A centralized control-based quantum key distribution relay method and system

Abstract

This invention discloses a centralized management-based quantum key distribution relay method and system, relating to the field of quantum secure communication. The method includes: establishing a relay node topology graph and obtaining an initial set of key XOR relationships for each relay node; compressing the initial set and distributing the compressed set and key resource batch number to each relay node; receiving shared key XOR values ​​generated by each relay node and completing the set with all XOR values; receiving a key distribution request from a source user, calculating the key distribution relay path, and receiving the XOR values ​​uploaded by the source user node and adjacent relay nodes along that path; obtaining missing key XOR values ​​based on the key resource batch number and the complete set of XOR values, performing XOR operations sequentially along the path, and sending the result to the target user. Through this scheme, under centralized management, the number of key XOR values ​​uploaded by relay nodes to the management center can be reduced, improving system response time and providing support for the widespread deployment of high-performance quantum key distribution.

Description

Technical Field

[0001] This invention relates to the field of secure communication technology, and more specifically, to a quantum key distribution relay method and system based on centralized management. Background Technology

[0002] Existing quantum key distribution relay schemes based on centralized management can meet the basic application requirements of long-distance quantum key distribution. The core of these schemes is to generate a shared key by relay nodes and neighboring nodes through quantum key distribution, and then upload the XOR value of the key to the management center, thereby realizing quantum key distribution based on trusted relays.

[0003] However, such solutions have significant technical limitations and are difficult to adapt to the needs of large-scale quantum key distribution networks. On the one hand, while existing solutions can support various topologies, the total number of keys that need to be uploaded is large, and current deployments mostly focus on quantum key distribution relays in linear topologies. In this linear architecture, each relay node only establishes optical path connections with two other relay nodes, negotiates two keys, and uploads the corresponding XOR values. In future large-scale quantum key distribution networks, the number of relay nodes will increase significantly, the topology will be more complex, and the amount of XOR values ​​uploaded will expand significantly, greatly increasing the complexity of system management and maintenance. On the other hand, the response efficiency is insufficient. Existing solutions only determine the path and perform key distribution, relaying, and computation in real time after the user initiates a key sharing request. This real-time processing mode is difficult to meet the high bandwidth and high-speed key requirements between users.

[0004] Therefore, there is an urgent need to develop new quantum key distribution relay methods based on centralized management, which can reduce the number of key XOR values ​​uploaded by orders of magnitude, improve system performance, and reduce the complexity of operation and management while ensuring security. Summary of the Invention

[0005] This invention provides a centralized control-based quantum key distribution relay method and system, aiming to solve the problems of large-scale key XOR value upload volume and insufficient system response efficiency in large-scale quantum key distribution networks.

[0006] According to one aspect of the present invention, a centralized-management-based quantum key distribution relay method is provided, applied to a management center, the method comprising:

[0007] Establish a relay node topology graph, wherein the nodes in the topology graph are the currently accessed relay nodes, and the edges are the key distribution quantum channel association relationships between relay nodes;

[0008] Summarize the node information that is associated with each relay node by edge, enumerate the pairwise XOR logical relationships between each relay node and the associated relay node to be generated the subsequent shared key, and generate the set of XOR relationships of each relay node key.

[0009] Calculate the union of the XOR sets of keys for each relay node to obtain the initial set of key XOR relationships;

[0010] Perform set compression on the initial set of key XOR relationships to obtain a compressed set of key XOR relationships, and distribute it to each relay node;

[0011] Receive the shared key XOR value generated by each relay node, perform shared key XOR value completion, and obtain the full set of key XOR values;

[0012] Receive the key distribution request from the source user node, calculate the key distribution relay path based on the relay node topology graph, select a key from the key resource pool, and distribute the key distribution relay path and the selected key resource batch number to each node under the path.

[0013] Receive the XOR value provided by the source user node and the relay node adjacent to the user node in the key distribution relay path;

[0014] Based on the full set of key XOR values, query the key resource pool to obtain the missing key XOR values ​​under the key distribution relay path. According to the adjacency order of the path nodes, XOR merge the XOR values ​​of each shared key and send the result to the target user node.

[0015] The present invention also proposes a quantum key distribution network controller, which includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the quantum key distribution relay method based on centralized control as described above.

[0016] According to another aspect of the present invention, a centralized-management-based quantum key distribution relay method is provided, applied to relay nodes, the method comprising:

[0017] Receive the XOR relationship compressed set of keys and the corresponding key resource batch number issued by the control center;

[0018] The relay shared key is generated by other relay nodes connected to the quantum channel through the quantum key distribution protocol, stored in the local key resource pool based on the corresponding key resource batch number, and the relay shared key XOR value corresponding to the key XOR relationship is calculated based on the key XOR relationship compression set and sent back to the control center.

[0019] Receive a key distribution relay request issued by the control center. The key distribution relay request includes the key distribution relay path and the key resource batch number selected for the path.

[0020] If it is adjacent to a user node, retrieve the relay shared key bound to the selected key resource batch number from the local key resource pool, generate a user shared key with the adjacent user node under the key distribution relay path through the quantum key distribution protocol, perform an XOR operation between the retrieved relay shared key and the user shared key generated by the adjacent user node, and upload the operation result to the control center.

[0021] Update the local password resource pool and delete the relay shared key that is bound to the path selection key resource batch number.

[0022] According to another aspect of the present invention, a centralized-management-based quantum key distribution relay method is provided, applied to user nodes, the method comprising:

[0023] When the user node is the source user node:

[0024] Initiate a key distribution request to the control center;

[0025] Receive the key distribution relay path and the batch number of the key resource used for the path selection issued by the control center;

[0026] A distribution key to be distributed to the target user nodes is generated using a quantum random number generator.

[0027] Relay nodes adjacent to the key distribution relay path generate user-shared keys through a quantum key distribution protocol;

[0028] Calculate the XOR value between the distribution key and the user-shared key, and upload the XOR value to the control center;

[0029] When the user node is the target user node:

[0030] Receive the key distribution relay path and the batch number of the key resource used for the path selection issued by the control center;

[0031] The relay nodes adjacent to the key distribution relay path generate user-shared keys via the quantum key distribution protocol;

[0032] The user shared key and the relay shared key whose matching path is selected from the local resource pool and whose corresponding key resource batch number is XORed by the adjacent relay node are performed. The result of the XOR operation is uploaded to the control center by the adjacent relay node.

[0033] The receiving control center receives the quantum key distribution relay XOR result obtained by XOR operation of each node under the key distribution relay path. The quantum key distribution relay XOR result is the result of XOR merging of the XOR values ​​of each shared key by the control center according to the adjacency order of the nodes under the key distribution relay path.

[0034] The XOR operation is performed between the result of the quantum key distribution relay and the user shared key to obtain the distribution key sent by the source user node.

[0035] This invention also proposes a centrally managed quantum key distribution relay system, comprising: a control center, relay nodes, and user nodes.

[0036] The control center is used for: creating a relay node topology graph and constructing a connection set; enumerating key XOR relationships to form an initial set of key XOR relationships, compressing it, and then sending it to the relay nodes; receiving shared key XOR values ​​uploaded by relay nodes and completing them into a full set of key XOR values; receiving requests from source user nodes and calculating key distribution relay paths; retrieving key resource batch numbers and sending them to each node along the path; receiving XOR values ​​calculated by the source user node and the relay nodes adjacent to the user along the path; obtaining missing XOR values ​​and performing XOR operations according to the adjacent order of path nodes; and sending the results to the target user node.

[0037] The relay node is used for: receiving compressed sets and key resource batch numbers issued by the control center; generating and storing shared keys with adjacent relay nodes via quantum key distribution protocol and calculating XOR values ​​during idle time; receiving key distribution requests and selection batch numbers; if adjacent to a user node, retrieving the shared key generated and stored during idle time that is bound to the selected key batch number, generating a user shared key with the user, calculating the XOR value of the two and uploading it; updating the local password resource pool; and deleting the shared key bound to the path selection key resource batch number.

