Optical transport network security system and communication method based on quantum enhancement

Abstract

The invention provides an optical transport network security system and communication method based on quantum enhancement, the system is a hardware, software and protocol layer integrated structure, and the system comprises an optical transport network device and a quantum enhancement unit; the quantum enhancement unit comprises a quantum measurement sensing module which establishes a health file of the optical transport network equipment, matches a safety parameter distribution mode based on the health file, monitors the safety state of an optical fiber transmission channel in the safety parameter distribution process, and locates a safety risk event; based on a security parameter distribution mode, generating security parameters through a quantum communication module or a security encapsulation / restoration module, and distributing the security parameters to each communication node; after the distribution of the security parameters is completed, the security encapsulation / restoration module encapsulates and restores the communication information data; and the optical transport network equipment transmits the packaged communication information data to the target communication node. According to the invention, the traditional telecommunication optical transport network can be covered, and the quantum security secrecy transmission of the telecommunication optical transport network is realized.

Description

Technical Field

[0001] The present invention relates to the field of information and communication technology, and in particular to a quantum-enhanced optical transport network security system and communication method. Background Art

[0002] Optical Transport Network (OTN) is a high-speed, high-capacity, and low-latency optical transmission technology, and a critical infrastructure for information and communications technology (ICT). However, with technological advancements, the boundaries of communication networks are being opened up, exposing critical infrastructure to ever-increasing risks and security threats to transparent transmission.

[0003] Quantum technology has become a core driver of next-generation information technology. Quantum communication, with its unique principles, can help build a new, theoretically unconditionally secure communication system, addressing the information leakage risks faced by traditional encryption systems. This technology is considered a strategic frontier for building a future cybersecurity infrastructure. Existing solutions integrating quantum technology with optical transport networks (OTNs) suffer from the following issues: 1. Separate deployment of OTN equipment and quantum devices. For example, connecting quantum communication equipment with traditional OTN equipment or utilizing quantum communication networks to distribute security parameters for secure encapsulation and transmission of communication information results in low efficiency for secure encapsulation and high deployment complexity and cost. 2. Limited by the transmission technology requirements of quantum key distribution (QKD) equipment and fiber resources, existing QKD technology cannot fully cover all OTN application scenarios. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a quantum-enhanced optical transport network security system and communication method, which can cover traditional telecommunication optical transport networks and realize quantum security and confidential transmission in telecommunication optical transport networks.

[0005] In order to achieve the above object, the technical solution adopted by the present invention is as follows: In the first aspect, the present invention provides a quantum-enhanced optical transport network security system, which is an integrated structure of hardware, software, and protocol layers, including: optical transport network equipment and quantum enhancement units; wherein the quantum enhancement unit is miniaturized and integrated into a slot of the optical transport network equipment, and the quantum enhancement unit includes: a quantum communication module, a security encapsulation / reduction module, and a quantum measurement sensor module; the quantum measurement sensor module is used to establish a health profile of the optical transport network equipment, and based on the health profile, specifies data matching security parameter distribution mode according to the target application scenario or transmission channel; if the security parameter distribution mode is the security parameter distribution mode of quantum key distribution, the quantum communication module is used to generate a security parameter distribution mode of quantum key distribution. The security parameters are generated and distributed to each communication node; if the security parameter distribution mode is the QRNG combined with encryption algorithm security parameter distribution mode, the security encapsulation / restore module is used to generate security parameters and distribute the security parameters to each communication node; during the security parameter distribution process, the quantum measurement sensing module is also used to monitor the security status of the optical fiber transmission channel and locate security risk events of the optical fiber transmission channel; after the security parameter distribution is completed, the security encapsulation / restore module is also used to encapsulate and restore the communication information data based on the security parameters and the preset encryption algorithm; the optical transport network equipment is used to transmit the encapsulated communication information data to the target communication node.

[0006] Optionally, the quantum measurement sensing module is specifically used to: use intelligent recognition technology to analyze the quality characteristic indicators of the optical fiber channel through time-of-flight testing, quantum measurement sensing, registration verification, and identity authentication, and identify the characteristic information, security status information, and device identity information of the optical fiber transmission channel to establish a health record of the optical transmission network equipment.

[0007] Optionally, the quantum measurement sensing module is also used to: inject monitoring optical pulse signals into the channel, and dynamically collect physical quantities in the backscattered or reflected signals using single-photon detection technology and high-precision time resolution technology; after pre-processing the collected physical quantities, extract features of different dimensions to obtain optical fiber channel quality characteristic indicators.

[0008] Optionally, the quantum measurement sensing module is also used to monitor the security status of the optical fiber transmission channel based on the optical fiber channel quality characteristic indicators and locate security risk events of the optical fiber transmission channel.

