Rail transit quantum communication system data transmission method, device, system and medium

Abstract

The embodiment of the application provides a kind of rail transit quantum communication system data transmission method and device, system, medium, it is related to data transmission technical field.The method comprises: quantum key distribution is carried out by first channel;Train data encrypted by quantum key is transmitted by second channel.Adopt quantum communication double-channel isolation architecture, i.e.first channel is used for quantum key distribution, and second channel is used for transmitting encrypted data, utilizes quantum key distribution technology to realize the key distribution characteristics of information theory security based on quantum mechanics principle, physically isolates key distribution and data transmission channel, avoids the risk of key and data mixed leakage, effectively resists traditional eavesdropping and quantum computing attack, guarantees the security and integrity of train data in transmission process, provides quantum level security guarantee for train-ground communication, avoids the security incident and economic loss caused by information leakage, while ensuring the low latency and high efficiency of communication system.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, specifically to a data transmission method and apparatus, communication system, and storage medium for a quantum communication system for rail transit. Background Technology

[0002] Currently, with the deepening of the intelligentization process of rail transit, the vehicle communication networks of high-speed railways and urban rail transit are gradually breaking through the time and space limitations of information transmission, providing key support for the optimized scheduling and efficient operation of transportation networks. As the core foundation for ensuring the safe operation of trains, the real-time performance and security of vehicle-to-ground communication in railway communication systems are crucial. However, current vehicle-to-ground communication systems are facing the severe challenge that traditional encryption technologies are unable to withstand quantum computing attacks.

[0003] In related technologies, newly manufactured urban rail trains connect to the ground-based PIS (Passenger Information System) network via onboard switches, achieving vehicle-to-ground data transmission through a dedicated wireless channel of the ground-based PIS. This significantly improves security compared to public network (such as 4G / 5G) transmission methods. For retrofitted trains, vehicle-to-ground transmission equipment integrating WLAN and public network wireless transmission functions is installed to construct a topology similar to that of high-speed trains, enabling wireless transmission of vehicle status, fault information, and other data.

[0004] In the process of implementing the embodiments of this application, at least the following problems were found in the related technology:

[0005] The adoption of relevant technologies has improved the security of communication systems to some extent. However, in practical applications, when vehicles transmit data through the dedicated ground-based PIS wireless channel, the development of quantum computing technology allows attackers to leverage its powerful computing capabilities to crack traditional encryption algorithms, thereby attacking the vehicle-to-ground wireless transmission channel and seriously threatening the normal operational safety of trains. Summary of the Invention

[0006] This application provides a data transmission method and apparatus, a communication system, and a storage medium for a rail transit quantum communication system.

[0007] The first aspect of this application provides a data transmission method for a rail transit quantum communication system, comprising:

[0008] Quantum key distribution is performed via the first channel;

[0009] Train data encrypted with quantum keys is transmitted via a second channel.

[0010] In an optional embodiment of this application, quantum key distribution is performed through a first channel, including:

[0011] Generate the first quantum key corresponding to the vehicle attributes;

[0012] The secure cryptographic carrier is encrypted by transmitting the first quantum key through the first channel.

[0013] In an optional embodiment of this application, before performing quantum key distribution through the first channel, the method further includes:

[0014] Quantum keys are pre-loaded into secure cryptographic carriers using quantum key injection devices.

[0015] In an optional embodiment of this application, transmitting quantum-key-encrypted train data via a second channel includes:

[0016] The secure cryptographic carrier is encrypted using the quantum key transmitted through the first channel, rendering the secure cryptographic carrier unusable.

[0017] The secure cryptographic carrier is decrypted using a quantum-secure gateway, making it usable.

[0018] When the decrypted secure cryptographic carrier is inserted into the vehicle-to-ground wireless communication device, the train data is encrypted using the quantum key pre-installed in the secure cryptographic carrier, and the encrypted train data is transmitted.

[0019] In an optional embodiment of this application, the train data is encrypted using a quantum key pre-stored in a secure cryptographic carrier, including:

[0020] The train data is symmetrically encrypted using a national cryptographic algorithm by reading the quantum key pre-installed in the secure cryptographic carrier through a vehicle-to-ground wireless communication device.

[0021] In an optional embodiment of this application, the data transmission method for a rail transit quantum communication system further includes:

[0022] The ground security gateway receives encrypted train data and performs traffic filtering and access control to block unauthorized requests.

[0023] The ground decryption server is used to parse the key address in the encrypted train data and apply to the quantum cryptography service platform for the corresponding decryption quantum key;

[0024] After verifying the legitimacy of the key address using the quantum cryptography service platform, the decryption quantum key is sent to the ground decryption server.

[0025] The ground decryption server decrypts the encrypted train data using a quantum key based on the national cryptographic algorithm, and then transmits the decrypted train data to the ground business system for analysis and processing.

[0026] In an optional embodiment of this application, the data transmission method for a rail transit quantum communication system further includes:

[0027] The quantum cryptography service platform uses a first channel to distribute periodically generated new quantum keys to each node of the communication system, enabling dynamic updates of the quantum keys at each node; the nodes include vehicle-to-ground wireless communication devices and / or ground decryption servers.

[0028] A second aspect of this application provides a data transmission device for a quantum communication system for rail transit, including a processor and a memory storing program instructions. The processor is configured to execute the data transmission method for a quantum communication system for rail transit as described in the first aspect of this application when running the program instructions.

[0029] A third aspect of this application provides a communication system, including:

[0030] The communication system itself; and,

[0031] As in the second aspect of the embodiments of this application, the data transmission device for a quantum communication system for rail transit is installed on the main body of the communication system.