[0038] The user nodes include source user nodes and target user nodes. The source user node initiates a key distribution request, receives the key distribution relay path planned by the control center, generates a distribution key to be distributed to the target user node, generates a relay shared key with adjacent relay nodes along the path, calculates the XOR value of the distribution key and the relay shared key, and uploads it. The target user node receives the key distribution relay path, generates a user shared key with adjacent relay nodes along the key distribution relay path, performs an XOR operation with the pre-prepared relay shared key locally invoked by adjacent relay nodes, and uploads it to the control center. The target user node receives the quantum key distribution relay XOR result issued by the control center, performs an XOR operation with the user shared key generated by the target user node, and obtains the shared key of the source user node.

[0039] The main contributions of the technical solutions in the embodiments of the present invention are as follows:

[0040] First, this invention reduces the number of XOR values ​​uploaded by relay nodes through relay topology initialization and XOR set compression mechanisms. Moreover, the compressed XOR subset can restore all original values ​​without affecting key generation. Neither relay nodes nor the control center can crack the user's shared key. This reduces communication and maintenance costs while ensuring the security of quantum keys.

[0041] Secondly, this invention adopts an idle pre-preparation and real-time invocation mode. When idle, relay nodes pre-generate keys, calculate XOR values, and upload them to the control center to form a key resource pool. When a user node needs to distribute keys, only a small number of XOR values ​​need to be uploaded by the user and adjacent relay nodes under the key distribution relay path. The control center calls the pre-stored resources for rapid calculation. This mode significantly shortens the key generation cycle and effectively meets the system response efficiency requirements of high-bandwidth data encryption scenarios. It is especially suitable for scenarios where the key distribution relay path is uncertain and needs to be temporarily planned. At the same time, it supports multi-path planning and improves service stability.

[0042] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart of a quantum key distribution relay method based on centralized management, provided by an embodiment of the present invention;

[0045] Figure 2 This is a schematic diagram of the structure of a quantum key distribution network controller according to an embodiment of the present invention;

[0046] Figure 3 This is a schematic diagram of a centrally managed quantum key distribution relay system provided by an embodiment of the present invention. Detailed Implementation

[0047] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0048] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0049] Example 1

[0050] Figure 1 This is a flowchart of a centralized quantum key distribution relay method according to an embodiment of the present invention. This method is suitable for large-scale quantum key distribution scenarios, especially those with a large number of relay nodes, complex topologies, and the need for temporary planning of key distribution relay paths. The method can be executed by a quantum key distribution network controller, which can be implemented in hardware and / or software and integrated into a centralized quantum key distribution relay system or a quantum key distribution network control platform, such as a quantum key distribution network control server or dedicated quantum key distribution network control equipment. Figure 1 As shown, the method includes:

[0051] S110. Establish a relay node topology graph, wherein the nodes in the topology graph are the currently accessed relay nodes, and the edges are the key distribution quantum channel association relationships between relay nodes.

[0052] The control center obtains all relay nodes currently connected to the system. Based on whether each relay node has a quantum channel, it can perform end-to-end QKD quantum key distribution and draw a relay topology diagram, where each relay node is denoted as a point, and if there is a quantum channel between two points, an edge is drawn between the two points.

[0053] The control center can access the management module through the internal quantum communication network to obtain basic information of all relay nodes currently connected to the system, including but not limited to: unique identifiers of relay nodes (such as device ID and physical address), hardware operating status (activity of quantum optics module, connectivity of classical communication interface), network access parameters (access gateway, communication port), and geographical location markings (for reference in subsequent link planning), forming an initial list of relay nodes and excluding invalid nodes that are hardware faulty or offline.

[0054] For each pair of relay nodes in the initial node list, the control center can trigger an end-to-end QKD protocol test: control the relay node pair to be tested to start the quantum key distribution process. If the node pair can successfully generate a shared key, it is determined that there is a valid quantum channel between them; if the negotiation fails, such as the bit error rate exceeding the threshold or the quantum state transmission being interrupted, it is determined that there is no valid channel.

[0055] Based on the collected relay node information with valid channels, a relay node topology graph is drawn. The node and edge element information in the topology graph is as follows:

[0056] Node: Each relay node corresponds to a node in the topology graph. The labeling includes the node's unique identifier, real-time operating status (online / offline), and core quantum module model (which can be used to adapt to subsequent key negotiation parameters).

[0057] Edges: Edges are drawn only between node pairs that have valid quantum channels. The attribute labels of the edges include the unique identifier of the channel, the real-time key generation rate, the channel type, and the timestamp of the most recent validity check, so as to reflect the association of key distribution capabilities between nodes.

[0058] The completed topology map can be identified by information such as version number, and a topology map verification and dynamic update mechanism can be initiated. The verification and update cycle can be set, and the access status and channel validity of all nodes can be automatically retested within the cycle. If a node is offline or the channel fails, the topology map is updated in real time to ensure that the topology map is consistent with the actual network status. This provides an accurate basis for subsequent XOR set compression, path planning and key negotiation, and ensures that key negotiation is carried out smoothly.

[0059] S120. Summarize the information of all relay nodes that are associated with each relay node, enumerate the pairwise XOR logical relationships between each relay node and the associated relay node to be generated for the subsequent shared key, and generate the set of XOR relationships of each relay node key.

[0060] The control center selects each relay node in the topology graph one by one, traverses all the edges marked as valid in the topology graph for that node, extracts the relay node at the other end of each valid edge, and summarizes the information to form a set of connections for each relay node.

[0061] Each relay node enumerates the end-to-end shared keys that will be generated by the QKD protocol between the relay node and other nodes in the set (i.e., relay nodes that are associated with the relay node by an edge) based on the corresponding relay node connection set. Then, it performs a unique pairwise XOR operation on all the shared keys to be generated to generate a set of XOR relationships between the keys of each relay node.

[0062] For example, for relay nodes Let its connection set be: The set of XOR relations that need to be uploaded is . ;

[0063] in, For relay nodes The set of connections, k being the number of connections to relay nodes. The number of nodes with interconnected relationships. This indicates a connection relationship.

[0064] exist In the middle, relay node based on Connections in The corresponding shared key to be generated later is identified as follows: For example, Identified as and The shared key to be generated subsequently between two related relay nodes. Identified as and The shared key to be generated subsequently between two related relay nodes.

[0065] for and Pairwise XOR logic relationship, For relay nodes The set of shared keys to be generated by relay nodes that have an association relationship with each other, and the set of XOR operations performed on each pair of keys without repetition.

[0066] S130. Calculate the union of the XOR relationship sets of each relay node's keys to obtain the initial set of key XOR relationships.

[0067] The core objective of this step is to XOR the set of independent keys generated by each relay node in S120. The data is integrated into an initial set X covering the entire network, avoiding omissions or duplications of XOR relationships, and providing a complete and non-redundant raw data foundation for subsequent XOR set compression.

[0068] Specifically, for Taking the union yields This is the initial set of XOR relationships between all relay node keys to be uploaded.

[0069]

[0070] S140. Perform set compression on the initial set of key XOR relationships to obtain a compressed set of key XOR relationships, and distribute it to each relay node.

[0071] If the initial set of XOR relationships for relay node keys generated by S130 is used directly, a problem of order-of-magnitude expansion will be encountered: when there are relay node topology relationships in the graph... When there are 1 relay node, the number of XOR values ​​in the initial set reaches 1 class.

[0072] Taking a quadrilateral fully connected architecture as an example, where quantum channels exist between all four nodes, the total number of keys that need to be generated is... According to the centralized key relay management mechanism, relay node 1 needs to calculate separately. ， ， The data is then uploaded to the management center. Relays 2, 3, and 4 also need to calculate the key XOR value according to similar requirements and upload it. A total of 12 types of XOR values ​​need to be uploaded by each node. If the relay node topology graph contains... If there are [number] relay nodes, then the total number of keys is [number]. The total number of nodes that need to upload is [number]. XOR-like values, with a large number of values. The order of magnitude of the data makes management and maintenance difficult in large-scale deployments. If uploading only the key itself is omitted, then at most only the XOR value needs to be uploaded. Class key, expansion amount is The value can be reduced by an order of magnitude compared to the uploaded XOR value, but the management node will be able to recover the user key, which will reduce security.

[0073] To reduce the order of magnitude of uploaded key XOR values ​​and improve overall system performance while ensuring security, this application employs an XOR set compression method: based on the relay node topology graph, an adaptation algorithm is used to compress the initial set of key XOR relationships of each relay node. Specifically, this compression process involves selecting the smallest valid subset from the initial set of key XOR relationships based on the relay node topology. This subset does not need to retain all XOR values ​​from the initial set, but its XOR values ​​can be combined using XOR operations to reconstruct all XOR expressions from the initial set. The subset obtained through this selection is called the key XOR relationship compressed set. The control center assigns a corresponding key resource batch number to it to achieve accurate association, efficient access, and orderly management of pre-prepared key resources.