[0009] Optionally, if the security parameter distribution mode is the security parameter distribution mode of quantum key distribution, the quantum communication module is specifically used to: generate security parameters using quantum key distribution technology for an optical transmission channel that meets the technical conditions of quantum key distribution, and distribute the security parameters to each communication node; wherein the technical conditions of quantum key distribution include at least: quantum key distribution transmission distance, quantum channel, quantum key distribution protocol and encoding method, and the quantum key distribution protocol includes at least: decoy state BB84 protocol and Gaussian modulation coherent state protocol; the encoding method includes at least: polarization, phase, and time phase.

[0010] Optionally, if the security parameter distribution mode is a security parameter distribution mode of QRNG combined with an encryption algorithm, the security encapsulation / restore module is specifically used to: use a quantum random number generator to generate security parameters for optical transmission channels that do not meet the technical conditions of quantum key distribution; perform identity authentication and security parameter distribution between communication nodes based on a preset encryption algorithm protocol; wherein the preset encryption algorithm protocol includes at least: post-quantum cryptography algorithm, SM2 algorithm, SM3 algorithm, and SM4 algorithm.

[0011] Optionally, the security encapsulation / restoration module is also used to: transmit the uplink data of the communication information to the optical path payload unit, and securely encapsulate the communication information data in the optical path payload unit based on the security parameters, and update the OPUk payload before encapsulation with the encapsulated OPUk payload; combine the encapsulated OPUk payload and the ODU overhead into ODU, and map the ODU to the QOTN frame through multiplexing mapping; when the QOTN frame is transmitted to the target communication node via the optical transport network equipment, separate the ODU from the QOTN frame, and extract the OPUk payload from the ODU; securely restore the OPUk payload based on the security parameters, and update the OPUk payload before restoration with the restored OPUk payload; extract the communication information data based on the restored OPUk payload, and transmit the communication information data to the downstream service side.

[0012] In a second aspect, the present invention provides a communication method, which is applied to any one of the quantum-enhanced optical transport network security systems provided in the first aspect. The quantum-enhanced optical transport network security system is an integrated structure of hardware, software, and protocol layers, including: an optical transport network device and a quantum enhancement unit; wherein the quantum enhancement unit is miniaturized and integrated into a slot of the optical transport network device, and the quantum enhancement unit includes: a quantum communication module, a security encapsulation / reduction module, and a quantum measurement sensor module; the method includes: establishing a secure channel between communication nodes through a transmission channel, and establishing a health profile of the optical transport network device through the quantum measurement sensor module, and based on the health profile, specifying a data matching security parameter distribution mode according to the target application scenario or transmission channel; if the security parameter distribution If the security parameter distribution mode is the quantum key distribution security parameter distribution mode, the security parameters are generated by the quantum communication module and distributed to each communication node; if the security parameter distribution mode is the QRNG combined with encryption algorithm security parameter distribution mode, the security parameters are generated by the security encapsulation / restore module and distributed to each communication node; during the security parameter distribution process, the quantum measurement sensing module is also used to monitor the security status of the optical fiber transmission channel and locate security risk events of the optical fiber transmission channel; after the security parameter distribution is completed, the communication information data is encapsulated and restored by the security encapsulation / restore module based on the security parameters and the preset encryption algorithm; and the encapsulated communication information data is transmitted to the target communication node through the optical transport network equipment.

[0013] Optionally, a health profile of the optical transport network equipment is established through the quantum measurement sensing module, including: using intelligent recognition technology to identify the characteristic information, security status information, and device identity information of the optical fiber transmission channel through flight time testing, quantum measurement sensing, registration verification, and identity authentication, and establish a health profile of the optical transport network equipment.

[0014] Optionally, security parameters are generated through a quantum communication module and distributed to each communication node, including: for an optical transmission channel that meets the technical conditions of quantum key distribution, quantum key distribution technology is used to generate security parameters, and the security parameters are distributed to each communication node; wherein, the technical conditions of quantum key distribution include: quantum key distribution transmission distance, quantum channel, quantum key distribution protocol and encoding method, quantum key distribution protocols include: decoy state BB84 protocol, Gaussian modulation coherent state protocol; encoding methods include: polarization, phase, time phase.

[0015] The present invention brings the following beneficial effects: The above-mentioned quantum-enhanced optical transport network security system and communication method provided by the present invention is an integrated structure of hardware, software, and protocol layers, including: optical transport network equipment and quantum enhancement units; wherein the quantum enhancement unit is miniaturized and integrated into the slot of the optical transport network equipment, and the quantum enhancement unit includes: a quantum communication module, a security encapsulation / reduction module, and a quantum measurement sensor module; the quantum measurement sensor module is used to establish a health profile of the optical transport network equipment, and based on the health profile, specifies data matching security parameter distribution mode according to the target application scenario or transmission channel; if the security parameter distribution mode is the security parameter distribution mode of quantum key distribution, the quantum communication module is used to generate The security parameters are generated and distributed to each communication node; if the security parameter distribution mode is the QRNG combined with encryption algorithm security parameter distribution mode, the security encapsulation / restore module is used to generate security parameters and distribute the security parameters to each communication node; during the security parameter distribution process, the quantum measurement sensing module is also used to monitor the security status of the optical fiber transmission channel and locate security risk events of the optical fiber transmission channel; after the security parameter distribution is completed, the security encapsulation / restore module is also used to encapsulate and restore the communication information data based on the security parameters and the preset encryption algorithm; the optical transport network equipment is used to transmit the encapsulated communication information data to the target communication node.