[0032] A fourth aspect of the embodiments of this application provides a computer-readable storage medium storing program instructions that, when executed, cause a computer to perform a traffic control method as described in the first aspect of the embodiments of this application.

[0033] The data transmission method, apparatus, communication system, and storage medium for the rail transit quantum communication system provided in this application have the following advantages:

[0034] This application embodiment performs quantum key distribution through a first channel and transmits quantum-encrypted train data through a second channel. It employs a dual-channel isolation architecture for quantum communication: the first channel is dedicated to quantum key distribution, and the second channel is dedicated to transmitting encrypted data. Utilizing the quantum key distribution technology's theoretically secure key distribution characteristics based on quantum mechanics principles, the key distribution and data transmission channels are physically isolated, avoiding the risk of key and data mixing and leakage. This effectively resists traditional eavesdropping and quantum computing attacks, ensuring the security and integrity of train data during transmission, providing quantum-level security for vehicle-to-ground communication, preventing security incidents and economic losses due to information leakage, and ensuring low latency and high efficiency of the communication system. Attached Figure Description

[0035] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0036] Figure 1 This is a schematic diagram of the overall architecture of a communication system provided in an embodiment of this application;

[0037] Figure 2 This is a schematic diagram of a data transmission method for a quantum communication system in rail transit provided in an embodiment of this application;

[0038] Figure 3 This is a schematic diagram of a data transmission device for a quantum communication system for rail transit provided in an embodiment of this application.

[0039] Figure label:

[0040] 800: Data transmission device for quantum communication system in rail transit; 801: Processor; 802: Memory; 803: Communication interface; 804: Bus. Detailed Implementation

[0041] To make the technical solutions and advantages of the embodiments of this application clearer, the exemplary embodiments of this application will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not an exhaustive list of all embodiments. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other.

[0042] QKD (Quantum Key Distribution) technology, based on the principles of quantum mechanics, can achieve theoretically secure key distribution, making it a potential solution to this challenge. Furthermore, quantum encrypted communication exhibits superior performance in key distribution efficiency, anti-eavesdropping capabilities, and low-latency communication, thus avoiding security incidents and economic losses caused by information leakage and providing quantum-level security for vehicles against external attacks. Existing research largely focuses on the application of QKD in fiber optic networks, but issues such as dynamic key management, multi-domain synchronization, and hardware integration in mobile scenarios (such as train-to-ground communication) remain largely unresolved.

[0043] Combination Figure 1As shown in the embodiments of this application, a communication system is proposed, including a quantum key generation and management terminal, a quantum cryptography service platform, a quantum security gateway, a secure cryptographic carrier, a vehicle-mounted communication terminal, a ground data processing unit, and a dual-channel physical layer. The quantum key generation and management terminal is deployed on the ground and generates quantum keys through a quantum key distribution network. The quantum cryptography service platform is connected to the quantum key generation and management terminal and includes key management, authentication, and dynamic update modules. The quantum security gateway is connected to the quantum cryptography service platform and performs secondary encryption and decryption operations on a super SIM card. The secure cryptographic carrier uses a super SIM card and is pre-installed with quantum keys and digital certificates. The vehicle-mounted communication terminal includes vehicle-to-ground wireless communication equipment that supports super SIM card insertion and data encryption. The ground data processing unit includes a ground security gateway, an aggregation switch, and a decryption server connected in sequence. The dual-channel physical layer includes a physically isolated first channel and a second channel. The first channel is dedicated to quantum key distribution, and the second channel is dedicated to transmitting train service data encrypted using national cryptographic algorithms. The communication system also includes a processor electrically connected to each of the above modules for controlling the modules to perform the aforementioned actions. The quantum key generation and management terminal connects to the quantum cryptography service platform through the first channel. The platform connects to the quantum security gateway through a bidirectional communication link. The quantum security gateway reads and writes key data in the super SIM card through a physical interface. The activated super SIM card is inserted into the vehicle-to-ground wireless communication device in a detachable manner. The vehicle-to-ground wireless communication device connects wirelessly to the ground security gateway through the second channel and connects to the decryption server through the aggregation switch. The decryption server connects to the quantum cryptography service platform through a bidirectional communication interface. In the redundant fault-tolerant architecture, the two vehicle-to-ground wireless communication devices in the front and rear carriages are interconnected through a data synchronization bus. The dual super SIM cards in a single device are switched and connected through a hot standby control circuit.

[0044] Specifically, the quantum key generation and management terminal generates a quantum key and transmits it to the quantum cryptography service platform via the first channel. After the quantum cryptography service platform injects the key into the super SIM card, the quantum security gateway performs secondary encryption on the super SIM card according to the vehicle model differentiation strategy. The encrypted super SIM card is physically transported to the train, decrypted and activated by the quantum security gateway, and then inserted into the vehicle-to-ground wireless communication equipment. The vehicle-to-ground wireless communication equipment collects train operation data, reads the quantum key from the super SIM card, and encrypts the data using the national cryptographic algorithm. After adding a key tag containing the vehicle's identity identifier to the encrypted data, it is sent to the ground security gateway via the second channel. The ground security gateway intercepts illegal data streams based on a whitelist mechanism and sends the data to the decryption server via the aggregation switch. The decryption server parses the key tag and requests a decryption key from the quantum cryptography service platform. After verifying the identity's legitimacy, the quantum cryptography service platform issues the decryption key, and the decryption server decrypts the data and transmits it to the ground business system. When a super SIM card malfunction is detected, the equipment on the front and rear vehicles achieves millisecond-level master / slave switching via the data synchronization bus, or calls a recently cached key locally to continue encryption, while simultaneously requesting a short-term temporary key from the platform until a new card is replaced.