[0074] Subsequently, the XOR relationship of the keys can be compressed based on the key XOR relationship, and the key XOR relationship that each relay node in the set needs to upload can be obtained. The key resource batch number corresponding to the compressed set is then sent to the corresponding relay node.

[0075] Furthermore, based on the topological relationships of each relay node, an adaptation algorithm is used to perform set compression on the initial set of XOR relationships of relay node keys, which can be divided into two cases:

[0076] If the relay nodes in the relay node topology graph are in a fully connected topology, the compression steps are as follows:

[0077] step 1. Randomly select two relay nodes as base nodes, determine the XOR relationship between each base node and the other relay nodes that need to be uploaded, and filter out the smallest subset of XOR values ​​that can cover all the initial XOR relationships through element combinations.

[0078] Specifically, if in the current system relay nodes And in a fully connected state, arbitrarily select two nodes as base nodes, first determine the key XOR relationship that each base node and the other relay nodes need to upload, and then filter from all the key XOR relationships obtained by enumeration to obtain the minimum XOR value subset, and the filtered XOR relationship can cover all the initial XOR relationship through element combination.

[0079] For example, if the two selected reference nodes are respectively ， Based on the commutative and combinatory properties of the XOR operation, the XOR relationship of the keys that the two base nodes need to upload is calculated as follows:

[0080] (1) About The XOR relationship of the keys that need to be uploaded is denoted as: In total indivual;

[0081] (2) About The XOR relationship of the keys that need to be uploaded is denoted as: In total indivual;

[0082] step Based on the minimum XOR value subset of the baseline node, determine the minimum XOR value subset to be uploaded for each non-baseline node according to the XOR relationship between the non-baseline node and the baseline node.

[0083] The first two nodes cover the baseline association with most nodes, while the remaining nodes only need to upload the XOR value of the association with the few uncovered nodes, taking advantage of the inferability of the baseline association.

[0084] The minimum XOR value subset of the first two benchmark nodes has covered the benchmark associated XOR values ​​of most nodes; the remaining nodes use the commutative and associative laws of XOR operation to deduce the values ​​by combining the existing XOR values ​​of the benchmark nodes. Therefore, they only need to upload a small number of associated XOR values ​​that cannot be restored by combining the XOR values ​​of the benchmark nodes, thereby determining the minimum XOR value subset to be uploaded by themselves. This ensures that all XOR relationships can be fully covered while minimizing their own upload volume.

[0085] Specifically, based on the minimum XOR value subset of the baseline node, the minimum key XOR relationship for the remaining nodes to be uploaded is as follows:

[0086] (1) About The XOR relationship of the keys that need to be uploaded is denoted as: ， Total indivual;

[0087] (2) About The XOR relationship of the keys that need to be uploaded is denoted as: In total indivual;

[0088] (3) Regarding The XOR relationship of the keys that need to be uploaded is denoted as: In total indivual;

[0089] (n) about The XOR relationship of the keys that need to be uploaded is denoted as: In total indivual.

[0090] step Integrate the minimum XOR subsets corresponding to each relay node to form a compressed set of key XOR relationships; wherein the total number of elements in the compressed set is... , This represents the total number of relay nodes in the relay node topology graph.

[0091] Due to the steps The current relay node topology graph is enumerated. This step will be the minimum XOR subset of the relay nodes to be uploaded. All the obtained key XOR relationships are integrated to form the relay node key XOR relationship compressed set.

[0092] Integration here refers to: combining steps The minimum XOR value subset to be uploaded by each relay node, including the base node and non-base nodes, is merged and summarized. This process collects the XOR relationship elements scattered across different relay nodes, forming a unified set covering all relay nodes in the entire system without redundancy. Therefore, in a fully connected topology, all XOR values ​​that each relay node needs to upload are... It is easy to know that the total amount is indivual.

[0093] It is worth noting that, before integration, the minimum XOR value subset to be uploaded determined by the base node and non-base nodes, along with the corresponding key resource batch number, can be sent to the corresponding relay nodes.

[0094] Besides fully connected topological relationships, other types of topological relationships exist. For different types of topological relationships for each node, such as missing edges or acyclic relationships, differentiated algorithms can be used to obtain compressed XOR sets, such as exhaustive traversal and reverse deletion methods. The operational logic of exhaustive traversal and reverse deletion methods is as follows:

[0095] (a) Exhaustive search method:

[0096] 1) Introduce temporary sets Y, Y Initially, it is an empty set;

[0097] 2) From the initial XOR set Randomly select an element from Y and add it to Y. Calculate all possible XOR values ​​of any combination of elements in Y (up to three elements) to form a set. ;

[0098] 3) If The algorithm terminates and outputs... Y ;

[0099] 4) If , continue from the set Randomly select elements from Y and add them to Y. Repeat steps 2) and 3).

[0100] (ii) Reverse deletion method:

[0101] 1) Introduce temporary sets Y and Z, with Z initialized as the initial XOR set. ;

[0102] 2) Randomly select elements from Z Calculate Y=Z- That is, randomly deleting elements from set Z. Calculate all possible XOR values ​​of the elements in the current Y (at most three elements) to form a set. ;

[0103] 3) If Then let Z = Y, and then repeat steps 2-3, that is, continue from the set Randomly delete elements from the middle, complete the same calculation process, and repeat the loop;

[0104] if Then let Y=Z, that is, do not delete. Delete other elements and repeat steps 2 and 3).

[0105] 4) When iterating through and attempting to delete each element in Z, the following conditions are met: When the loop stops, the algorithm terminates and outputs Y.

[0106] After executing the two types of algorithms mentioned above multiple times, the XOR value compressed set Y can be obtained.

[0107] S150: Receive the shared key XOR value generated by each relay node, perform shared key XOR value completion, and obtain the full set of key XOR values.

[0108] The control center first receives the shared key XOR value generated and uploaded by each relay node. The shared key XOR value is obtained by performing an XOR operation on the compressed relay node key XOR relationship issued by S140 and is bound to the key resource batch number.

[0109] Furthermore, the key resource batch number is uniformly allocated by the control center. The key resource batch number includes: the key XOR value generation batch number, the validity period, and the corresponding relay node topology graph version number. It is also bound to the connection set, XOR relationship set, XOR relationship compression set, and full key XOR value set corresponding to that relay node. The key XOR value generation batch number identifies the XOR values ​​pre-prepared in the same round, avoiding confusion between pre-prepared resources from multiple rounds and facilitating the control center to quickly locate the XOR value in a specific round, thus solving the resource traceability problem. The validity period corresponds to the timeliness of the quantum key, eliminating expired resources and avoiding security risks caused by long-term key storage or negotiation failures due to channel changes, ensuring resource security and availability. The topology graph version number is associated with the topology state at the time of XOR value generation. Since the topology graph may be updated with node additions / removals and channel failures, this version number ensures that the XOR value matches the current topology relationship, avoiding calculation errors caused by adapting the XOR value of the old topology relationship to the new topology path.

[0110] It is worth noting that each uploaded key XOR value is bound to a key resource batch number to identify which round of pre-prepared key resources the XOR value belongs to, thus avoiding confusion between XOR values ​​from different batches and providing an identification basis for accurate resource access in the future.

[0111] Subsequently, based on the relay node topology graph, the initial set of key XOR relationships, and the shared key XOR values ​​uploaded by the relay nodes, shared key XOR value completion is performed to obtain the full set of key XOR values ​​corresponding to the key resource batch number.

[0112] Since the shared key XOR values ​​generated by each relay node are currently received are based on the compressed set of key XOR relationships issued by the control center, they only contain a portion of the XOR values. It is necessary to perform a completion operation to deduce and generate the missing XOR relationships from the uploaded XOR values, and then combine them to restore the initial set of relay node key XOR relationships, thereby forming the full set of relay node key XOR values.

[0113] Furthermore, perform shared key XOR value completion to obtain the full set of key XOR values, including:

[0114] step Based on the relay node topology graph and the union of key XOR relationships, determine all preset key XOR relationships within the union.

