Method for dynamically adjusting secret key distribution flow

Abstract

The invention discloses a method for dynamically adjusting key distribution flow, and the method comprises the steps: a quantum key pool server receives a key distribution request sent by network element equipment connected with the quantum key pool server, generates a corresponding key distribution task according to the key distribution request, and generates a corresponding to-be-sent key file; then, distributing a key distribution task corresponding to the key distribution request to a task list of a distribution thread through the key distribution request; and the distribution thread of the quantum key pool server extracts the key distribution task with the minimum next start time Next value in the task parameters of all key distribution tasks from the task list of the distribution thread, and judges whether the next start time Next value in the key distribution task is the current time or not. According to the invention, the sending bandwidth B of the key distribution task is dynamically adjusted through the quantum key pool server, so that the distribution operation of the key file is completed under the condition that the service process of the network element equipment is not occupied.

Description

Technical Field

[0001] The present invention relates to the field of key distribution, and in particular to a method for dynamically adjusting key distribution flow. Background Art

[0002] With the advent of the internet age, encrypted communication has become the norm for data transmission. During this process, keys are required to encrypt and decrypt data for secure transmission. This results in a significant consumption of keys. Keys should use true random numbers to increase the unpredictability of the encryption process, making it more difficult to crack. However, the key pool of network element devices has a limited storage capacity, necessitating continuous key transmission between the network element devices and the quantum key pool server.

[0003] However, when distributing keys, the quantum key pool server will occupy a large amount of user bandwidth, affecting the use of user applications. Moreover, the quantum key pool server does not consider the receiving capabilities of network element devices (such as quantum security terminals), and often competes with other applications on the terminal for bandwidth. Therefore, when distributing keys, the quantum key pool server needs to combine its own distribution capabilities with the receiving capabilities of the network element devices to distribute keys. Otherwise, it will lead to problems such as uneven distribution, with some terminals distributing keys quickly and others distributing keys slowly; unreasonable distribution, where key distribution occupies a large amount of user bandwidth, affecting the use of user applications, and so on.

[0004] To sum up, the quantum key pool server needs to reasonably control the key download traffic for each network element device, without affecting the device's own business execution and the key download business of other network element devices. Summary of the Invention

[0005] Purpose of the Invention: This invention aims to provide a method for dynamically adjusting key distribution traffic. This method addresses the problem of existing quantum key pool servers occupying a large amount of user bandwidth when distributing keys, which affects user application usage. It also addresses the problem of quantum key pool servers not considering the receiving capabilities of network element devices, often competing with other applications on the terminal for bandwidth. By controlling key distribution traffic through a quantum key pool server, this method ensures that key distribution is carried out as quickly as possible without affecting business applications, and without causing key accumulation in the quantum key pool server.

[0006] Technical solution: The present invention provides a method for dynamically adjusting key distribution traffic, comprising the following steps:

[0007] (1) The quantum key pool server receives the key distribution request sent by the network element device connected to it, and generates the corresponding key distribution task and the corresponding key file to be sent according to the key distribution request; then, it assigns the corresponding key distribution task to the task list of the distribution thread through the key distribution request;

[0008] (2) The distribution thread of the quantum key pool server takes out the key distribution task with the smallest value of the next start time Next in the task parameters of all key distribution tasks from its task list, and determines whether the value of the next start time Next in the key distribution task is the current time. If so, it proceeds to the next step; if not, it is put back into the task list and continues to wait until the task execution time;

[0009] (3) The distribution thread of the quantum key pool server determines the sending bandwidth B of this key distribution task, and uses the sending bandwidth B to send the key file to be sent within the preset time t. If the sending time of the key file to be sent is less than t, the key file to be sent is sent; if the sending time of the key file to be sent is equal to t, it is detected whether the key file to be sent has been sent. If there is no remaining key file to be sent, the sending is completed; if there is a remaining key file to be sent, the task parameters in the key distribution task are updated according to the sending result, and the updated key distribution task is put back into the task list of the distribution thread. Steps (2) to (3) are repeated until the key file to be sent is sent and the key distribution task is completed.

[0010] Furthermore, before step (1), the method further includes: the quantum key pool server sets a maximum bandwidth Bmax that can be occupied by key distribution for each network element device in the communication network.

[0011] Furthermore, the specific process of setting the maximum bandwidth Bmax that can be occupied by key distribution is:

[0012] First, the quantum key pool server obtains the key usage M of the network element device in the past period of time T, calculates the value of m=M / T, and obtains the key usage flow m per unit time; then pre-sets a flow multiplier I, and the maximum bandwidth Bmax=I*m.