[0016] This quantum-enhanced optical transport network security system utilizes an integrated communication and security design for optical transmission equipment, miniaturizing the quantum enhancement unit and integrating it into the optical transport network equipment slot. This system integrates hardware, software, and protocol layers. A quantum measurement sensor module establishes a health profile for the optical transport network equipment. Based on this health profile, the security parameter distribution model is matched to the target application scenario and the optical fiber transmission channel, enabling secure distribution of security parameters between communication nodes within a trusted security domain. During this security parameter distribution process, the quantum measurement sensor module provides on-demand monitoring of the security status of the optical fiber transmission channel and locates security risk events along the channel. Once security parameter distribution is complete, the communication data can be encapsulated and restored using the security parameters and a pre-set encryption algorithm, ensuring the confidentiality and integrity of the transmitted information, thereby enabling quantum secure and confidential transmission within the telecommunications optical transport network.

[0017] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or understood by practicing the present invention. The purposes and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0018] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the preferred embodiments are specifically listed below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0020] Figure 1 A diagram of a quantum-enhanced optical transport network security architecture provided by an embodiment of the present invention; Figure 2 A schematic diagram of the principle of a quantum measurement sensor module provided by an embodiment of the present invention; Figure 3 A schematic diagram of the QKD working principle provided by an embodiment of the present invention; Figure 4 A schematic diagram of a secure encapsulation / restoration module provided in an embodiment of the present invention; Figure 5 A schematic diagram of communication information data encapsulation and restoration provided by an embodiment of the present invention; Figure 6 A block diagram of a quantum-enhanced OTN device provided by an embodiment of the present invention; Figure 7 A schematic diagram of the communication process of a quantum-enhanced optical transport network security system provided by an embodiment of the present invention; Figure 8 A flow chart of a communication method provided by an embodiment of the present invention; Figure 9 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0022] At present, the application scenarios of quantum key distribution are limited by transmission line conditions and the separate deployment of OTN equipment and quantum equipment. There are problems such as low performance efficiency, high cost, complex maintenance, limited security monitoring and protection capabilities of existing optical fiber channels, and insufficient active defense measures.

[0023] Based on this, the embodiments of the present invention provide a quantum-enhanced optical transport network security system and communication method that can cover traditional telecommunication optical transport networks and realize quantum-secure and confidential transmission in telecommunication optical transport networks.

[0024] To facilitate understanding of this embodiment, a quantum-enhanced optical transport network security system disclosed in an embodiment of the present invention is first introduced in detail. Figure 1 As shown, based on the traditional telecommunications network structure and OTN equipment form factors, and in accordance with relevant ITU-T standards, quantum technology is integrated into OTN equipment in the form of device modules. This design integrates hardware, software, and protocol layers with high integration, security, and reliability, resulting in a "communication and security-integrated" optical transport device. This quantum-enhanced optical transport network security architecture comprises optical transport network equipment and quantum enhancement units (QUs), which are miniaturized and integrated into slots in the optical transport network equipment. The optical transport network equipment includes user-side processing modules, cross-connect modules, line-side processing modules, and multiplexing / demultiplexing modules. The QUs (QuA) include, but are not limited to, quantum communication modules, security encapsulation / reduction modules, and quantum measurement and sensing modules.

[0025] The quantum measurement sensing module is used to establish a health profile for optical transport network equipment, and based on the health profile, specifies the data matching security parameter distribution mode according to the target application scenario or transmission channel.

[0026] If the security parameter distribution mode is the quantum key distribution security parameter distribution mode, the quantum communication module is used to generate security parameters and distribute the security parameters to each communication node; if the security parameter distribution mode is the QRNG (Quantum Random Number Generator) combined with the encryption algorithm security parameter distribution mode, the security encapsulation / restore module is used to generate security parameters and distribute the security parameters to each communication node.

[0027] During the security parameter distribution process, the quantum measurement sensing module can provide on-demand monitoring of the security status of the optical fiber transmission channel and locate security risk events in the optical fiber transmission channel.

[0028] After the security parameters are distributed, the security encapsulation / restoration module is further used to encapsulate and restore the communication information data based on the security parameters and a preset encryption algorithm.

[0029] Optical transport network equipment is used to transmit encapsulated communication information data to the target communication node.