[0115] The purpose of this step is to accurately determine the preset key XOR relationship based on the relay node topology graph and the union of key XOR relationships, and to clarify the range of derivable XOR relationships. The topology graph clearly defines the effective quantum channels between nodes, ensuring that each preset XOR relationship corresponds to a node pair that can generate a shared key. It also defines the processing boundaries for subsequent XOR set compression, avoiding the retention of invalid or missing necessary XOR relationships during compression. Furthermore, it establishes the correspondence between physical connections and XOR relationships, ensuring that the XOR value matches the link during subsequent user key calculations.

[0116] step The shared key XOR value uploaded by each relay node is compared with the preset key XOR relationship one by one, and the key XOR relationship that has not been uploaded is filtered out.

[0117] The core objective is to determine the range of XOR values ​​that need to be filled in later, based on the relay node topology graph and the initial set of key XOR relationships, so as to avoid filling in invalid or duplicate XOR relationships.

[0118] In terms of operation, based on steps Within the defined union set, all preset key XOR relationships are compared one by one with the XOR values ​​of the shared keys uploaded by each relay node and bound to the batch number. If the uploaded XOR value matches the preset relationship, it is marked as "overwritten". If there is no corresponding uploaded value in the preset relationship, it is filtered as "unuploaded key XOR relationship". These unuploaded relationships are the objects that need to be derived and generated by XOR operation in the subsequent completion step.

[0119] step By utilizing the properties of the XOR operation, a second XOR operation is performed on the XOR values ​​of the shared keys of each relay node that have been uploaded, and the XOR values ​​of the keys corresponding to the XOR relationships of the keys that have not been uploaded are derived.

[0120] Using the XOR value of the uploaded shared key as the basic element for completion, and leveraging the commutative and associative laws of XOR operation, the missing XOR relationship is derived from the uploaded XOR values.

[0121] First, from the uploaded XOR values, elements associated with node pairs involved in the unuploaded XOR relationships are selected. Then, a second XOR operation is performed on these associated elements to cancel out duplicate terms. Finally, the key XOR value corresponding to the unuploaded relationship is derived. The derivation process is combined with the relay node topology graph and the initial set of key XOR relationships for verification to ensure that the result conforms to the effective channel range and to fill in the missing XOR relationships.

[0122] step The shared key XOR value uploaded by each relay node is integrated with the key XOR value corresponding to the deduced unuploaded key XOR relationship to obtain a full set of relay node key XOR values ​​covering all preset relationships within the union of key XOR relationships.

[0123] The XOR value of the shared key uploaded by each relay node and bound to the key resource batch number, and the result obtained through the steps... The XOR values ​​of the keys derived from the quadratic XOR operation are integrated. During integration, the relay node topology graph and the initial set of key XOR relationships are used for verification, eliminating duplicate XOR values. Simultaneously, it is confirmed that all integrated elements cover the preset relationships within the union of key XOR relationships, ultimately forming a complete set of key XOR values. Its core purpose is to build a key resource pool covering all valid XOR values ​​in the entire system. This provides a foundation for the control center to quickly extract the XOR values ​​required for the corresponding key distribution relay path when users initiate key distribution requests, ensuring an efficient and accurate key calculation process.

[0124] Furthermore, to ensure the orderly use of subsequent key resources, the full set of key XOR values ​​needs to be bound to the key resource batch number. Since different batches of the full set correspond to different topology diagram versions and key validity periods, binding can avoid confusion between multiple batches of resources, ensuring that subsequent calls can accurately match the current network topology and timeliness requirements. At the same time, this binding relationship also provides a core identifier for the batch-partitioned storage and dynamic updating of the key resource pool, ensuring the integrity and availability of data within the resource pool.

[0125] It is worth noting that steps S110-S150 are preprocessing operations performed during the idle period of the quantum key distribution relay system. These operations pre-compile the topology, clarify XOR relationships, and compress and complete XOR values, preparing resources and processes for subsequent real-time key requests from users. This idle-time preprocessing design avoids response delays caused by performing complex calculations on an ad-hoc basis when users request key distribution, ensuring that the control center can directly call upon the pre-prepared topology and XOR resources to efficiently complete key calculations when users subsequently initiate key distribution requests.

[0126] S160. Receive the key distribution request from the source user node, calculate the key distribution relay path based on the relay node topology graph, select a key from the key resource pool, and send the key distribution relay path and the selected key resource batch number to each node under the path.

[0127] During the real-time connection phase of user key distribution, the source user node, as the initiator of key distribution, will send a key distribution request to the control center when it needs to establish secure communication with the target user node and obtain the shared key. The request asks the control center to provide quantum key distribution relay services, including planning key distribution relay paths and coordinating key resources of relay nodes, in order to support the subsequent key transmission and XOR operation process based on relay nodes.

[0128] Typically, in a key distribution request initiated by the source user node, only one key is distributed by default. This single-key distribution scenario is mostly suitable for short-term, one-time encryption needs, such as temporary file transfers and instant messaging encryption. In this case, the key distribution period setting is more flexible: you can directly specify the specific time of key distribution, such as 14:00 on December 1, 2025, or you can set the period value to empty.

[0129] In specific scenarios, users can request the continuous distribution of multiple keys along the same planned path based on long-term, periodic key distribution needs, specifying the exact distribution time for each key. For example, one key could be distributed on the 9th of each month, or one key could be distributed every Monday at 10:00 AM, to match regular business operations. It is important to emphasize that the core security mechanism of quantum key distribution is one-time pad, meaning that each encrypted communication must use an independent and non-repeating key to completely eliminate the security risks associated with key leakage or reuse. Therefore, when distributing multiple keys continuously along the same planned path, each distribution must utilize different relay node key resources. Based on this requirement, the batch numbers of the key resources to be utilized from each relay node must be pre-defined for each distribution cycle to ensure that each key generation accurately matches the corresponding independent resources, guaranteeing both encryption security and distribution efficiency.

[0130] After responding to the key distribution request from the source user node, the control center first calculates the key distribution relay path based on the relay node topology graph. Usually, multiple backup paths are calculated to cope with node or channel failures and ensure system stability, but the optimal path is determined first, such as the path with good channel quality and few nodes. Then, from the key resource pool pre-built during idle time, the available key resource batch numbers of each relay node under the path are called, and key resources are selected from them. The selected key resource batch number is then distributed to each node under the planned path.

[0131] Among them, the key resource pool is the core resource carrier pre-built by the system. Its core value lies in storing the XOR values ​​of the keys of each relay node in advance, so as to avoid response delay caused by the temporary generation of XOR values ​​when users make requests.

[0132] Regarding resource reserve strategies, the number of XOR values ​​for keys reserved in advance is not fixed but needs to be dynamically adjusted based on actual business scenarios. For example, it is calculated comprehensively based on dimensions such as the daily encryption frequency, the demand for key distribution per transaction, and the number of user requests during peak periods to ensure that the reserve amount can meet regular needs while avoiding waste caused by excessive resource consumption. Simultaneously, to ensure the continuous availability of the resource pool, the system can preset an available resource threshold. This threshold is typically set based on the historical lowest resource consumption rate and emergency resource needs to ensure that the resource pool always remains within the capacity range for efficient service, avoiding service interruptions due to resource depletion. When the number of available XOR values ​​in the resource pool falls below the preset threshold, the system automatically triggers a resource replenishment mechanism: sending a resource replenishment command to the relevant relay nodes, requiring them to regenerate a new shared key through the quantum key distribution protocol, calculate the corresponding XOR value based on the new shared key, and then upload it to the key resource pool, completing the dynamic replenishment of resources and achieving a stable cycle of resource pool capacity.

[0133] The complete set of XOR values ​​for a key is the basic unit constituting a key resource pool. Multiple complete sets of XOR values ​​are stored within the same key resource pool, and each set is bound to a corresponding key resource batch number. Key resources within the same complete set of XOR values ​​can be partitioned and stored according to relay nodes. This design of managing by key resource batch number and partitioning within the same batch according to relay nodes further improves resource retrieval efficiency: the batch number can be directly associated with the complete XOR values ​​prepared during a specific idle period, facilitating quick filtering of valid resources suitable for the current topology; partitioning within the same batch by node enables precise location. When subsequently needing to retrieve the XOR value of a specific relay node on a certain path, it is not necessary to traverse the entire pool of resources; only the corresponding node partition needs to be located, significantly reducing resource retrieval time.