[0013] Furthermore, allocating the key distribution task corresponding to the key distribution request to the task list of the distribution thread through the key distribution request means:

[0014] The quantum key pool server determines whether the network element device initiating the request currently has a key distribution task through the key distribution request. If so, the key distribution request is ignored; if not, the quantum key pool server searches for the key file to be sent corresponding to the key distribution request. If not, the key distribution request is ignored; if so, the total number of distribution threads is modulo-operated according to the task sequence number of the key distribution task corresponding to the key distribution request to obtain the remainder P, which is the corresponding distribution thread number; finally, the key distribution task is assigned to the task list of the distribution thread numbered P.

[0015] Furthermore, the task parameters in the key distribution task include the task sequence number, the device number DID of the network element device, the next start time Next, the next sending start position Offset and the next sending data length Len; among which, the initial value of the next start time Next is the current time value created by the key distribution task.

[0016] Furthermore, the determination of the sending bandwidth B of this key distribution task refers to:

[0017] The distribution thread obtains the minimum value MIN among the three parameters of the network element device's maximum bandwidth Bmax, link average bandwidth Bave, and current link bandwidth Bcur corresponding to this key distribution task, and uses this minimum value MIN as the sending bandwidth B of this task;

[0018] Among them, the average link bandwidth Bave is the total bandwidth provided by the quantum key pool server / the total number of links, and the total number of links is the number of all network element devices currently connected to the quantum key pool server; the current link bandwidth Bcur is the actual sending bandwidth of the link in the previous round.

[0019] Furthermore, the task parameters in the update key distribution task refer to:

[0020] The next sending start position Offset is updated to the current sending start position Offset + B*t, where B*t is the key amount sent this time;

[0021] The next time the data is sent, the length Len is updated to B*t;

[0022] The next start time Next is updated to the end time of this sending + t.

[0023] Furthermore, the task list is implemented using an ordered heap, and the list is arranged in the order of the key distribution task creation time.

[0024] The present invention has the following beneficial effects: The present invention first generates a corresponding key distribution task and a corresponding key file to be sent through a key distribution request, and then assigns the corresponding key distribution task to the task list of the distribution thread. When the key distribution task reaches the task execution time, the distribution thread of the quantum key pool server determines the sending bandwidth B of this key distribution task and uses the sending bandwidth B to send the key file to be sent within a preset time t. The present invention dynamically adjusts the sending bandwidth B of the key distribution task through the quantum key pool server, thereby completing the key file distribution operation without crowding out the service processes of the network element device. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a schematic diagram of the classification of network element devices in a communication network according to the present invention;

[0026] Figure 2 A flowchart of allocating key distribution tasks to a distribution thread task list according to the present invention;

[0027] Figure 3 Schematic diagram of the process of step (3) of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described below with reference to the accompanying drawings and embodiments:

[0029] The quantum key pool server is a device that generates and distributes key files to each network element device in the communication network. It is connected to other network element devices in the communication network, including communication terminals, communication gateway devices, service servers, etc.

[0030] These network elements handle varying amounts of communication data within the communication network, and accordingly, their requirements for key files (including key file size and download speed) are also inconsistent. For example, a terminal requires far fewer key files than a service server, as a single service server can serve multiple services for multiple terminals. Consequently, a terminal requires far fewer key files than a server, and its download speed requirements are less urgent. Because service server lags can affect multiple terminals, a terminal is only responsible for its own services, and has relatively little impact on other terminals (except the receiving end).

[0031] Therefore, the quantum key pool server needs to reasonably control the key download traffic for each network element device, without affecting the device's own business execution and the key download business of other network element devices.

[0032] In view of this, the present application proposes a method for dynamically adjusting key distribution traffic, comprising the following steps:

[0033] The quantum key pool server sets the maximum bandwidth Bmax that can be occupied by key distribution for each network element device in the communication network. For example, the network element device is a terminal, so as to avoid key distribution occupying too much bandwidth and affecting the execution of normal services of the network element device.

[0034] The specific process for setting the maximum bandwidth Bmax that can be occupied by key distribution is as follows: First, the quantum key pool server obtains the key usage M of the network element device over the past period T (for example, the past day), calculates the value of m = M / T, and obtains the key usage flow m per unit time; this flow m corresponds to the flow of replenishing keys, that is, key replenishment according to this flow is likely to meet the service needs of the network element device. Then, a flow multiplier I is pre-set, for example, I = 2, and the maximum bandwidth Bmax = I * m.