[0030] The above-mentioned quantum-enhanced optical transport network security system provided by the embodiment of the present invention adopts the "communication and security integration" design of optical transmission equipment, miniaturizes the quantum enhancement unit and integrates it into the optical transport network equipment slot, establishes the health record of the optical transport network equipment through the quantum measurement sensor module, and matches the security parameter distribution mode according to the health record and the target application scenario and the optical fiber transmission channel, so that the security parameters can be securely distributed between communication nodes within a trusted security domain; after the security parameters are distributed, the communication information data can be encapsulated and restored in combination with the security parameters and the preset encryption algorithm, ensuring the confidentiality and integrity of the transmitted information, thereby realizing quantum security and confidential transmission in the telecommunications optical transport network.

[0031] In one embodiment, the quantum measurement sensing module is specifically used to: use intelligent recognition technology to identify the characteristic information, security status information, and device identity information of the optical fiber transmission channel through flight time testing, quantum measurement sensing, registration verification, and identity authentication, and establish a health record for the optical transport network equipment.

[0032] In practical implementation, quantum measurement and sensing modules are used for online physical security measurements of OTN fiber transmission routes. Specifically, technologies such as time-of-flight testing and quantum measurement and sensing (QMS) can be used to dynamically monitor fiber physical characteristics in real time. Through data preprocessing, feature extraction, and artificial intelligence, these modules can identify physical conditions such as transmission route events, loss, and distance, as well as security status and device identity information, thereby establishing a health profile for optical transport network equipment.

[0033] Furthermore, the security parameter distribution mode can be automatically matched according to the health record. The security parameter distribution modes include: (1) quantum key distribution (QKD) security parameter distribution mode, which uses a quantum communication module to distribute security parameters; (2) QRNG combined with national encryption, PQC and other algorithms, which uses a security encapsulation / restore module to distribute security parameters.

[0034] The quantum measurement sensor module can also analyze and evaluate fiber transmission quality on demand throughout the security parameter lifecycle, identifying potential security parameter or communication information eavesdropping risks and providing guidance for fiber line maintenance. Specifically, the quantum measurement sensor module can monitor the security status of fiber transmission channels based on fiber channel quality characteristic indicators and locate security risk events along the channels.

[0035] In one embodiment, the quantum measurement sensing module is also used to: inject a monitoring optical pulse signal into the channel, and dynamically collect physical quantities in the backscattered signal or reflected signal using single-photon detection technology and high-precision time resolution technology; after preprocessing the collected physical quantities, extract features of different dimensions to obtain optical fiber channel quality characteristic indicators.

[0036] In the specific implementation, see Figure 2 As shown, the quantum measurement sensing module injects monitoring light pulses into the channel and utilizes single-photon detection and high-precision time resolution techniques to dynamically collect physical quantities from the backscattered or reflected signals. This data is then fed into the processing unit, which pre-processes the data (e.g., cleaning, denoising, and normalization) to extract features in different dimensions (such as time, frequency, time-frequency, and intensity). Intelligent algorithms are then used to identify, analyze, locate, and evaluate fiber channel quality indicators and channel anomalies such as clamping, bending, fiber breakage, strong light injection, V-groove cuts, scattering, beam splitting, and asymptotic coupling. Furthermore, through quantum-enhanced collaborative mechanisms, QuA provides real-time, reliable security analysis and assessment, ensuring the confidentiality, integrity, and trustworthiness of security parameter distribution.

[0037] In one embodiment, the above-mentioned quantum communication module is specifically used to: generate security parameters using quantum key distribution technology for an optical transmission channel that meets the technical conditions of quantum key distribution, and distribute the security parameters to each communication node; wherein the technical conditions of quantum key distribution include at least: quantum key distribution transmission distance, quantum channel, quantum key distribution protocol and encoding method, quantum key distribution protocol includes at least: decoy state BB84 protocol, Gaussian modulation coherent state protocol; encoding method includes at least: polarization, phase, time phase.

[0038] In specific implementation, the quantum communication module is mainly composed of functional modules such as QKD. For the optical transmission channel in the traditional telecommunications network that meets the QKD technical conditions, it can enable the two communicating parties to generate and share random security parameters for subsequent packaging and restoration of communication information.

[0039] Specifically, for optical transmission channels in traditional telecommunication networks that meet their technical requirements, the principles of quantum mechanics are used to ensure the security of security parameter distribution. Figure 3A schematic diagram of the QKD operating principle is shown. Quantum key distribution is a secure communication method involving quantum technology components and protocols. It enables both communicating parties to generate and share a random security parameter to encapsulate and restore the communicated information. QKD technical requirements generally include the QKD transmission distance, quantum channel, QKD protocol, and encoding scheme. QKD protocols include but are not limited to the decoy state BB84 protocol and the Gaussian modulated coherent state protocol. Encoding schemes can be polarization, phase, or time phase. A security parameter distribution link is established from the central computer room to node computer room n using time division multiplexing. The control unit processes relevant control information between nodes, such as synchronization information and classical communication information during the security parameter distribution process. The analysis unit receives and analyzes information uploaded between nodes for subsequent optimization of the on-demand allocation of security parameter resources.

