second local area network; a first quantum key distribution device and a second quantum key distribution device, the first quantum key distribution device is connected to the first quantum security switch through a dedicated network interface, the second quantum key distribution device is connected to the second quantum security switch through a dedicated network interface, and the first quantum key distribution device and the second quantum key distribution device are connected through a quantum channel, wherein the dedicated network interface refers to a network interface that is only used by the quantum key distribution device and is used for quantum key transmission. The terminal device is generally a mobile phone, a landline, a tablet, etc.

[0031] The first quantum security switch performs quantum encryption on the data sent by the first terminal device and decrypts the quantum encrypted data received by the first terminal device; the second quantum security switch performs quantum encryption on the data sent by the second terminal device and decrypts the quantum encrypted data received by the second terminal device, so as to realize quantum encrypted communication between the first terminal device in the first local area network and the second terminal device in the second local area network.

[0032] In an embodiment of the present invention, the first quantum secure switch and the second quantum secure switch include:

[0033] An encryption and decryption control unit, a key management and control unit connected to the encryption and decryption control unit, the key management and control unit is connected to the master key pool and the sub-key pool, the master key pool is connected to the sub-key pool, and the key management and control unit is connected to the corresponding quantum key distribution device;

[0034] The encryption and decryption control unit is used to issue a quantum key application instruction to the key management and control unit. The key management and control unit reads the quantum key from the corresponding sub-key pool based on the quantum key application instruction and returns it to the encryption and decryption control unit. The encryption and decryption control unit encrypts the sent data or decrypts the received quantum encrypted data based on the obtained quantum key. The master key pool is used to supplement the quantum keys of each sub-key pool, and the master key pool supplements the quantum keys through the corresponding quantum key distribution device.

[0035] In an embodiment of the present invention, the quantum security switch also includes: a switching unit, which is used to forward quantum encryption data to the other party's quantum security switch through a public channel, or to receive quantum encryption data reissued by the other party's switching unit. Once the quantum key leaves the sub-key pool from the key management unit and reaches the encryption and decryption control unit, it will no longer return to the key pool, and will be destroyed after the current use. At the same time, the key management unit will no longer retain this part of the key, and reverse operation is not allowed. This is to ensure the security and isolation of the quantum key.

[0036] In an embodiment of the present invention, in addition to performing quantum encryption communication with a second terminal device in a second local area network, a first terminal device in a first local area network can also perform quantum encryption communication with terminal devices in other local area networks. If a terminal device in the current local area network performs quantum encryption communication with terminal devices in n other local area networks, n master key pools are provided in the quantum security switch in the current local area network. The i-th master key pool is used to store the quantum key required when the terminal device in the local area network performs quantum encryption communication with the terminal device in the i-th local area network. The current local area network is the first local area network or the second local area network.

[0037] In an embodiment of the present invention, the key control unit monitors the remaining quantum key amount in the sub-key pool in real time during the communication process, and determines whether it is necessary to apply for quantum key replenishment from the master key pool connected to it based on the remaining quantum key amount of the sub-key pool. If necessary, the sub-key pool is replenished with quantum keys through the update mechanism of the sub-key pool. At the same time, the key control unit monitors the remaining quantum key amount of the master key pool, and determines whether it is necessary to replenish quantum keys based on the remaining quantum key amount of the master key pool. If necessary, the master key pool is replenished with quantum keys through the update mechanism of the master key pool.

[0038] Multiple first terminal devices in the first local area network can simultaneously perform quantum encryption communication with multiple second terminal devices in the second local area network. The first quantum security switch and the second quantum security switch respectively establish a sub-key pool for the first device terminal and the second device terminal currently in the communication state, which is used to store the quantum key for encrypting or decrypting the communication data between the two parties.