[0035] Since there are many network element devices in a communication network, setting the maximum bandwidth for each network element device is bound to be time-consuming and labor-intensive. Therefore, the quantum key pool server first divides each network element device into multiple role network element groups based on at least one of the network element device's demand for keys and download speed requirements. Generally, network element devices of the same type are divided into the same role group. For example, Figure 1 As shown, the first role network element group can be a terminal network element device group, including multiple terminals such as the first terminal to the n1th terminal; the second role network element group can be a gateway network element device group, including the first gateway device to the n2th gateway device. The remaining role network element groups are similar. If a network element device meets the classification criteria of the terminal role, this network element device can be placed in the first role network element group. Then, the quantum key pool server can select one network element device from each role network element group and use the calculated maximum bandwidth Bmax of the network element device as the maximum bandwidth of each network element device in this role network element group.

[0036] (1) The quantum key pool server receives a key distribution request sent by a network element device connected to it, and generates a corresponding key distribution task and a corresponding key file to be sent according to the key distribution request; for example, the first network element device sends a first download request req1 to the quantum key pool server, and the nth network element device sends an nth download request reqn to the quantum key pool server; the quantum key pool server generates a first key distribution task in response to req1, and generates a first key file to be sent to the first network element device; the quantum key pool server generates an nth key distribution task in response to reqn, and generates an nth key file to be sent to the nth network element device, and a corresponding relationship is established between the nth key file to be sent and the nth key distribution task.

[0037] Then, the corresponding key distribution task is assigned to the task list of the distribution thread through the key distribution request, specifically: Figure 2 As shown, the quantum key pool server determines whether the network element device initiating the request currently has a key distribution task through the key distribution request. If so, the key distribution request is ignored; if not, the quantum key pool server searches for the key file to be sent corresponding to the key distribution request. If not, an error is responded to and the key distribution request is ignored; if so, the total number of distribution threads (for example, the total number of threads is 10) is modulo-operated according to the task sequence number of the key distribution task corresponding to the key distribution request to obtain the remainder P, which is the corresponding distribution thread number; finally, the key distribution task is assigned to the task list of the distribution thread numbered P. The task list is created locally by the quantum key pool server, and the key distribution task is added to the task list. Among them, the task list can be implemented using an ordered heap, and the list is arranged in order of the key distribution task creation time.

[0038] The task parameters for a key distribution task include the task sequence number, the network element device's device ID (DID), the next start time (Next), the next transmission start position (Offset), and the next transmission data length (Len). The initial value of the next start time (Next) is the current time when the key distribution task was created. The quantum key pool server executes this key distribution operation through a distribution thread numbered P.

[0039] (2) The distribution thread of the quantum key pool server takes out the key distribution task with the smallest value of the next start time Next in the task parameters of all key distribution tasks from its task list. For example, the task is the nth key distribution task. The distribution thread determines whether the value of the next start time Next in the key distribution task is the current time. If so, it proceeds to the next step; if not, it is put back into the task list and continues to wait until the task execution time to start executing the distribution task;

[0040] (3) Figure 3 As shown, the distribution thread of the quantum key pool server determines the sending bandwidth B of this key distribution task. Specifically, the distribution thread obtains the minimum value MIN of the three parameters of the maximum bandwidth Bmax, link average bandwidth Bave and current link bandwidth Bcur of the network element device corresponding to this key distribution task, and uses the minimum value MIN as the sending bandwidth B of this task.

[0041] Among them, the average link bandwidth Bave is the total bandwidth provided by the quantum key pool server / the total number of links, and the total number of links is the number of all network element devices currently connected to the quantum key pool server; the current link bandwidth Bcur is the actual sending bandwidth of the link in the previous round.

[0042] In order to prevent the key distribution task from occupying the communication bandwidth of the network element device all the time, the distribution thread presets the maximum execution time t of each task, for example, t=100ms.

[0043] Then, the distribution thread of the quantum key pool server uses the sending bandwidth B to send the key file to be sent within the preset time t. If the sending time of the key file to be sent is less than t, it means that the key file to be sent has been sent; if the sending time of the key file to be sent is equal to t, it is detected whether the key file to be sent has been sent. If there is no remaining key file to be sent, the sending is completed; if there is a remaining key file to be sent, the key file to be sent has not been sent yet and needs to be sent again. At this time, the task parameters in the key distribution task are updated according to the sending result, and the key distribution task with the updated task parameters is put back into the task list of the distribution thread. Steps (2) to (3) are repeated until the key file to be sent is sent and the key distribution task is completed.

[0044] The task parameters for the update key distribution task are:

[0045] Update the next sending start position Offset to the current sending start position Offset + B*t, where B*t is the key amount sent this time;

[0046] The next time the data is sent, the length Len is updated to B*t;

[0047] The next start time Next is updated to the end time of this sending + t, where t is the preset time.