[0040] In one embodiment, the above-mentioned security encapsulation / restore module is specifically used to: use a quantum random number generator to generate security parameters for optical transmission channels that do not meet the technical conditions of quantum key distribution; perform identity authentication and distribution of security parameters between communication nodes based on a preset encryption algorithm protocol; wherein the preset encryption algorithm protocol includes at least: post-quantum cryptography algorithm, SM2 algorithm, SM3 algorithm, and SM4 algorithm.

[0041] In specific implementations, the secure encapsulation / restore module primarily consists of a quantum random number generator (QRNG), post-quantum cryptography (PQC), a security module, a QMS collaborative mechanism, and an intelligent matching algorithm. These modules are responsible for security parameter generation and synchronization, secure encapsulation and restoration, and full lifecycle management of security parameters. For optical transmission channels that don't meet QKD technical requirements, QRNG is combined with national encryption, PQC, and other algorithmic protocols. These protocols are then activated and configured according to policy to enable identity authentication and security parameter sharing between communication nodes, ensuring secure encapsulation or restoration of communication information.

[0042] Specifically, the secure encapsulation / restore module is equipped with national secret algorithms such as SM2, SM3, and SM4, covering post-quantum cryptographic algorithms such as Kyber, Dilithium, and SPHINCS+. It is composed of integrated intellectual property cores, efficient core operators, dynamic reconfiguration, side-channel attack defense, and dedicated integrated circuits for secure SoC integration technology, as well as security hardware composed of QRNG, FPGA, etc. and a QMS security collaborative strategy platform. Figure 4As shown in the figure, the security module mainly includes an embedded system, a hardware cryptographic coprocessor, and a quantum random number entropy source. The embedded system realizes the rapid response and processing of control instructions and data, and the hardware cryptographic coprocessor realizes cryptographic operations such as encryption and decryption, key exchange, and digital signature verification. The quantum random number entropy source can extract random information from the real physical state based on quantum principles such as quantum tunneling effect, ensuring the compliance and security of the source of the cryptographic system. Among them, the security encapsulation / reduction module includes the following functions: (1) providing high-speed, multi-task parallel processing security computing functions; (2) providing application system digital signatures, identity authentication, security parameter exchange, communication service data protection, and security parameter full life cycle management functions; (3) used to establish a secure communication channel for security parameter exchange, protect the unforgeability of digital signatures and the security of data during transmission and storage, and ensure the confidentiality, integrity, and credibility of transmitted information.

[0043] Furthermore, the above-mentioned security encapsulation / restoration module is also used to: transmit the uplink data of the communication information to the optical path payload unit, and securely encapsulate the communication information data in the optical path payload unit based on the security parameters, and use the encapsulated OPUk payload to update the OPUk payload before encapsulation; combine the encapsulated OPUk payload and the ODU overhead into ODU, and map the ODU to the QOTN frame through multiplexing mapping; when the QOTN frame is transmitted to the target communication node via the optical transport network equipment, separate the ODU from the QOTN frame and extract the OPUk payload from the ODU; securely restore the OPUk payload based on the security parameters, and use the restored OPUk payload to update the OPUk payload before restoration; extract the communication information data based on the restored OPUk payload, and transmit the communication information data to the downstream service side.

[0044] For details, see Figure 5 The diagram shows a communication information data encapsulation and restoration diagram. Uplink data from the communication information is sent to the optical path payload unit (OPUk). The communication information data in the OPUk is securely encapsulated using security parameters, and the OPUk payload is updated. The OPUk payload is then combined with the ODU overhead to form an ODU, which is then multiplexed and mapped to a QOTN frame. After being transmitted to the target communication node via the optical transport network, the ODU is separated from the QOTN device frame, and the OPUk payload is extracted. The OPUk payload area is securely restored using security parameters, and the restored OPUk payload is used to update the OPUk payload before restoration. At this point, the communication information data can be extracted from the OPUk and transmitted to the downstream side.

[0045] The embodiments of the present invention can enable the secure distribution of quantum security parameters between communication nodes within a trusted security domain, and can be used for on-demand deployment of quantum-enhanced security technologies at the OTN physical layer, data link layer, or network layer, while fully covering traditional telecommunication optical transport networks. This enables quantum-secure and confidential transmission in telecommunication optical transport networks without affecting normal communications, leaving no security risks due to relaying, and without affecting quantum security performance due to optical amplification.

[0046] For ease of understanding, the embodiment of the present invention also provides a block diagram of a quantum enhanced OTN device, see Figure 6 As shown, the Control and Exchange Platform (CXP) integrates cross-connect, master control, and clock functions, supporting communication control, service scheduling, and clock processing. The hardware architecture adopts a single-board design. The quantum-enhanced unit provides both client-side and line-side interfaces and includes a quantum communication module, a security encapsulation / reduction module, and a quantum measurement sensor module. The quantum-enhanced OTN supports packet switching, time division multiplexing (TDM), SDH VC cross-connection, and OTN service adaptation, encapsulation, and mapping. It offers a variety of communication service interfaces, including E1, FE, GE, 10GE LAN, STM-1 / 4 / 16, STM-64, ODU1, and ODU2.