[0039] In an embodiment of the present invention, a method for establishing a sub-key pool is specifically as follows: before a first terminal device and a second terminal device perform quantum encryption communication, the first quantum security switch and the second quantum security switch establish a unique communication identifier for the communication connection through negotiation. The first quantum security switch and the second quantum security switch each establish a sub-key pool based on the communication identifier, and simultaneously apply for a set number of quantum keys from their respective master key pools. The applied quantum keys are deleted from the master key pool, and the applied quantum keys are sequentially entered into the corresponding sub-key pools. Since quantum keys exist linearly in the master key pool, for example, if the quantum keys in the master key pool are numbered from 0 to N, and N1 quantum keys are taken out from the master key pool, the quantum keys in the sub-key pool are in the order of 0 to N1, where N1≤N. The quantum keys in the master key pools of the first quantum security switch and the second quantum security switch are exactly the same, and the same quantum keys assigned to the sub-key pools are also exactly the same, with their order and keys being exactly the same.

[0040] In an embodiment of the present invention, the quantum encryption and decryption process of communication data based on the subkey pool is as follows:

[0041] When the sending end sends the message Msg, the quantum security switch at the sending end extracts a quantum key of a set length from the corresponding sub-key pool based on the communication identifiers of the communicating parties to encrypt the message Msg, and sends the quantum encryption message Msg1 and the quantum key information to the receiving end through the exchange unit and the public channel. The quantum key information includes: the position identifier x (which key it belongs to) and the key length l of the first key in the key sequence that constitutes the quantum key. After the quantum security switch at the receiving end receives the encrypted message Msg1 and the quantum key information through the exchange unit, it extracts the quantum key of the corresponding position and length from the sub-key pool corresponding to the communication identifier through the encryption and decryption control unit to decrypt the quantum encryption message Msg1, obtain the message Msg, and forward it to the corresponding terminal device, thus completing a communication.

[0042] The initiator can be either the first or second terminal device. When the initiator is the first terminal device, the receiver is the second terminal device. When the sender is the second terminal device, the receiver is the first terminal device. Both parties simultaneously destroy the used quantum key according to the standard destruction process. Because key extraction and destruction are sequential, encryption can use the fastest bitwise XOR method (other encryption methods are also possible). The algorithm complexity is very low, and the encryption and decryption functions are secure and efficient, with no impact on the original communication network performance.

[0043] In an embodiment of the present invention, the update mechanism of the master key pool is as follows:

[0044] Before initial deployment, the keys in the master key pool of the quantum secure switch are synchronized and obtained from the quantum key distribution device, ensuring consistency under secure conditions. This synchronization can be achieved in a variety of ways, including having the quantum secure switches on both sides simultaneously obtain the same quantum key from one end in a secure environment, or manually assigning the same quantum key to the master key pool of the quantum secure switches on both sides.

[0045] Since the quantum keys in the master key pool are used to encrypt communications between terminal devices in different LANs, if the number of quantum keys in the master key pool for encryption of communications between different LANs is insufficient, it is necessary to supplement the quantum keys in the master key pools of the two LANs. The supplementation process is as follows:

[0046] The quantum security switches in the two local area networks, through consensus, first synchronize the newly generated quantum keys of the corresponding quantum key distribution devices into their respective temporarily applied secondary key pools; the quantum security switches of both parties perform consistency detection on the quantum keys in the two secondary key pools. If the quantum keys in the two secondary key pools are consistent, the main key pools of both parties are locked, and the quantum keys in the secondary key pools are synchronously injected into the corresponding main key pool, and the main key pools are unlocked. After the main key pool is locked, no other operations can be performed on the main key pool, thus ensuring the security and consistency of the two main key pools. The specific process of the consistency check of the quantum keys in the secondary key pools is as follows:

[0047] The quantum security switches in the two local area networks calculate the check values ​​of the quantum keys in their local secondary key pools respectively and send them to each other. The quantum security switches at both ends will compare the check values ​​obtained based on the quantum keys in their local secondary key pools with the received check values. If the two are consistent, it is determined that the quantum keys in the secondary key pools of both parties are consistent and can be injected into their respective master key pools.

[0048] In order not to affect the progress of encrypted communication, when the amount of sub-key pool keys used in this link is lower than the set threshold (for example, the threshold is set to 30% of the total amount of the sub-key pool), the key management and control units at both ends must reach a consensus and then synchronously apply for new quantum keys from the main key pool to supplement the insufficient sub-key pool keys. The newly applied keys can be placed sequentially after the existing keys in the sub-key pool and numbered sequentially.