[0048] The present invention first generates a corresponding key distribution task and a corresponding key file to be sent through a key distribution request, and then assigns the corresponding key distribution task to the task list of the distribution thread. When the key distribution task reaches the task execution time, the distribution thread of the quantum key pool server determines the sending bandwidth B of this key distribution task and uses the sending bandwidth B to send the key file to be sent within a preset time t. The present invention dynamically adjusts the sending bandwidth B of the key distribution task through the quantum key pool server, thereby completing the key file distribution operation without crowding out the service processes of the network element device.

Claims

1. A method for dynamically adjusting key distribution traffic, characterized in that: The following steps are involved: (1) The quantum key pool server receives a key distribution request from a network element device connected to it, and generates a corresponding key distribution task and a corresponding key file to be sent according to the key distribution request; Then, the corresponding key distribution task is assigned to the task list of the distribution thread through the key distribution request; (2) The distribution thread of the quantum key pool server takes out the key distribution task with the smallest value of the next start time Next in the task parameters of all key distribution tasks from its task list, and determines whether the value of the next start time Next in the key distribution task is the current time. If so, it proceeds to the next step; if not, it is put back into the task list and continues to wait until the task execution time; (3) The distribution thread of the quantum key pool server determines the sending bandwidth B of this key distribution task, and uses the sending bandwidth B to send the key file to be sent within the preset time t. If the sending time of the key file to be sent is less than t, the key file to be sent is sent; if the sending time of the key file to be sent is equal to t, it is detected whether the key file to be sent has been sent. If there is no remaining key file to be sent, the sending is completed; if there is a remaining key file to be sent, the task parameters in the key distribution task are updated according to the sending result, and the updated key distribution task is put back into the task list of the distribution thread. Steps (2) to (3) are repeated until the key file to be sent is sent and the key distribution task is completed.

2. The method for dynamically adjusting key distribution traffic according to claim 1, characterized in that: Before step (1), the method further includes: the quantum key pool server sets a maximum bandwidth Bmax that can be occupied by key distribution for each network element device in the communication network.

3. The method for dynamically adjusting key distribution traffic according to claim 2, characterized in that: The specific process of setting the maximum bandwidth Bmax that can be occupied by key distribution is: First, the quantum key pool server obtains the key usage M of the network element device in the past period of time T, calculates the value of m = M / T, and obtains the key usage flow m per unit time; A flow multiplier I is preset, and the maximum bandwidth Bmax=I*m.

4. The method for dynamically adjusting key distribution traffic according to claim 2, characterized in that: Allocating the corresponding key distribution task to the task list of the distribution thread through the key distribution request means: The quantum key pool server determines whether the network element device initiating the request currently has a key distribution task through the key distribution request. If so, the key distribution request is ignored; if not, the quantum key pool server searches for the key file to be sent corresponding to the key distribution request. If not, the key distribution request is ignored; if so, the total number of distribution threads is modulo-operated according to the task sequence number of the key distribution task corresponding to the key distribution request to obtain the remainder P, which is the corresponding distribution thread number; finally, the key distribution task is assigned to the task list of the distribution thread numbered P.

5. The method for dynamically adjusting key distribution traffic according to claim 1, characterized in that: The task parameters in the key distribution task include the task sequence number, the device number DID of the network element device, the next start time Next, the next sending start position Offset and the next sending data length Len; among which, the initial value of the next start time Next is the current time value created by the key distribution task.

6. The method for dynamically adjusting key distribution traffic according to claim 2, characterized in that: The transmission bandwidth B for determining this key distribution task is: The distribution thread obtains the minimum value MIN among the three parameters of the network element device's maximum bandwidth Bmax, link average bandwidth Bave, and current link bandwidth Bcur corresponding to this key distribution task, and uses this minimum value MIN as the sending bandwidth B of this task; Among them, the average link bandwidth Bave is the total bandwidth provided by the quantum key pool server / the total number of links, and the total number of links is the number of all network element devices currently connected to the quantum key pool server; the current link bandwidth Bcur is the actual sending bandwidth of the link in the previous round.

7. The method for dynamically adjusting key distribution traffic according to claim 5, characterized in that: The task parameters in the update key distribution task are: The next sending start position Offset is updated to the current sending start position Offset + B*t, where B*t is the key amount sent this time; The next time the data is sent, the length Len is updated to B*t; The next start time Next is updated to the end time of this sending + t.

8. The method for dynamically adjusting key distribution traffic according to claim 1, characterized in that: The task list is implemented using an ordered heap, and is arranged in the order of the key distribution task creation time.

Images