[0134] Furthermore, each time a key distribution relay is completed, the key resource pool needs to trigger a resource update, deleting the selected key resource information under that key distribution relay path. This operation not only conforms to the one-time pad security principle of quantum key distribution, avoiding the risk of reusing used keys, but also ensures the accuracy of available resources within the resource pool, preventing subsequent misuse of invalid resources.

[0135] Preferably, the control center can only send the selected key resource batch number to the relay nodes under the planned key distribution relay path. For user nodes under the planned path, including source user nodes and target user nodes, only the planned path can be sent. This is because in the subsequent operation process, user nodes only need to obtain the information of the relay nodes adjacent to them under the planned path to complete the relevant calculations, without using the key resource batch number information, which is only for the key resources of the relay nodes.

[0136] For relay nodes not adjacent to user nodes, since they have already uploaded the XOR value of the shared key pre-generated with other relay nodes via the quantum key distribution protocol to the key resource pool on the control center side during the idle phase of relay key preparation, the control center can directly query the resource pool to obtain the XOR value of such nodes without requiring them to upload it again in this step. Only the relay nodes adjacent to user nodes in the planned path need to retrieve the XOR value of the shared key bound to the available key batch number from their local key resource pool. However, since each relay node consumes resources after each key distribution request, after completing the key distribution relay operation based on the key resource batch number selected based on the path, an update operation needs to be performed on the local key resources to delete the keys used in this key distribution relay, thus achieving synchronization with the key resource pool on the control center side.

[0137] S170, Receive the XOR value provided by the source user node and the relay node adjacent to the user node in the key distribution relay path.

[0138] This step is crucial in the user key distribution process. Its core is the XOR value calculated by the source user node and the adjacent relay nodes along the key distribution relay path. The XOR value calculation is based on the user shared key generated between the user node and its adjacent relay nodes, as well as the relay shared key generated between the relay nodes. The distribution key from the source user node to the target user node also participates in the calculation. The generation of both the user shared key and the relay shared key is based on the quantum key distribution protocol. Specifically, this includes:

[0139] step Receive the XOR value of the source user node: This XOR value is obtained by XORing the distribution key and the user shared key. The distribution key is the key generated by the source user node to be distributed to the target user node, and the user shared key is the shared key generated by the source user node and the adjacent relay nodes in the key distribution relay path through the quantum key distribution protocol.

[0140] The source user node, as the initiator of key distribution, first generates an original random key to be shared with the target user node using a quantum random number generator. This key is the distribution key to be transmitted to the target user node and has information theory security, which is the core foundation for subsequent encrypted communication between the two parties.

[0141] Subsequently, the source user node establishes a quantum channel with adjacent relay nodes along the key distribution relay path issued by the management center. Point-to-point key negotiation is then completed using quantum key distribution protocols such as BB84, generating a shared user key exclusive to both nodes. After obtaining the distribution key and the shared user key, the source user node performs an XOR operation on these two keys to obtain the corresponding XOR value. The management center receives this XOR value through a trusted classical channel and binds it to the current key resource batch number for storage, providing data support for subsequent full-path XOR value merging operations and the final key restoration of the target user node.

[0142] For example, suppose the key distribution relay path is: "Source user node A → Relay node 1 → Relay node 2 → Relay node 3 → Target user node B".

[0143] The distribution key generated by the source user node A is Key, and the user-shared key generated by the adjacent relay node 1 along the path using quantum key distribution protocols such as BB84 is Key. The XOR value received by the control center from the source user node A is... .

[0144] step Receive the XOR value of the relay nodes adjacent to the user node: This XOR value is obtained by XORing the user shared key and the relay shared key. The user shared key is generated by the user node and the adjacent relay nodes in the key distribution relay path through a quantum key distribution protocol. The relay shared key is generated by the relay nodes adjacent to the user node and their adjacent nodes in the key distribution relay path based on the quantum key distribution protocol. The relay nodes adjacent to the user node are the relay nodes adjacent to the source user node and the target user node in the key distribution relay path.

[0145] In the key distribution relay path, for relay nodes that are not adjacent to user nodes, i.e., intermediate relay nodes whose adjacent nodes are all relay nodes, since they have already uploaded the shared key and the calculated XOR value pre-generated with other relay nodes through the quantum key distribution protocol to the key resource pool on the control center side during the idle phase, the control center can directly query and obtain the XOR value of such nodes from the resource pool without having to upload it again in this step.

[0146] For relay nodes adjacent to user nodes in the key distribution relay path, on the one hand, they need to generate shared keys with user nodes in real time; on the other hand, they need to query the key resource pool at the relay node end using the relay node key availability resource batch number issued by the control center to find the shared keys pre-generated by other relay nodes adjacent to the key distribution relay path during the key preparation stage, and then calculate the XOR value of the two and upload it. In this way, the present invention can reduce unnecessary upload overhead and improve key negotiation efficiency in large-scale quantum networks with long communication links, many relay nodes, and temporary path planning by distinguishing the XOR value acquisition methods of different types of relay nodes, thus making its advantages more significant.

[0147] For example, suppose the key distribution relay path is: "Source user node A → Relay node 1 → Relay node 2 → Relay node 3 → Target user node B", where the relay nodes adjacent to the user nodes in this path are Relay node 1, which is adjacent to the source user node, and Relay node 3, which is adjacent to the target user node.

[0148] For relay node 1, which is adjacent to the source user node, one end is adjacent to the source user node A and the other end is adjacent to relay node 2. Therefore, the calculation of the XOR value involves not only the user shared key generated between the relay node 1 and the source user node A, but also other related factors. It is also necessary to associate the relay shared key generated by relay node 1 and its adjacent relay node 2 during the key preparation phase. The specific calculation method for the XOR value of the relay nodes adjacent to the user node is as follows:

[0149] First, negotiate with adjacent source user nodes to generate a shared key. ;

[0150] Next, based on the key resource batch number issued by the control center, relay node 1 queries its key resource pool for the shared key pre-generated with relay node 2 during the key pre-preparation stage for that path. ;

[0151] Perform an XOR operation on the two to obtain the XOR value. ⊕ The data is then uploaded to the control center by relay node 1.

[0152] Relay node 3 is a relay node adjacent to target user node B, with one end adjacent to target user node B and the other end adjacent to relay node 2;

[0153] After the control center issues the key resource batch number to relay node 3, relay node 3 first generates a shared user key with the target user node B using the BB84 protocol, denoted as . ;

[0154] Relay node 3 retrieves the relay shared key generated by adjacent relay node 2 in the path from the local key resource pool, based on the key resource batch number. ;

[0155] Will and Perform an XOR operation to obtain the XOR value. ⊕ The XOR value is then uploaded to the control center by relay node 3.

[0156] S180. Based on the full set of key XOR values, query the key resource pool to obtain the missing key XOR values ​​under the key distribution relay path. According to the adjacency order of the path nodes, perform XOR merging on each shared key XOR value and send the result to the target user node.

[0157] After executing step S170 and receiving the XOR values ​​uploaded by the source user node and the relay nodes adjacent to the user in the key distribution relay path, the XOR values ​​required for the key distribution relay path not only include the XOR values ​​of the key uploaded by the source user node and the XOR values ​​uploaded by the relay nodes adjacent to the user node, but also include the XOR values ​​of the shared keys uploaded by the adjacent nodes in the key resource pool of the control center during the pre-preparation stage. Therefore, the XOR values ​​received by S170 alone are not complete.

[0158] Based on the batch number of the key resources selected by each relay node, the control center queries the full set of key XOR values ​​in the key resource pool for relevant resources, extracts the shared key XOR values ​​of intermediate relay nodes under the key distribution relay path, and thus completes all the XOR values ​​required for the key distribution relay path. After obtaining all the XOR values, the control center performs XOR operations on each shared key XOR value sequentially according to the node adjacency order of the key distribution relay path ("Source User Node A → Relay Node 1 → Relay Node 2 → Relay Node 3 → Target User Node B"), and sends the final operation result to the target user node through a trusted classical channel. The control center then completes the quantum key distribution relay process.

[0159] For example, the control center receives via step S170 , , Then, based on the current key resource batch number, extract from the full set of XOR values ​​corresponding to the current key resource batch number. The XOR value of this key is the XOR value that the relay node prepares in advance and uploads to the control center.