[0045] Any of the following data transmission methods for a quantum communication system for rail transit provided in this application can be executed in the communication system, or in a server or terminal device that is connected to the communication system.

[0046] Based on the above-mentioned communication system structure, such as Figure 2 As shown in the figure, this application provides a data transmission method for a rail transit quantum communication system, including:

[0047] S21, quantum key distribution is performed through the first channel.

[0048] S22 transmits train data encrypted with quantum keys through a second channel.

[0049] In this embodiment of the disclosure, the first channel refers to a dedicated path at least used for quantum key distribution, such as a key transmission link from a quantum key generation and management terminal to nodes such as a quantum cryptography service platform and a quantum security gateway. The second channel refers to a dedicated path at least used for encrypted train data transmission, such as an encrypted data transmission link from a vehicle-to-ground wireless communication device to a ground security gateway.

[0050] In this embodiment, a quantum key generation and management terminal is deployed at a railway communication center and connected to a quantum cryptography service platform along the railway line via a quantum channel. The quantum key generation and management terminal periodically generates quantum keys and distributes them to the quantum cryptography service platforms at each station via the quantum channel. Each station's quantum cryptography service platform injects the received quantum key into a super SIM card and performs secondary encryption on the super SIM card through a quantum security gateway. The encrypted super SIM card is transported to the train maintenance center, where professionals decrypt it and insert it into the train's ground-to-train wireless communication equipment. During train operation, the train-to-train wireless communication equipment collects train operation data, such as speed, location, and fault information, and uses the quantum key in the super SIM card combined with the national cryptographic SM4 algorithm to perform symmetric encryption on the data. The encrypted data is transmitted to the ground security gateway via a classical channel (such as a 4G / 5G network). The ground security gateway performs traffic filtering and access control on the received data, blocking illegal requests, and then forwards the data to the decryption server via a convergence switch. The decryption server parses the key address in the data and requests the corresponding decryption quantum key from the quantum cryptography service platform. After verifying the legality of the key address, the quantum cryptography service platform issues the decryption key to the decryption server. The decryption server uses the key to decrypt the encrypted data and transmits the decrypted data to the ground-based business system for analysis and processing. In other embodiments, the quantum key generation and management terminal is deployed in the metro control center and connected to the quantum cryptography service platform of each station via a quantum channel. The quantum key generation and management terminal generates a quantum key and distributes the key to the quantum cryptography service platform of each station via the quantum channel. Each station's quantum cryptography service platform injects the quantum key into a super SIM card and performs secondary encryption on the super SIM card through a quantum security gateway. The encrypted super SIM card is transported to the metro depot, where professionals decrypt it and insert it into the train's vehicle-to-ground wireless communication device (WTD). When the metro train is running, the WTD device collects the train's operating data, such as door status, traction system status, and braking system status, and uses the quantum key in the super SIM card combined with the national cryptographic SM4 algorithm to perform symmetric encryption on the data. The encrypted data is transmitted to the ground security gateway via a classical channel (such as a WLAN network). The ground security gateway performs traffic filtering and access control on the received data, blocks illegal requests, and forwards the data to the decryption server via a ground aggregation switch. The decryption server parses the key address from the data and requests the corresponding decryption quantum key from the quantum cryptography service platform. After verifying the validity of the key address, the quantum cryptography service platform issues the decryption key to the decryption server. The decryption server uses this key to decrypt the encrypted data and transmits the decrypted data to the ground-based operational system for analysis and processing.

[0051] The data transmission method for a quantum communication system in rail transit provided in this application involves quantum key distribution through a first channel and transmission of quantum-encrypted train data through a second channel. A dual-channel isolation architecture for quantum communication is employed: the first channel is dedicated to quantum key distribution, and the second channel is dedicated to transmitting encrypted data. Utilizing the quantum key distribution technology's theoretically secure key distribution characteristics based on quantum mechanics principles, the key distribution and data transmission channels are physically isolated, avoiding the risk of key and data leakage. This effectively resists traditional eavesdropping and quantum computing attacks, ensuring the security and integrity of train data during transmission, providing quantum-level security for vehicle-to-ground communication, preventing security incidents and economic losses due to information leakage, and ensuring low latency and high efficiency of the communication system.

[0052] Optionally, quantum key distribution is performed through the first channel, including: generating a first quantum key corresponding to the vehicle attributes; and encrypting the secure cryptographic carrier by transmitting the first quantum key through the first channel.

[0053] In this embodiment, the quantum key generation and management terminal uses the vehicle identification number and the vehicle-to-ground wireless communication device serial number as input parameters to generate a unique key string, i.e., the first quantum key, through a quantum random number generator. The first quantum key is strongly bound to a specific train identity. Subsequently, the quantum key generation and management terminal transmits the first quantum key to the quantum cryptography service platform via a dedicated quantum key distribution network. The cryptography service platform invokes the encryption module to perform encrypted writing operations on the storage area of ​​the super SIM card using the first quantum key, placing the key data within the secure cryptographic carrier in an encrypted and locked state, thus achieving physical isolation protection of the secure cryptographic carrier during the key distribution stage. In other embodiments, after receiving the first quantum key from the quantum key generation and management terminal, the quantum cryptography service platform extracts the vehicle production batch number and equipment model identifier associated with the first quantum key to generate a composite key tag. The quantum cryptography service platform transmits the first quantum key and composite key tag to the offline key injection workstation through the first channel. The offline key injection workstation uses a hardware encryption engine to write the first quantum key and composite key tag together into the security chip of the super SIM card, and performs quantum key encryption on the key access interface of the security chip of the super SIM card. This enables the secure cryptographic carrier to complete the dual binding encryption of quantum key and device attributes during the pre-installation stage, blocking the risk of unauthorized devices reading the data.