[0047] The quantum enhancement unit includes but is not limited to functional modules and security strategies such as quantum communication modules, security encapsulation / reduction, and quantum measurement sensing. It adopts algorithms such as SM2, SM3, SM4, and PQC, and through quantum enhancement and coordination mechanisms such as identity authentication and security monitoring and evaluation, it constructs a point-to-multipoint security parameter distribution network for distributed telecommunications networks, deploys communication information for secure encapsulation and secure reduction, and realizes OTN security and confidentiality.

[0048] The quantum enhancement unit is a quantum-enhanced optical transport network security architecture, which is applied to the above-mentioned quantum-enhanced optical transport network security system. Figure 7 As shown, the communication process of the quantum-enhanced optical transport network security system includes the following steps: S1: Establish and analyze the channel. Specifically, a secure channel is first established between communication nodes through the transmission channel. Using quantum measurement and sensing modules and intelligent identification technology, through security mechanisms and strategies such as node identity authentication, time-of-flight testing, and quantum measurement sensing, the characteristic indicators of the optical fiber transmission channel are analyzed. The channel's characteristic information, security status, device identity, and other performance are identified, and an infrastructure health profile is established.

[0049] S2: Security parameter distribution. Specifically, based on health records, application scenarios, and transmission channels, one of the following two security parameter distribution mechanisms is selected to complete security parameter distribution: (1) Technical Route 1: Utilizes the quantum communication module and the QKD security parameter distribution model; (2) Technical Route 2: Utilizes the security encapsulation / reduction module and adopts the QRNG combined with national encryption, PQC, and other algorithms for security parameter distribution. At the same time, centralized monitoring and diagnosis are deployed through the network management system to implement performance, configuration, and security management.

[0050] S3: Security status monitoring and risk event location. Specifically, during the security parameter distribution process, the quantum measurement sensor module can provide on-demand monitoring of the security status of the optical fiber transmission channel and locate security risk events in the optical fiber transmission channel.

[0051] S4: Communication information data encapsulation and restoration. Specifically, after security parameters are distributed, they are used in conjunction with national encryption, PQC, and other algorithms to encapsulate and restore the communication information data. The entire process utilizes the full lifecycle management of security parameters. Through the network management system, centralized monitoring, diagnosis, anomaly analysis, performance management, configuration management, and security management are deployed. This centrally manages OTN equipment, communication routes, transmission media, communication information, and security parameters, providing alarms for anomalies and location, ensuring secure, stable, and efficient operation of the communication network while reducing maintenance costs.

[0052] The above-mentioned quantum-enhanced optical transport network security system provided by the embodiment of the present invention adopts a technical route of integrating QuA technology, including but not limited to quantum key distribution, quantum random number generator, post-quantum cryptography and quantum measurement sensing, with OTN transmission equipment. It realizes the on-demand configuration of quantum security and quantum-enhanced protection functions such as security encapsulation and security restoration at the OTN physical layer, data link layer, or network layer according to application requirements on the basis of traditional telecommunications networks, and is fully adapted to the traditional telecommunications network structure and its flexible networking requirements.

[0053] The embodiments of the present invention are based on the International Telecommunication Union (ITU-T) OTN technical standards. Through the QuA miniaturized design technology, devices and components such as QKD, QRNG, PQC, and QMS are integrated into board-based cards and placed in OTN device slots. This provides a highly integrated, secure, and reliable telecommunications-grade solution that integrates hardware, software, and protocol layers.

[0054] The embodiment of the present invention adopts high-sensitivity and large dynamic range QMS technology. Through online measurement strategies and security coordination mechanisms, it dynamically monitors the physical characteristics of optical fibers, captures security risks of optical fiber channels in real time, provides physical security data and analysis and evaluation conclusions for the online distribution of security parameter channels, monitors the security of optical transmission network infrastructure, and ensures the confidentiality, integrity, and reliability of optical fiber transmission.

[0055] Regarding the quantum-enhanced optical transport network security system provided in the aforementioned embodiment, an embodiment of the present invention further provides a communication method, which is applied to the quantum-enhanced optical transport network security system provided in the aforementioned embodiment. Figure 8 The flowchart of a communication method shown in FIG. 1 illustrates that the method mainly includes the following steps S801 to S805: Step S801: Establish a secure channel between communication nodes through the transmission channel, and establish a health profile of the optical transport network device through the quantum measurement sensor module. Based on the health profile, specify the data matching security parameter distribution mode according to the target application scenario or transmission channel; Step S802: If the security parameter distribution mode is the quantum key distribution security parameter distribution mode, the quantum communication module generates security parameters and distributes the security parameters to each communication node; if the security parameter distribution mode is the QRNG combined with encryption algorithm security parameter distribution mode, the security encapsulation / restore module generates security parameters and distributes the security parameters to each communication node; Step S803: During the security parameter distribution process, the security status of the optical fiber transmission channel is monitored by the quantum measurement sensing module, and security risk events of the optical fiber transmission channel are located; Step S804: After the security parameters are distributed, the communication information data is encapsulated and restored based on the security parameters and a preset encryption algorithm by the security encapsulation / restoration module; Step S805: The encapsulated communication information data is transmitted to the target communication node via the optical transport network device.