[0049] In an embodiment of the present invention, the negotiation process is as follows: If the quantum key quantity in the sub-key pool is less than a set threshold, a key replenishment notification is sent to the other party. After the other party completes the current round of communication (at this time, the keys of the two-terminal key pool are consistent), both parties temporarily lock the sub-key pool. One party calculates the key length L1 to be applied based on the key capacity and the remaining key quantity of the sub-key pool, unlocks the sub-key pool (communication can continue), and sends the key information of the key to be applied to the key control unit of the other party. The key information of the key to be applied includes the key length L1 of the key to be applied, the starting position index0 of the key to be applied, and the check value of the key to be applied. After obtaining the key information of the key to be applied, the key control unit of the other party locates the newly applied key from the local master key pool and calculates the check value. If the check values ​​of both parties are consistent, the other party is notified to synchronously add the newly applied key from the master key pool to the corresponding sub-key pool, and the portion of the key injected into the sub-key pool is destroyed in the master key pool. If the check values ​​of both parties are inconsistent, the above process is repeated. If there are multiple inconsistencies, the master key pool key needs to be verified through the update mechanism of the master key pool. The communication information in this process is also completed by quantum key encryption.

[0050] Sub-key pool key recovery mechanism: After the communication between the two parties is completed, the key management and control unit uses the remaining quantum key in the sub-key pool as the new key to synchronize the quantum key of the main key pool, and synchronously recovers it to the main key pool, releasing the sub-key pool space and destroying the communication identifier of the communication connection.

[0051] The invention provides a design of a quantum security switch, which uses quantum keys to encrypt communication data through the quantum security switch, greatly reducing the risk of leakage of communication information. In addition, the quantum keys in the quantum security switch are updated quickly, and each quantum key used is a new and unused key. The one-time encryption method is strictly implemented. Once the key is used, it is destroyed synchronously according to the standard process, which minimizes the leakage of information and greatly improves the security of encrypted communication.

[0052] The present invention has been described exemplarily. Obviously, the specific implementation of the present invention is not limited to the above-mentioned method. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the scope of protection of the present invention.

Claims

1. A quantum encryption communication system between local area networks, characterized in that: The system comprises: a first quantum secure switch and a second quantum secure switch, the first quantum secure switch and the second quantum secure switch being connected via a public channel; the first quantum secure switch being connected to at least one first terminal device via a first local area network, and the second quantum secure switch being connected to at least one second terminal device via a second local area network; The first quantum security switch performs quantum encryption on the data sent by the first terminal device and decrypts the quantum encrypted data received by the first terminal device; the second quantum security switch performs quantum encryption on the data sent by the second terminal device and decrypts the quantum encrypted data received by the second terminal device, so as to realize quantum encrypted communication between the first terminal device in the first local area network and the second terminal device in the second local area network.

2. The quantum encryption communication system between local area networks according to claim 1, wherein: The quantum-safe switch includes: An encryption and decryption control unit, a key management and control unit connected to the encryption and decryption control unit, the key management and control unit is connected to the master key pool and the sub-key pool, the master key pool is connected to the sub-key pool, and the key management and control unit is connected to the corresponding quantum key distribution device; The encryption and decryption control unit is used to issue a quantum key application instruction to the key management and control unit. The key management and control unit reads the quantum key from the corresponding sub-key pool based on the quantum key application instruction and returns it to the encryption and decryption control unit. The encryption and decryption control unit encrypts the sent data or decrypts the received quantum encrypted data based on the obtained quantum key. The master key pool is used to supplement the quantum keys of each sub-key pool, and the master key pool supplements the quantum keys through the corresponding quantum key distribution device.

3. The quantum encryption communication system between local area networks as claimed in claim 1, characterized in that: When a terminal device in the current local area network performs quantum encryption communication with terminal devices in n other local area networks, n master key pools are set in the quantum security switch in the current local area network. The i-th master key pool is used to store the quantum key required when the terminal device in the local area network performs quantum encryption communication with the terminal device in the i-th local area network. The current local area network is the first local area network or the second local area network.