[0054] In this way, a first quantum key corresponding to the vehicle's attributes is generated, creating a strong binding relationship between the key and a specific vehicle identity (such as the vehicle identification number and device serial number), ensuring the device exclusivity of the key distribution from the outset. This key is transmitted through a first channel while encrypting the secure cryptographic carrier. Utilizing the physical isolation characteristic of the quantum channel, encryption protection is implemented on the carrier during the key distribution stage, blocking eavesdropping or tampering attacks on the secure cryptographic carrier during transmission. This dual-mechanism collaboratively ensures the security of the key during generation and transmission, establishing an unforgeable device identity authentication foundation for subsequent vehicle-to-ground encrypted communication, effectively solving the technical challenge of reliably binding keys and devices in complex network environments.

[0055] Optionally, before distributing quantum keys through the first channel, the method further includes: pre-loading the quantum key into a secure cryptographic carrier using a quantum key injection device.

[0056] In this embodiment, the quantum key injection device connects to the quantum cryptography service platform via a physically isolated hardware interface and receives quantum key data packets from the platform. The device parses the vehicle identification number (VIN) and device serial number from the data packet, writes the matching quantum key into the quantum key storage area of ​​the super SIM card, and simultaneously activates the hardware-level access lock of the security chip, ensuring the key can only be read through authorized decryption operations. In other embodiments, for super SIM card replacement scenarios, authorized personnel operate an offline quantum key injection device to connect to a local key backup library. The device automatically identifies the vehicle attribute information corresponding to the faulty card, extracts the three most recently used quantum keys for that vehicle from the backup library, and synchronously injects them into the secure storage partition of the new super SIM card using a sharding writing technique. After pre-installation, the device generates a key binding certificate and burns it into the read-only area of ​​the card, achieving seamless binding between the new carrier and the original vehicle identity.

[0057] In this way, by using a quantum key injection device to pre-install the quantum key into a secure cryptographic carrier in a physically isolated environment, the network transmission risks during the initial key distribution are avoided from the outset. This offline pre-installation establishes a hardware-level binding relationship between the device and the key, ensuring that the secure cryptographic carrier possesses an unforgeable device identity certificate before deployment. This eliminates the risk of eavesdropping or man-in-the-middle attacks during the initial trust establishment phase before the key is activated. This mechanism provides a verifiable trust anchor for the quantum key distribution process, ensuring that the security of subsequent first-channel key transmission is based on the reliable authenticity of the device's identity.

[0058] Optionally, transmitting train data encrypted with a quantum key via a second channel includes: encrypting the secure cryptographic carrier using the quantum key transmitted through the first channel, rendering the secure cryptographic carrier unusable; decrypting the secure cryptographic carrier using a quantum security gateway, rendering the secure cryptographic carrier usable; and when the decrypted secure cryptographic carrier is inserted into the vehicle-to-ground wireless communication device, encrypting the train data using the quantum key pre-installed in the secure cryptographic carrier, and transmitting the encrypted train data.

[0059] In this embodiment, the quantum security gateway receives the quantum key distributed by the quantum cryptography service platform via a quantum channel and processes the key using a dedicated encryption algorithm library for high-speed rail models. The processed encryption command is written to the super SIM card control module, activating the card's hardware locking mechanism to render the secure cryptographic carrier unusable. When an authorized person inserts the encrypted super SIM card into the dedicated interface of the quantum security gateway, the gateway verifies the device's digital certificate and performs a quantum-level decryption operation, removing the functional restrictions on the secure cryptographic carrier. When the secure cryptographic carrier is inserted into the card slot of the vehicle-to-ground wireless communication device, the device's security chip automatically reads the pre-installed quantum key, encrypts the real-time collected train positioning data using the national cryptographic algorithm, and sends the encrypted data packet via the wireless transmission module. In other embodiments, the quantum cryptography service platform transmits the metro-specific quantum key to the quantum security gateway via a quantum channel. After converting the key format using the metro encryption strategy, the quantum security gateway performs a quantum state writing operation on the super SIM card's key storage area, triggering the physical locking function of the security chip. In the train maintenance depot, the operator places the locked super SIM card into the quantum security gateway's decryption terminal, which then completes the super SIM card decryption and activation via a two-way authentication protocol. After the Super SIM card is installed in the vehicle-to-ground wireless communication device, the device uses the pre-installed key on the Super SIM card to encrypt the speed sensor data in real time. The encrypted data stream is then transmitted to the ground via a dedicated wireless channel.

[0060] In this way, the secure cryptographic carrier is encrypted using the quantum key transmitted through the first channel, rendering it unusable and preventing unauthorized access during transportation through physical isolation. Then, authorized decryption via the quantum security gateway restores the secure cryptographic carrier to a usable state, achieving dual access control during the key activation phase. When the decrypted secure cryptographic carrier is inserted into the vehicle-to-ground wireless communication device, the pre-installed quantum key is used to encrypt data, ensuring that the key remains in a hardware-level secure environment throughout the entire process from storage to use. By establishing dynamic encryption and decryption barriers during key distribution and device activation, the risk of key leakage during transportation and storage is eliminated, while mandatory secondary authentication is required before device use, providing end-to-end security for vehicle-to-ground communication.

[0061] Optionally, the train data is encrypted using a quantum key pre-stored in the secure cryptographic carrier, including: reading the quantum key pre-installed in the secure cryptographic carrier using a vehicle-to-ground wireless communication device, and symmetrically encrypting the train data using a national cryptographic algorithm.