[0160] The control center performs an XOR operation on the XOR values ​​according to the adjacent order under the key distribution relay path: and the calculation results Send to target user node B.

[0161] Target user B received Then, through calculation: This will allow you to obtain the key distributed by the source user node A. .

[0162] Example 2

[0163] Another embodiment of the present invention provides a centralized-management quantum key distribution relay method applied to relay nodes. This method is suitable for large-scale quantum key distribution scenarios, especially those with a large number of relay nodes and complex topologies. The method can be executed by a relay device, which can be implemented in hardware and / or software and integrated into a centralized-management quantum key distribution relay system or a quantum key distribution relay network control platform, such as a quantum key distribution relay device. The method includes:

[0164] S210 Receive the key XOR relationship compressed set and the corresponding key resource batch number issued by the control center.

[0165] The control center sends two types of core information to the relay nodes, both based on the relay topology diagram and compressed calculation results:

[0166] First, there is a compressed set of key XOR relationships. This set is a subset of the smallest XOR values ​​selected by the control center in combination with the quantum channel topology between relay nodes, using algorithms such as exhaustive search and reverse deletion. It can completely restore the initial XOR relationship and has a small total upload amount. Its core function is to clearly inform the relay nodes that they only need to calculate and upload specific key XOR values ​​within this subset, and do not need to upload all pairwise XOR values.

[0167] Second, the corresponding key resource batch number, which includes the generation batch, validity period, and topology map version number. The shared keys subsequently generated by the relay node need to be bound to this batch number and stored in the local resource pool. The batch number also needs to be carried when the shared key XOR value is sent back, so as to ensure that the control center can associate the XOR value compression set by batch and achieve precise resource management.

[0168] It is worth noting that this embodiment is implemented based on the relevant content of Embodiment 1. It includes the establishment of a relay node topology graph by the control center, where the nodes in the topology graph are the currently accessing relay nodes, and the edges of the topology graph represent the quantum channel association relationships between relay nodes for key distribution. Based on the relay node topology graph, information on all relay nodes with edge associations to each relay node is summarized to construct a relay node connection set. Based on the relay node connection set, the pairwise XOR logical relationships between the relay node and other relay nodes in the set for the subsequent generation of shared keys are enumerated to generate a key XOR relationship set for each relay node. The union of the key XOR relationship sets for each relay node is calculated to obtain an initial set of key XOR relationships for all relay nodes. Based on the relay node topology graph, set compression is performed on the initial set of key XOR relationships to obtain a compressed set of key XOR relationships for each relay node. Further details are omitted here.

[0169] S220. Other relay nodes connected to the quantum channel generate a relay shared key through the quantum key distribution protocol, store it in the local key resource pool based on the corresponding key resource batch number, calculate the relay shared key XOR value corresponding to the key XOR relationship based on the key XOR relationship compression set, and send it back to the control center.

[0170] This step is performed by the relay node when it is idle, i.e., when the user has not requested key distribution.

[0171] A relay shared key refers to a shared key generated between relay nodes via a quantum key distribution protocol.

[0172] The user shared key refers to the shared key generated between the relay node and the user node through a quantum key distribution protocol.

[0173] First, the relay node, based on the key XOR relationship compression set received by S210, negotiates with other relay nodes that have valid quantum channels to generate a relay shared key, and stores it in the local key resource pool in combination with the corresponding key resource batch number, in preparation for rapid retrieval when users request the key in real time.

[0174] Next, based on the generated relay shared key, the XOR operation is performed pairwise according to the key XOR relationship compression set given by the key XOR logic relationship, generating the relay shared key XOR value. The calculated key XOR value is then bound to the batch number of the issued key resources and stored synchronously back to the control center. After receiving the data, the control center combines the topology diagram and the initial set of key XOR relationships to complete the full set of XOR values, ensuring the consistency of key resources between the relay node side and the control center side.

[0175] It is worth noting that each relay node analyzes the XOR relationships in the key XOR relationship compression set to determine that the node corresponding to the XOR relationship is a relay node with a quantum channel connection, and then uses the quantum key distribution protocol to generate a shared key.

[0176] For example, if relay node 1 has a quantum channel connection with relay nodes 2, 3, and 4, then a relay shared key is generated through the QKD protocol. , , Next, according to the key XOR logic relationship given by the compressed set, the XOR value of the relay shared key is calculated, and relay node 1 calculates the XOR value. ⊕ , ⊕ Instead of uploading all pairwise XOR values, upload only the XOR values.

[0177] Finally, the calculated XOR value of the relay key is bound to the key resource batch number received by S210 and sent back to the control center. This allows the control center to perform shared key XOR value completion based on the relay node topology diagram, the initial set of key XOR relationships, and the shared key XOR values ​​uploaded by the relay nodes. This results in a full set of relay node key XOR values ​​corresponding to the key resource batch number, and a key resource pool is constructed on the control center side based on this full set of key XOR values ​​corresponding to the key resource batch number. The specific completion process has been described in detail in Implementation Example 1 and will not be repeated here.

[0178] S230. Receive a key distribution relay request issued by the control center. The key distribution relay request includes a key distribution relay path and a key resource batch number selected for the path.

[0179] During the real-time connection phase of user key distribution, the source user node, as the initiator of key distribution, will send a key distribution request to the control center when it needs to establish secure communication with the target user node and complete the secure distribution of the key. The request asks the control center to provide quantum key distribution relay services, including planning key distribution relay paths and coordinating key resources of relay nodes, in order to support the subsequent key transmission and XOR operation process based on relay nodes.

[0180] At this point, the control center will query the cryptographic resource pool on the control center side to determine the available resources of each relay node under the planned key distribution relay path, select key resources based on the available resources to support the completion of key distribution under the planned key distribution relay path, and at the same time issue the selected key resource batch number to the relay node under the key distribution relay path.

[0181] It is worth noting that relay nodes are divided into two categories based on whether they are adjacent to user nodes. Relay nodes adjacent to users and relay nodes not adjacent to user nodes perform different operations. Here, user nodes include the source user node and the target user node under the planned path.

[0182] S240. If adjacent to a user node, retrieve the relay shared key bound to the selected key batch number from the local key resource pool, generate a user shared key with the adjacent user node through the quantum key distribution protocol, perform an XOR operation between the retrieved relay shared key and the user shared key generated by the adjacent user node, and upload the operation result to the control center.

[0183] In the key distribution relay path, for relay nodes that are not adjacent to user nodes, since they have already uploaded the XOR value of the shared key pre-generated with other relay nodes to the key resource pool on the control center side during the idle phase of relay key preparation, the control center can directly query and obtain the XOR value of such nodes from its key resource pool without having to upload it again in this step.

[0184] If the relay node is adjacent to a user node, after receiving the quantum key distribution relay request and the selected key resource batch number issued by the control center, it retrieves the pre-prepared relay shared key bound to the available key batch number from the key resource pool of the relay node based on the key resource batch number, and negotiates the generated user shared key with the adjacent user node through the quantum key distribution protocol. Then, it performs an XOR operation with the retrieved relay shared key to calculate a new XOR value, which is then uploaded to the control center.

[0185] Furthermore, each relay node has a local key resource pool, which stores the key resources pre-prepared by each relay node during idle time. The key XOR value is calculated based on a compressed set of key XOR relationships pre-issued by the control center after the relay node generates a relay shared key with other relay nodes connected via a quantum channel through a quantum key distribution protocol. The key resources in the local key resource pool are managed according to key resource batch numbers, and these batch numbers are consistent with the corresponding batch key resource batch numbers in the control center's key resource pool. Each time a relay node completes a key distribution relay, it needs to update the key resources in the key resource pool and delete used key resource information.

[0186] When a user requests a key in real time, a complete link needs to be established: "source user → relay → target user". The key in the "user-relay" link ( , The key is generated in real time and is not included in the pre-prepared resources. Therefore, it is necessary to first negotiate with the adjacent user node through the quantum key distribution protocol to generate a shared key, and then retrieve the pre-prepared shared key negotiated by the relay node and the adjacent relay node under the planned path from the local key resource pool. After that, the two shared keys are XORed to obtain a new XOR value, and the link is completed.

[0187] For example, suppose the determined key distribution relay path is: "Source user node A → Relay node 1 → Relay node 2 → Relay node 3 → Target user B", where relay node 3 is adjacent to target user node B.