4. The quantum encryption communication system between local area networks as claimed in claim 2, characterized in that: When the first terminal device communicates with the second terminal, the first quantum secure switch and the second quantum secure switch respectively establish a subkey pool for the first device terminal and the second device terminal currently in the communication state, which is used to store the quantum key used for encrypting the communication data between the two parties.

5. The quantum encryption communication system between local area networks as claimed in claim 4, characterized in that: The method for establishing a subkey pool is as follows: The first quantum security switch and the second quantum security switch establish a unique communication identifier for the communication connection through negotiation, and respectively establish a sub-key pool based on the communication identifier. They simultaneously apply for a set amount N1 of quantum keys from their respective master key pools, delete the applied quantum keys from the master key pool, and simultaneously enter the corresponding sub-key pools in sequence. The quantum keys in the master key pools of the first quantum security switch and the second quantum security switch are exactly the same, and the quantum keys are stored linearly in sequence, and N1 quantum keys are taken out from the master key pool in sequence.

6. The quantum encryption communication system between local area networks as claimed in claim 5, characterized in that: The quantum encryption and decryption process of communication data based on the subkey pool is as follows: When the sender sends a message Msg, the quantum secure switch at the sender extracts a quantum key of a set length from the corresponding subkey pool based on the communication identifiers of the two communicating parties to encrypt the message Msg, and sends the quantum encrypted message Msg1 and the quantum key information to the receiver. The quantum key information includes: the position identifier x of the first key in the key sequence that constitutes the quantum key and the key length l; After the quantum security switch at the receiving end receives the encrypted information Msg1 and the quantum key information, the encryption and decryption control unit takes out the quantum key of the corresponding position and length from the subkey pool corresponding to the communication identifier to decrypt the quantum encrypted information Msg1, obtain the information Msg, and forward it to the corresponding terminal device.

7. The quantum encryption communication system between local area networks as claimed in claim 3, characterized in that: If the number of quantum keys in the master key pool used for communication encryption between two local area networks is lower than the set threshold, the corresponding master key pool will be supplemented with quantum keys. The supplementation process is as follows: The quantum security switches in the two local area networks, through consensus, synchronously put the newly generated quantum keys of the corresponding quantum key distribution devices into their respective temporarily applied secondary key pools. The quantum security switches in the two local area networks perform consistency detection on the quantum keys in the two secondary key pools. If the detection is consistent, the two main key pools used for communication encryption between the two local area networks are locked, and the quantum keys in the secondary key pools are synchronously injected into the corresponding main key pool to unlock the main key pool.

8. The quantum encryption communication system between local area networks as claimed in claim 7, characterized in that: The consistency check process of the quantum key in the secondary key pool is as follows: The quantum security switches in the two local area networks calculate the check value of the quantum key in the local secondary key pool respectively and send it to each other. The quantum security switch will compare the check value obtained based on the quantum key in the local secondary key pool with the received check value. If the two are consistent, the quantum keys in the two secondary key pools are deemed to be consistent.

9. The quantum encryption communication system between local area networks as claimed in claim 1, characterized in that: When the amount of quantum keys in the sub-key pool used for encrypting communication data between the first terminal device and the second terminal device is lower than a set quantity threshold, the first quantum secure switch negotiates with the second quantum secure switch to apply for a new quantum key from the master key pool to supplement the sub-key pool. The negotiation content includes: the starting position, length, and key check value of the newly applied key.

10. The quantum encryption communication system between local area networks as claimed in claim 1, characterized in that: After the first terminal device and the second terminal device complete this round of communication, the first quantum security switch and the second quantum security switch will put the remaining quantum keys in the corresponding sub-key pool into their respective temporarily applied secondary key pools, and detect the consistency of the quantum keys in the two secondary key pools. If the detection is consistent, they will be synchronously injected into their respective main key pools, freeing up the sub-key pool space and destroying the communication identifier of the communication connection.

Images