[0062] In this embodiment, the vehicle-to-ground wireless communication device reads the pre-installed quantum key on the super SIM card through the security chip interface, extracts the key, and calls the built-in national cryptographic algorithm encryption engine. The vehicle-to-ground wireless communication device divides the real-time operating status data collected by the train into data blocks, and uses the quantum key as the national cryptographic algorithm symmetric encryption key to encrypt the data content block by block. During the encryption process, a key identifier and a timestamp are added, and after generating a complete encrypted data packet, it is sent through the wireless transmission module. In other embodiments, when the vehicle-to-ground wireless communication device detects that the primary super SIM card has failed, it automatically switches to the backup card slot to read the pre-installed quantum key in the backup super SIM card. The security processing unit of the vehicle-to-ground wireless communication device calls the national cryptographic algorithm library and combines it with the current key to perform real-time frame-by-frame encryption processing on the train positioning data stream. Each data frame is added with a frame check sequence and an encryption protocol header to form an encrypted message that conforms to the wireless transmission protocol and is continuously sent to the ground receiving end.

[0063] In this way, the vehicle-to-ground wireless communication equipment directly reads the quantum key pre-installed in the secure cryptographic carrier. Hardware-level isolation mechanisms prevent the key from being intercepted by unauthorized programs during the reading process. Then, national cryptographic algorithms are used to symmetrically encrypt the train data. Combining the unbreakability of the quantum key with the independent controllability of national cryptographic standard algorithms, the encryption strength is guaranteed while meeting the safety and compliance requirements of the rail transit sector. Through the synergy of the hardware carrier and national cryptographic algorithms, the risks of key leakage and algorithm cracking during encryption are reduced, providing vehicle-to-ground communication with data protection capabilities that balance efficiency and security.

[0064] Optionally, the data transmission method of the rail transit quantum communication system further includes: receiving encrypted train data using a ground security gateway and performing traffic filtering and access control to block illegal requests; parsing the key address in the encrypted train data using a ground decryption server and applying for the corresponding decryption quantum key from the quantum cryptography service platform; verifying the legality of the key address using the quantum cryptography service platform and then issuing the decryption quantum key to the ground decryption server; enabling the ground decryption server to decrypt the encrypted train data based on the national cryptographic algorithm using the decryption quantum key, and transmitting the decrypted train data to the ground business system for analysis and processing.

[0065] In this embodiment, the ground security gateway receives encrypted data streams from vehicle-to-ground wireless communication devices and filters the data source addresses using a pre-set access control policy, blocking illegal data requests from unauthorized devices. The ground decryption server parses the key address field in the encrypted data packet header, extracts the vehicle identification number and device serial number combination identifier, and submits a decryption key application to the quantum cryptography service platform. The quantum cryptography service platform verifies the consistency of this combination identifier with the pre-stored device whitelist; upon successful verification, it issues the corresponding decryption quantum key via the quantum channel. The ground decryption server uses this key in conjunction with the national cryptographic algorithm decryption engine to restore the plaintext data, which is then transmitted to the ground operation monitoring system for real-time analysis after data verification. In other embodiments, when encrypted train data arrives at the ground security gateway, the ground security gateway activates the traffic shaping module to block high-frequency abnormal access requests, allowing only data packets carrying valid quantum encryption protocol identifiers to pass. The ground decryption server extracts the key index code from a specific position in the data frame and initiates a digitally signed key application request to the quantum cryptography service platform. After verifying the vehicle registration status associated with the index code and the key validity period, the quantum cryptography service platform returns the decryption quantum key transmitted via the encrypted channel to the decryption server. The decryption server uses this key to perform reverse calculations of the national cryptographic algorithm, recovers the original train operation data, and pushes it to the ground fault diagnosis system for automated processing.

[0066] In this way, after receiving encrypted data, the ground security gateway performs traffic filtering and access control, effectively intercepting illegal requests and attack traffic in the public network environment and reducing security threats to the data transmission channel. The ground decryption server parses the key address in the encrypted data and requests a decryption key from the quantum cryptography service platform. Through a precise matching mechanism between the key address and the vehicle identification, the legitimacy of the decryption key request is ensured. After verifying the legitimacy of the key address, the quantum cryptography service platform issues the decryption key. The ground decryption server completes the decryption operation based on the national cryptographic algorithm, forming a closed-loop control process of key application, verification, and issuance. Multi-layered collaborative verification enhances the security and reliability of the decryption process, while the application of the national cryptographic algorithm ensures decryption efficiency and compliance, providing a reliable data source for the ground business system.

[0067] Optionally, the data transmission method of the rail transit quantum communication system further includes: using a quantum cryptography service platform to distribute periodically generated new quantum keys to each node of the communication system through a first channel, thereby realizing dynamic updates of the quantum keys of each node; wherein, the nodes include vehicle-to-ground wireless communication equipment and / or ground decryption servers.

[0068] In this embodiment, after the quantum cryptography service platform detects the arrival of the preset key update cycle, it instructs the quantum key generation and management terminal to generate a new quantum key string. The quantum cryptography service platform distributes this key to the security chip of the vehicle-to-ground wireless communication device via a quantum channel. After receiving the key, the vehicle-to-ground wireless communication device automatically replaces the contents of the old key storage area and updates its local key version index, completing the dynamic update of the vehicle node key. In other embodiments, when the quantum cryptography service platform detects an abnormal bit error rate in the quantum channel transmission, it immediately triggers an emergency key update process. The quantum cryptography service platform control terminal generates a backup quantum key and distributes it synchronously to the ground decryption server's key pool and the vehicle-to-ground wireless communication device via the quantum channel. The decryption server writes the new key to the active storage partition, and the vehicle-to-ground device switches encryption modules and calls the interface to achieve seamless key rotation across all nodes.