[0056] The communication method provided by the embodiment of the present invention establishes a health profile of optical transport network equipment through a quantum measurement sensor module, and matches the security parameter distribution mode based on the health profile, according to the target application scenario and the optical fiber transmission channel, so that the security parameters can be securely distributed between communication nodes within a trusted security domain; after the security parameter distribution is completed, the communication information data can be encapsulated and restored in combination with the security parameters and a preset encryption algorithm, ensuring the confidentiality and integrity of the transmitted information, thereby realizing quantum secure and confidential transmission in the telecommunications optical transport network.

[0057] In one embodiment, when establishing a health profile of an optical transport network device through the quantum measurement sensing module, it can be implemented in ways including but not limited to: using intelligent recognition technology to identify the characteristic information, security status information, and device identity information of the optical fiber transmission channel through time-of-flight testing, quantum measurement sensing, registration verification, and identity authentication to establish a health profile of the optical transport network device.

[0058] It should be noted that the implementation principle and technical effects of the method provided in the embodiment of the present invention are the same as those of the aforementioned system embodiment. For the sake of brief description, for matters not mentioned in the method embodiment, reference can be made to the corresponding content in the aforementioned system embodiment.

[0059] An embodiment of the present invention further provides an electronic device. Specifically, the electronic device includes a processor and a storage device. The storage device stores a computer program, and when the computer program is executed by the processor, it executes the method described in any one of the above embodiments.

[0060] Figure 9 A structural diagram of an electronic device provided in an embodiment of the present invention, the electronic device 100 includes: a processor 90, a memory 91, a bus 92 and a communication interface 93, wherein the processor 90, the communication interface 93 and the memory 91 are connected via the bus 92; the processor 90 is used to execute an executable module stored in the memory 91, such as a computer program.

[0061] Memory 91 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. Communication between the system network element and at least one other network element is achieved through at least one communication interface 93 (which may be wired or wireless), and may utilize the Internet, a wide area network, a local area network, a metropolitan area network, or the like.

[0062] The bus 92 may be an ISA bus, a PCI bus, or an EISA bus. The bus may be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, Figure 9 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0063] Among them, the memory 91 is used to store programs, and the processor 90 executes the program after receiving the execution instruction. The method executed by the device for flow process definition disclosed in any embodiment of the above-mentioned embodiment of the present invention can be applied to the processor 90 or implemented by the processor 90.

[0064] The processor 90 may be an integrated circuit chip with signal processing capabilities. During implementation, the steps of the above-described method may be performed by hardware integrated logic circuits or software instructions within the processor 90. The processor 90 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present invention may be directly executed by a hardware decoding processor or by a combination of hardware and software modules within the decoding processor. The software modules may be located in storage media well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or the like. The storage medium is located in the memory 91 , and the processor 90 reads the information in the memory 91 and completes the steps of the above method in combination with its hardware.

[0065] The computer program product of the readable storage medium provided in the embodiment of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method described in the previous method embodiment. The specific implementation can be referred to the previous method embodiment and will not be repeated here.

[0066] If the functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the portion that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical disks.

[0067] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A quantum-enhanced optical transport network security system, characterized in that: The system is an integrated structure of hardware, software, and protocol layers, including an optical transport network device and a quantum enhancement unit. The quantum enhancement unit is miniaturized and integrated into a slot of the optical transport network device. The quantum enhancement unit includes a quantum communication module, a security encapsulation / reduction module, and a quantum measurement sensor module. The quantum measurement sensor module is used to establish a health profile of the optical transport network device and, based on the health profile, specify a data matching security parameter distribution mode according to a target application scenario or transmission channel; If the security parameter distribution mode is a quantum key distribution security parameter distribution mode, the quantum communication module is used to generate security parameters and distribute the security parameters to each communication node; if the security parameter distribution mode is a QRNG combined with encryption algorithm security parameter distribution mode, the security encapsulation / reduction module is used to generate security parameters and distribute the security parameters to each communication node; During the security parameter distribution process, the quantum measurement sensor module is also used to monitor the security status of the optical fiber transmission channel and locate security risk events of the optical fiber transmission channel; After the security parameters are distributed, the security encapsulation / restoration module is further used to encapsulate and restore the communication information data based on the security parameters and a preset encryption algorithm; The optical transport network equipment is used to transmit the encapsulated communication information data to the target communication node.

2. The system according to claim 1, wherein: The quantum measurement sensing module is specifically used for: Intelligent recognition technology is used to analyze the quality characteristic indicators of the optical fiber channel through flight time testing, quantum measurement sensing, registration verification, and identity authentication, and to identify the characteristic information, security status information, and device identity information of the optical fiber transmission channel to establish a health record of the optical transport network equipment.