[0188] After the control center issues the selected key resource batch number to relay node 3, relay node 3 first negotiates in real time with the target user node B via the BB84 protocol to generate a shared user key exclusive to both of them, denoted as . ;

[0189] Relay node 3 retrieves the relay shared key generated by another adjacent relay node 2 in the path from its local key resource pool, based on the issued key resource batch number. ;

[0190] 3 pairs of relay nodes and Perform an XOR operation to obtain the XOR value. ⊕ The XOR value is then uploaded to the control center to complete the calculation and reception of the XOR value between the relay nodes adjacent to the target user node.

[0191] Similarly, relay node 1 is adjacent to the source user node and generates a user shared key with the source user node. Then, relay node 1 retrieves the pre-prepared relay shared key for that path from its local resource pool. ,calculate And upload it to the control center.

[0192] S250. Update the local password resource pool and delete the relay shared key bound to the path selection key resource batch number.

[0193] Specifically, each time a key distribution relay process is completed, the relay node's key resource pool immediately triggers a local resource update: deleting the key resource information used in this distribution, i.e., the shared key bound to the path selection batch number. This mechanism ensures that the relay node's local resource pool and the key resource pool on the control center side maintain real-time information consistency, fundamentally avoiding the security risk of used keys being repeatedly invoked, and ensuring the accuracy of subsequent resource calls, preventing distribution delays or errors caused by invalid resource residues.

[0194] Example 3

[0195] This invention provides another centralized quantum key distribution relay method for user nodes. This method is suitable for large-scale quantum key distribution scenarios, especially those with a large number of relay nodes, complex topologies, and the need for ad-hoc planning of key distribution relay paths. This method can be executed by a user quantum key distribution device, which can be implemented in hardware and / or software and integrated into the user server.

[0196] It is worth noting that this embodiment is implemented based on the relevant content of Embodiments 1 and 2. It includes the establishment of a relay node topology graph by the control center, where the nodes in the topology graph are the currently connected relay nodes, and the edges of the topology graph represent the quantum channel association relationships between relay nodes for key distribution. Based on the relay node topology graph, information on all relay nodes with edge associations to each relay node is summarized to construct a relay node connection set. Based on this relay node connection set, the pairwise XOR logical relationships between the relay node and other relay nodes in the set for subsequent negotiation to generate shared keys are enumerated to generate a key XOR relationship set for each relay node. The union of the key XOR relationship sets for each relay node is calculated. The process involves obtaining an initial set of XOR relationships for all relay node keys; compressing the initial set of XOR relationships based on the relay node topology graph to obtain a compressed set of XOR relationships; distributing the compressed set and the corresponding key resource batch number to each relay node; receiving the shared key XOR value generated by each relay node based on the compressed set of XOR relationships, wherein the shared key XOR value is bound to the key resource batch number; completing the shared key XOR value based on the relay node topology graph, the initial set of XOR relationships, and the shared key XOR values ​​uploaded by the relay nodes to obtain a full set of key XOR values ​​corresponding to the key resource batch number; and establishing a key resource pool based on the full set of key XOR values.

[0197] Meanwhile, the relay node generates a relay shared key with other relay nodes connected to the quantum channel through the quantum key distribution protocol based on the key XOR relationship compressed set and the corresponding key resource batch number received from the control center. The key is then stored in the local key resource pool based on the corresponding key resource batch number, which will not be elaborated here.

[0198] The implementation method of this embodiment includes:

[0199] When the user node is the source user node:

[0200] S310, Initiate a user key distribution request to the control center.

[0201] The source user node initiates a user key distribution request to the control center, and the request must include key identification information of the target user node, such as the target user node's device ID and unique node number. The purpose is to clarify the communication endpoint for key distribution for the control center, ensuring that the control center can accurately calculate the feasible key distribution relay path between the source and target user nodes based on a pre-defined relay node topology diagram, providing a core basis for subsequent key relay transmission link planning.

[0202] S320, Receive the key distribution relay path and the batch number of the key resource for the path selection issued by the control center.

[0203] The source user node receives the quantum key distribution relay path and the key resource batch number selected for the path from the control center. This path is usually the optimal path selected by the control center based on the relay node topology diagram. The selection criteria include high real-time key generation rate of the channel, small number of relay nodes, and strong link stability, which can ensure the efficiency and reliability of subsequent key transmission.

[0204] For example, suppose the key distribution relay path is: "Source user node A → Relay node 1 → Relay node 2 → Relay node 3 → Target user B". Based on the key distribution intermediate path, the relay node adjacent to the source user node A under this path can be determined as relay node 1.

[0205] S330. Generate a distribution key to be distributed to the target user node using a quantum random number generator.

[0206] The source user node generates a shared key to be distributed to the target user node through a quantum random number generator. This key is called the distribution key. It is the core foundation for secure communication between the two parties. The generation action has flexible execution timing and can be completed before initiating a key distribution request to the control center. Early generation can effectively shorten the overall time of the subsequent key distribution process and better adapt to the key response efficiency requirements of high-bandwidth data encryption in large-scale scenarios.

[0207] The distribution key is generated independently by the source user node. Relying on the physical characteristics of the quantum random number generator, it can ensure that the key has the true randomness required for information theory security, avoiding the potential security risks of traditional random number generation methods. At the same time, to strictly ensure key security, after the key is generated by the source user node, it only needs to be temporarily stored according to the actual process requirements or directly used for immediate calculation after generation and destroyed after the calculation is completed. It is directly transmitted to other nodes without passing through any classical or quantum channels, completely avoiding the risk of being eavesdropped or tampered with during direct transmission.

[0208] For example, suppose the quantum random number generated by the source user node A based on the quantum random number generator is: ,Will It is sent as a distribution key to the target user node B.

[0209] S340. Relay nodes adjacent to the key distribution relay path generate user-shared keys through the quantum key distribution protocol.

[0210] The source user node first locates an adjacent relay node with a direct quantum channel connection to itself, based on the key distribution relay path issued by the control center on the S320. Then, it performs point-to-point quantum key distribution with this adjacent relay node using quantum key distribution protocols such as BB84. The distribution process relies on the quantum optics modules of both parties to complete quantum state transmission and key selection, ultimately generating a shared key known only to the user node and the adjacent relay node; this is referred to as the user shared key. Simultaneously, this user shared key must be bound to the corresponding batch number of available key resources issued by the control center to prevent confusion of key resources from different rounds when transmitted back to the control center.

[0211] For example, since relay node 1 in the key distribution relay path is adjacent to the source user node A, and both source user node A and relay node 1 initiate the user shared key generation operation after receiving the key distribution relay path issued by the control center, they generate the user shared key through quantum key distribution protocols such as BB84. .

[0212] S350: Calculate the XOR value between the distribution key and the user shared key, and upload the XOR value to the control center.

[0213] First, the distribution key generated in step S340 using a quantum random number generator and to be transmitted to the target user node is retrieved, along with the user-shared key generated with adjacent relay nodes on the key distribution relay path via the quantum key distribution protocol. Then, an XOR operation is performed on these two keys according to the XOR rule to obtain the XOR value of the shared key. This avoids directly transmitting the original shared key and generates crucial intermediate data for the control center to subsequently deduce the key required by the target user node. Finally, the source user node uploads this XOR value to the control center via a trusted classical encryption channel. During upload, the XOR value must be bound to the batch number of available key resources of adjacent relay nodes to ensure that the control center can accurately associate the XOR value with the pre-prepared key resources of the corresponding path.

[0214] For example, the distribution key generated by the source user node Shared key with user Perform an XOR operation and output the result. Upload to the control center.

[0215] When the user node is the target user node:

[0216] S310' Receive the key distribution relay path and the batch number of the key resources selected for the path issued by the control center.

[0217] Similar to S320, the target user node also needs to receive the quantum key distribution relay path between itself and the control center.

[0218] S320': A user-shared key is generated by adjacent relay nodes on the key distribution relay path via the quantum key distribution protocol. The user-shared key is XORed with the relay shared key retrieved by the adjacent relay node from its local resource pool and whose key resource batch number matches the path selection. The result of the XOR operation is uploaded by the adjacent relay node to the control center.