[0069] In this way, the quantum cryptography service platform periodically distributes new quantum keys to all nodes of the communication system, including vehicle-to-ground wireless communication devices and ground decryption servers, through a first channel. This utilizes the dynamic rotation mechanism of quantum keys to reduce the probability of the same key being compromised due to prolonged use. Transmitting new keys through the first channel ensures the security of the key update process itself. After all nodes synchronously update their keys, even if some historical keys are leaked, the security of subsequent encrypted communications can still be ensured. The periodic key updates and the physical isolation of the quantum channel enhance the vehicle-to-ground communication system's continuous defense against quantum computing attacks.

[0070] Optionally, the vehicle-to-ground wireless communication devices installed in the first and second carriages are designated as the main device and the backup device, respectively. The main device and the backup device perform heartbeat monitoring through a data synchronization bus. When the main device fails to respond for a set number of consecutive times, it is determined that the security password carrier corresponding to the main device is faulty, and the backup device takes over the encrypted transmission function undertaken by the main device.

[0071] In this embodiment, when the secure password carrier fails, the vehicle-to-ground wireless communication equipment in the first and last carriages monitors the heartbeat via a data synchronization bus. When the primary device in the first carriage fails to respond for a set number of consecutive times, a switching mechanism is triggered, and the backup device in the last carriage takes over the encrypted transmission function. Specifically, the vehicle-to-ground wireless communication equipment in the first carriage, acting as the primary device, continuously sends heartbeat signals via the data synchronization bus, while the vehicle-to-ground wireless communication equipment in the last carriage, acting as the backup device, monitors the heartbeat signals sent by the primary vehicle-to-ground wireless communication equipment in real time. When the backup device detects that the primary device's heartbeat signal has been lost for a set number of consecutive times, it immediately activates its own encrypted transmission module to take over the data transmission function. The backup device reads the pre-installed quantum key on its local super SIM card and seamlessly takes over the encryption and transmission tasks of the train operation data undertaken by the primary device. In other embodiments, the primary and backup vehicle-to-ground wireless communication equipment establishes a two-way status monitoring channel via a data synchronization bus. The primary device periodically sends heartbeat data packets containing encrypted status codes, and the backup device verifies the validity of the status codes. When the backup device receives invalid status codes a set number of times, it automatically switches to become the working host, activates its wireless communication module and security chip, and calls the quantum key in the super SIM card corresponding to the backup device to continue the encrypted transmission of train data.

[0072] In this way, when the super SIM card fails, the train-to-ground wireless communication equipment in the front and rear carriages monitors the heartbeat via the data synchronization bus. If the primary device fails to respond a set number of times, a switching mechanism is triggered, utilizing a device-level hardware redundancy architecture to achieve millisecond-level primary / backup switching. By having a physically isolated backup device take over the encrypted transmission function in real time, the risk of communication interruption due to single-point failures is effectively avoided, enhancing the continuous operation capability of the train-to-ground communication system. The dual-device collaborative working mode ensures that quantum-encrypted transmission continues even when core safety components fail, providing uninterrupted security for critical train operation data.

[0073] Optionally, when the secure cryptographic carrier fails and / or there is no available backup device, the system can call upon the most recently set number of quantum keys cached in the local secure chip of the vehicle-to-ground wireless communication device to continue encrypting the train data, and apply to the quantum cryptography service platform for a temporary quantum key with a validity period of less than the set duration for subsequent encryption or decryption operations.

[0074] In this embodiment, when the vehicle-to-ground wireless communication device detects a failure to read the super SIM card key, it immediately activates the most recently available quantum key group cached in the local security chip. The vehicle-to-ground wireless communication device automatically calls the latest valid key in this key group and performs continuous encryption operations on the real-time train operation data in conjunction with the national cryptographic algorithm. Simultaneously, the vehicle-to-ground wireless communication device sends a temporary key request to the quantum cryptography service platform through the encrypted communication link. After responding, the cryptography service platform generates and distributes a short-term valid quantum key for subsequent encryption. In other embodiments, when a hardware failure of the super SIM card causes an interruption in quantum key access, the security processing unit of the vehicle-to-ground wireless communication device automatically switches to the key cache area. The vehicle-to-ground wireless communication device calls several recently stored quantum key groups in reverse chronological order and uses a polling mechanism to select an available key to encrypt and encapsulate the vehicle speed data. A temporary key request protocol is triggered synchronously. After verifying the device's identity, the quantum cryptography service platform distributes a time-limited quantum key. Upon receiving the key, the vehicle-to-ground wireless communication device immediately applies it to the encryption processing of new data packets.

[0075] In this way, when the vehicle-to-ground wireless communication device detects a failure of the super SIM card, it uses the most recently set number of quantum keys cached in the local security chip to continue encrypting data, providing a buffer period for emergency communication through a hardware-level key caching mechanism. Simultaneously, it requests temporary quantum keys with a validity period shorter than the set duration from the quantum cryptography service platform, utilizing the platform's centralized management capabilities to securely supply short-term keys. This maintains the continuity of encrypted transmission while reducing the risk of long-term key exposure through the time-limited nature of the temporary keys, enhancing the system's adaptive recovery capability against hardware failures while ensuring uninterrupted vehicle-to-ground communication.

[0076] Optionally, based on the vehicle model, the corresponding encryption algorithm library is invoked to process the original quantum key issued by the quantum key generation and management terminal, thereby generating the first quantum key corresponding to the vehicle model.