3. The system according to claim 2, characterized in that The quantum measurement sensing module is also used for: Inject monitoring optical pulse signals into the channel and use single-photon detection technology and high-precision time resolution technology to dynamically collect the physical quantities in the backscattered or reflected signals; After preprocessing the collected physical quantities, features of different dimensions are extracted to obtain fiber channel quality characteristic indicators.

4. The system according to claim 3, characterized in that The quantum measurement sensing module is also used for: The security status of the optical fiber transmission channel is monitored based on the optical fiber channel quality characteristic index, and the security risk event of the optical fiber transmission channel is located.

5. The system according to claim 1, wherein: If the security parameter distribution mode is a security parameter distribution mode of quantum key distribution, the quantum communication module is specifically configured to: For optical transmission channels that meet the technical conditions of quantum key distribution, quantum key distribution technology is used to generate security parameters, and the security parameters are distributed to each communication node; wherein the technical conditions of quantum key distribution include at least: quantum key distribution transmission distance, quantum channel, quantum key distribution protocol and encoding method, the quantum key distribution protocol includes at least: decoy state BB84 protocol, Gaussian modulation coherent state protocol; the encoding method includes at least: polarization, phase, time phase.

6. The system according to claim 1, wherein: If the security parameter distribution mode is a QRNG combined with encryption algorithm security parameter distribution mode, the security encapsulation / restoration module is specifically used to: For optical transmission channels that do not meet the technical requirements of quantum key distribution, a quantum random number generator is used to generate security parameters; Identity authentication between communication nodes and distribution of the security parameters are performed based on a preset encryption algorithm protocol; wherein the preset encryption algorithm protocol includes at least: post-quantum cryptography algorithm, SM2 algorithm, SM3 algorithm, and SM4 algorithm.

7. The system according to claim 1, wherein: The security encapsulation / restoration module is further used for: Transmitting uplink data of the communication information to an optical path payload unit, securely encapsulating the communication information data in the optical path payload unit based on the security parameter, and updating the OPUk payload before encapsulation with the encapsulated OPUk payload; Combining the encapsulated OPUk payload and ODU overhead into an ODU, and mapping the ODU into a QOTN frame through multiplexing mapping; After the QOTN frame is transmitted to the target communication node via the optical transport network device, the ODU is separated from the QOTN frame, and the OPUk payload is extracted from the ODU; securely restoring the OPUk payload based on the security parameter, and updating the OPUk payload before restoration with the restored OPUk payload; Communication information data is extracted based on the restored OPUk payload, and the communication information data is transmitted to the downlink service side.

8. A communication method, characterized in that: The quantum-enhanced optical transport network security system according to any one of claims 1 to 7 is an integrated structure of hardware, software, and protocol layers, comprising: an optical transport network device and a quantum enhancement unit; wherein the quantum enhancement unit is miniaturized and integrated into a slot of the optical transport network device, and comprises: a quantum communication module, a security encapsulation / reduction module, and a quantum measurement sensing module; and the method comprises: Establishing a secure channel between communication nodes through a transmission channel, establishing a health profile of the optical transport network device through the quantum measurement sensor module, and specifying a data matching security parameter distribution mode according to a target application scenario or transmission channel based on the health profile; If the security parameter distribution mode is a quantum key distribution security parameter distribution mode, security parameters are generated by the quantum communication module and distributed to each communication node; if the security parameter distribution mode is a QRNG combined with encryption algorithm security parameter distribution mode, security parameters are generated by the security encapsulation / reduction module and distributed to each communication node; During the security parameter distribution process, the security status of the optical fiber transmission channel is monitored by the quantum measurement sensing module, and security risk events of the optical fiber transmission channel are located; After the security parameters are distributed, the communication information data is encapsulated and restored by the security encapsulation / restoration module based on the security parameters and a preset encryption algorithm; The optical transport network equipment is used to transmit the encapsulated communication information data to the target communication node.

9. The communication method according to claim 8, wherein: Establishing a health profile of the optical transport network device through the quantum measurement sensing module includes: By using intelligent recognition technology, through time-of-flight testing, quantum measurement sensing, registration verification, and identity authentication, the characteristic information, security status information, and device identity information of the optical fiber transmission channel are identified, and a health record of the optical transport network equipment is established.

10. The communication method according to claim 8, wherein: Generating security parameters through the quantum communication module and distributing the security parameters to each communication node includes: For optical transmission channels that meet the technical conditions of quantum key distribution, quantum key distribution technology is used to generate security parameters, and the security parameters are distributed to each communication node; wherein the technical conditions of quantum key distribution include at least: quantum key distribution transmission distance, quantum channel, quantum key distribution protocol and encoding method, the quantum key distribution protocol includes at least: decoy state BB84 protocol, Gaussian modulation coherent state protocol; the encoding method includes at least: polarization, phase, time phase.

Images