[0077] In this embodiment, the quantum security gateway employs a vehicle-specific encryption strategy for the secondary encryption of the secure cryptographic carrier. For high-speed rail vehicles, it calls a first encryption algorithm library to process the original quantum key issued by the quantum key generation and management terminal, generating a first quantum key corresponding to the high-speed rail vehicle. For subway vehicles, it calls a second encryption algorithm library to process the original quantum key, generating a first quantum key corresponding to the subway vehicle. Specifically, after receiving the original quantum key issued by the quantum key generation and management terminal, the quantum security gateway calls a pre-set first encryption algorithm library for processing for high-speed rail vehicles. The algorithm library extracts the high-speed rail-specific equipment feature code and performs a composite operation with the original key to generate a first quantum key corresponding to the high-speed rail vehicle. This high-speed rail-specific encryption key is written to the super SIM card control module through a first channel, achieving binding with the encryption strategy of the high-speed rail system. When processing the subway vehicle scenario, the quantum security gateway activates the key conversion engine in the second encryption algorithm library. The engine performs a nonlinear transformation on the original quantum key and the subway equipment type identifier to generate a first quantum key corresponding to the subway vehicle. The converted subway-specific encryption key string is written to the designated storage area of ​​the super SIM card through the first channel, completing the implementation of the differentiated encryption strategy for subway vehicles.

[0078] In this way, the quantum security gateway uses differentiated encryption algorithm libraries to process the raw quantum key for different vehicle models, generating a unique encryption key through vehicle-specific encryption strategies. By leveraging the differences in hardware characteristics and security requirements of different vehicle models, the combination and matching of encryption algorithms and key lengths are optimized, ensuring the inherent security of the quantum key while improving the adaptability of the encryption strategy to the actual operating environment of the vehicle. Differentiated processing reduces the performance loss or security redundancy caused by a unified encryption scheme, achieving a balance between security and efficiency in complex multi-vehicle communication systems.

[0079] Optionally, the key address parsed by the decryption server contains a combination of vehicle identification number and device serial number. The quantum cryptography service platform verifies that the combination of identifiers matches the pre-stored device whitelist before issuing the decryption quantum key.

[0080] In this embodiment, the ground decryption server parses the header fields of the encrypted data packet and extracts a combined identifier of the vehicle identification number (VIN) and the vehicle-to-ground wireless communication device serial number. The decryption server encapsulates this combined identifier into a key request request and sends it to the quantum cryptography service platform via a secure channel. The quantum cryptography service platform searches a pre-stored device whitelist database, verifies that the combined identifier completely matches the registered device information, and then sends the corresponding decryption quantum key to the decryption server via a quantum channel. In other embodiments, when the ground decryption server processes encrypted train data, it reads a concatenated string of the VIN and device hardware serial number from a fixed offset position in the data frame. The decryption server submits a key request instruction containing this string to the quantum cryptography service platform. The quantum cryptography service platform calls the device authentication module to verify whether the concatenated string exists in the valid device whitelist. After confirmation, it generates an encrypted response message, which encapsulates the target decryption quantum key and returns it to the decryption server.

[0081] In this way, when the decryption server parses the key address in the encrypted data, it extracts a combined identifier of the vehicle identification number and the device serial number, and accurately identifies the device through a dual hardware identifier binding mechanism. The quantum cryptography service platform verifies the consistency of this combined identifier with a pre-stored device whitelist, ensuring that the decryption key is only distributed to authorized devices. By using the immutable device hardware identifier to build the verification foundation, it is possible to effectively prevent unauthorized devices from obtaining decryption privileges by forging a single code, improve the reliability of identity authentication in the vehicle-to-ground communication system, and provide a traceable device trust chain for secure key distribution in complex network environments.

[0082] Optionally, the Super SIM card is pre-installed offline with an initial quantum key and digital certificate via a physically isolated dedicated device. The pre-installation process is completed in a closed environment, and each Super SIM card establishes a hardware-level binding relationship with a specific vehicle-to-ground wireless communication device.

[0083] In this embodiment, the quantum key injection device connects to an offline key database within an electromagnetically shielded room to extract the initial quantum key and digital certificate data packet of the target vehicle. The quantum key injection device writes the data to the secure storage area of ​​the super SIM card via a dedicated interface, and simultaneously burns the physical serial number of the vehicle-to-ground wireless communication device into the read-only area of ​​the card, achieving a non-removable hardware-level binding between the super SIM card and the specific communication device. In other embodiments, authorized personnel activate the offline pre-installation system in a closed operating console. The offline pre-installation system reads the hardware identification code of the vehicle-to-ground wireless communication device to be bound, and generates a composite data block by combining it with the initial quantum key pre-stored on the quantum cryptography service platform. The data block is written to the super SIM card's secure chip via a physically isolated card writing device, and a device binding identifier is engraved in the chip's fuse area, completing the lifelong hardware-level association between the card and the device.

[0084] In this way, the Super SIM card is pre-installed offline with the initial quantum key and digital certificate in a closed environment via a physically isolated dedicated device, which can isolate the threat of network attacks to the initial key distribution process from the source. Simultaneously, each Super SIM card establishes a hardware-level binding relationship with a specific vehicle-to-ground wireless communication device, using the device's unique physical identifier (such as a security chip serial number) to achieve an uncopyable identity authentication foundation. This mechanism, through the dual protection of physical isolation and hardware binding, significantly reduces the risk of tampering and forgery during the key initialization phase, providing a verifiable root of trust for the quantum key distribution system and ensuring that the security of subsequent communication processes is based on reliable device identity authentication.

[0085] Combination Figure 3 As shown, this application provides a data transmission device 800 for a rail transit quantum communication system, including a processor 801 and a memory 802. Optionally, the device may further include a communication interface 803 and a bus 804. The processor 801, communication interface 803, and memory 802 can communicate with each other via the bus 804. The communication interface 803 can be used for information transmission. The processor 801 can call logical instructions in the memory 802 to execute the data transmission method for the rail transit quantum communication system described in the above embodiment.

[0086] Furthermore, the logic instructions in the aforementioned memory 802 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0087] The memory 802, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this application. The processor 801 executes functional applications and data processing by running the program instructions / modules stored in the memory 802, thereby realizing the data transmission method of the rail transit quantum communication system in the above embodiments.

[0088] The memory 802 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 802 may include high-speed random access memory and may also include non-volatile memory.

[0089] This application provides a communication system, including a communication system body and the aforementioned rail transit quantum communication system data transmission device 800. The rail transit quantum communication system data transmission device 800 is installed on the communication system body. The installation relationship described herein is not limited to placement within the communication system, but also includes installation connections with other components of the communication system, including but not limited to physical connections, electrical connections, or signal transmission connections. Those skilled in the art will understand that the rail transit quantum communication system data transmission device 800 can be adapted to feasible communication system bodies to achieve other feasible embodiments.

[0090] This application provides a computer-readable storage medium storing computer-executable instructions configured to execute the above-described data transmission method for a quantum communication system for rail transit.

[0091] The technical solutions of this application embodiment can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this application embodiment. The aforementioned storage medium can be a non-transitory storage medium, including: USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, and other media capable of storing program code.

[0092] The technical solutions of this application embodiment can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this application embodiment. The aforementioned storage medium can be a non-transitory storage medium, including: USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, and other media capable of storing program code.

[0093] The foregoing description and accompanying drawings fully illustrate embodiments of this application to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in this application is for describing embodiments only and is not intended to limit the claims. As used in the description of embodiments and claims, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or,” as used herein, means including one or more of the associated listed items and all possible combinations thereof. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., provided in the embodiments, if they correspond to the method section provided in the embodiments, then the relevant parts can be referred to the description of the method section.

[0094] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments provided herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0095] The methods and products (including but not limited to devices and equipment) disclosed in the embodiments herein can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to implement this embodiment according to actual needs. In addition, the functional units in the embodiments of this application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0096] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description; sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

Claims

1. A data transmission method for a quantum communication system in rail transit, characterized in that, include: Quantum keys are pre-loaded into secure cryptographic carriers using quantum key injection devices; Quantum key distribution via the first channel includes: generating a first quantum key corresponding to vehicle attributes; and encrypting a secure cryptographic carrier with the first quantum key transmitted via the first channel. Transmitting train data encrypted with a quantum key pre-installed in a secure cryptographic carrier via a second channel includes: encrypting the secure cryptographic carrier with a first quantum key transmitted via a first channel, rendering the secure cryptographic carrier unusable; decrypting the secure cryptographic carrier using a quantum security gateway, rendering the secure cryptographic carrier usable; and when the decrypted secure cryptographic carrier is inserted into a vehicle-to-ground wireless communication device, encrypting the train data with the quantum key pre-installed in the secure cryptographic carrier and transmitting the encrypted train data. The ground security gateway receives encrypted train data and performs traffic filtering and access control to block unauthorized requests. The ground decryption server parses the key address in the encrypted train data and applies for the corresponding decryption quantum key from the quantum cryptography service platform. After verifying the legality of the key address, the quantum cryptography service platform issues the decryption quantum key to the ground decryption server. The ground decryption server then decrypts the encrypted train data using the decryption quantum key based on the national cryptographic algorithm and transmits the decrypted train data to the ground business system for analysis and processing.

2. The method according to claim 1, characterized in that, The train data is encrypted using a quantum key pre-stored in a secure cryptographic carrier, including: The train data is symmetrically encrypted using a national cryptographic algorithm by reading the quantum key pre-installed in the secure cryptographic carrier through a vehicle-to-ground wireless communication device.

3. The method according to any one of claims 1 to 2, characterized in that, Also includes: The quantum cryptography service platform uses a first channel to distribute periodically generated new quantum keys to each node of the communication system, enabling dynamic updates of the quantum keys at each node; the nodes include vehicle-to-ground wireless communication devices and / or ground decryption servers.

4. The method according to any one of claims 1 to 2, characterized in that, Also includes: The vehicle-to-ground wireless communication equipment installed in the first and second carriages respectively is designated as the main equipment and the backup equipment; the main equipment and the backup equipment monitor the heartbeat through a data synchronization bus. When the main device fails to respond for a set number of consecutive times, it is determined that the security password carrier corresponding to the main device is faulty, and the backup device takes over the encrypted transmission function undertaken by the main device.

5. The method according to claim 4, characterized in that, Also includes: When the secure cryptographic carrier fails and no backup device is available, the system uses the most recently set number of quantum keys cached in the local secure chip of the vehicle-to-ground wireless communication device to continue encrypting the train data, and applies to the quantum cryptography service platform for a temporary quantum key with a validity period of less than the set duration for subsequent encryption or decryption operations.

6. A data transmission device for a quantum communication system in rail transit, comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to execute the data transmission method for a quantum communication system for rail transit as described in any one of claims 1 to 5 when running the program instructions.

7. A communication system, characterized in that, include: The communication system itself; The data transmission device for the rail transit quantum communication system as described in claim 6 is installed on the main body of the communication system.

8. A computer-readable storage medium storing program instructions, characterized in that, When the program instructions are executed, they cause the computer to perform the data transmission method of the rail transit quantum communication system as described in any one of claims 1 to 5.

Images