[0219] Similar to step S340, the target user node first locates the adjacent relay node with which it has a direct quantum channel connection based on the key distribution relay path issued by the control center in S310', and then performs point-to-point quantum key distribution with the adjacent relay node through quantum key distribution protocols such as BB84 to generate a user shared key.

[0220] Adjacent relay nodes need to query the pre-prepared relay shared key from the local cryptographic resource pool based on the selected key resource batch number issued by the control center, and negotiate the generated relay shared key with another adjacent relay node under the planned path. The queried relay shared key is then XORed with the user shared key to obtain the XOR value, which is then uploaded to the control center by the adjacent relay node.

[0221] S330' Receive the quantum key distribution relay XOR result obtained by the control center based on the XOR operation of each node under the key distribution relay path. The quantum key distribution relay XOR result is the result of the control center XORing and merging the XOR values ​​of each shared key according to the adjacency order of the nodes under the key distribution relay path.

[0222] The control center first collects the XOR values ​​uploaded by the source user nodes and the XOR values ​​uploaded by the relay nodes adjacent to the user nodes along the path. Then, it queries the full set of XOR values ​​of the relay nodes' keys on the control center side for the pre-prepared XOR values ​​of the non-adjacent intermediate relay nodes along the path, thereby constructing a complete XOR value link covering "source user - relay - target user". Subsequently, the control center performs XOR operations on these XOR values ​​sequentially according to the node order of the key distribution relay path, merging them and performing non-union operations to cancel out intermediate key items, finally obtaining the quantum key distribution relay XOR result, and then sending it to the target user node.

[0223] For example, suppose the key distribution relay path is: "Source user node A → Relay node 1 → Relay node 2 → Relay node 3 → Target user B", and the control center receives... , , Then, based on the current key resource batch number, extract from the full set X of XOR values ​​corresponding to the current key resource batch number. The XOR value of this key is the XOR value that the relay node prepares in advance and uploads to the control center.

[0224] The control center performs an XOR operation on the XOR values ​​according to the adjacent order under the key distribution relay path: ,but XOR the result of the quantum key distribution relay, and calculate the result, and... Send to target user node B.

[0225] S340': Perform an XOR operation between the result of the quantum key distribution relay and the user shared key to obtain the distribution key sent by the source user node.

[0226] The target user node performs core operations to obtain the distribution key transmitted by the source user node. First, the node calls the user shared key generated in real time by the adjacent relay node on the key distribution relay path; then, it performs an XOR operation again with the XOR result of the received quantum key distribution relay. Relying on the property that the XOR operation can cancel out intermediate terms by XORing the same data twice, the intermediate data of the relay shared key is canceled out, and the shared key originally generated and to be distributed by the source user node is restored.

[0227] For example, target user B receives Then, through calculation: This will allow you to obtain the key distributed by the source user node A. .

[0228] Preferably, user nodes can receive only the key distribution relay path and do not need to receive the key resource batch number selected under the key distribution relay path. This is because user nodes do not directly call the key resources corresponding to the batch number in the entire key distribution process. Their core operations are only concentrated in negotiating with adjacent relay nodes to generate user shared keys, performing XOR operations, and uploading results. They do not need to participate in the key resource batch management within the relay nodes.

[0229] Example 4

[0230] The present invention also proposes a quantum key distribution network controller, which includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the quantum key distribution relay method based on centralized control described in Embodiment 1, and has the corresponding functional modules and beneficial effects of the execution method.

[0231] Figure 2 This is a schematic diagram of a quantum key distribution network controller provided in an embodiment of this application. The quantum key distribution network controller can be a server, and includes a processor, a memory, and a network interface connected via a system bus. The memory may include a non-volatile storage medium and internal memory. The non-volatile storage medium may store an operating system and a computer program. The computer program includes program instructions, which, when executed, cause the processor to execute any relay method for centralized quantum network key resource management. The processor provides computational and control capabilities to support the operation of the entire computer device. The internal memory provides an environment for the execution of the computer program in the non-volatile storage medium; when executed by the processor, this computer program causes the processor to execute any relay method for centralized quantum network key resource management. The network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 2 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0232] Example 5

[0233] like Figure 3 As shown, the present invention also proposes a centralized quantum key distribution relay system, comprising: a control center, relay nodes, and user nodes, wherein adjacent relay nodes in the key distribution relay path are connected through quantum channels, and user nodes are connected to adjacent relay nodes in the key distribution relay path through trusted classical encryption channels; the control center is connected to relay nodes and user nodes through trusted classical encryption channels.

[0234] The control center is used for: creating a relay node topology graph and constructing a connection set; enumerating key XOR relationships to form an initial set of key XOR relationships, compressing it, and then distributing it to the relay nodes; receiving shared key XOR values ​​uploaded by relay nodes and completing them into a full set of key XOR values; receiving requests from source user nodes and calculating key distribution relay paths; retrieving key resource batch numbers and distributing them to each node along the path; receiving XOR values ​​calculated by the source user node and adjacent relay nodes along the path; obtaining missing XOR values ​​and performing XOR operations according to the adjacent order of path nodes; and sending the results to the target user node.

[0235] Relay nodes are used for: receiving compressed sets and key resource batch numbers issued by the control center; generating and storing shared keys with adjacent relay nodes via the quantum key distribution protocol and calculating their XOR values ​​during idle time; receiving key distribution requests and selection batch numbers; if adjacent to a user node, retrieving the shared key generated and stored during idle time that is bound to the selected key batch number, generating a user shared key with the user, calculating their XOR values ​​and uploading it; updating the local password resource pool; and deleting the shared key bound to the path selection key resource batch number.

[0236] User nodes consist of source user nodes and target user nodes. The source user node initiates a key distribution request, receives the key distribution relay path planned by the control center, generates a distribution key to be distributed to the target user node, generates a relay shared key with adjacent relay nodes along the path, calculates the XOR value of the distribution key and the relay shared key, and uploads it. The target user node receives the key distribution relay path, generates a user shared key with adjacent relay nodes along the key distribution relay path, performs an XOR operation with the pre-prepared relay shared key locally invoked by adjacent relay nodes, and uploads it to the control center. The target user node receives the quantum key distribution relay XOR result issued by the control center, performs an XOR operation with the user shared key generated by the target user node, and obtains the shared key of the source user node.

[0237] Those skilled in the art should understand that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the appended claims. It should be understood that various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of the present invention can be achieved, and this is not limited herein.

Claims

1. A centralized management-based quantum key distribution relay method, applied to a management center, and characterized in that, The method comprises the following steps: establishing a relay node topology relationship diagram, wherein the nodes in the topology relationship diagram are the currently accessed relay nodes, and the edges are the key distribution quantum channel association relationships between the relay nodes; aggregating the node information associated with the nodes having edges associated with each relay node, enumerating the exclusive or logical relationships between each relay node and the associated relay nodes to be generated subsequently, and generating a key exclusive or relationship set of each relay node; calculating the union set of the key exclusive or relationship set of each relay node to obtain an initial key exclusive or relationship set; performing set compression on the initial key exclusive or relationship set to obtain a compressed key exclusive or relationship set and issuing the set to each relay node; receiving the generated shared key exclusive or value of each relay node, performing shared key exclusive or value completion, and obtaining a full key exclusive or value set; receiving a key distribution request of a source user node, calculating a key distribution relay path based on the relay node topology relationship diagram, selecting a key from a key resource pool, and issuing the key distribution relay path and the selected key resource batch number to each node on the path; receiving the exclusive or value provided by the source user node and the adjacent relay node of the user node on the key distribution relay path; querying the key resource pool based on the full key exclusive or value set, obtaining the missing key exclusive or value on the key distribution relay path, performing exclusive or merging on each shared key exclusive or value in the order of the adjacency of the path nodes, and sending the result to the target user node.

2. The method of claim 1, wherein, The method comprises the following steps:

3. The method of claim 1, wherein, The key exclusive or relationship set, the initial key exclusive or relationship set, the compressed key exclusive or relationship set, the full key exclusive or value set, and the key resource batch number are bound, and the key resource batch number comprises a key exclusive or value generation batch number, a validity period, and a corresponding relay node topology relationship diagram version number. The key exclusive or relationship set, the initial key exclusive or relationship set, the compressed key exclusive or relationship set, the full key exclusive or value set, and the key resource batch number are bound, and the key resource batch number comprises a key exclusive or value generation batch number, a validity period, and a corresponding relay node topology relationship diagram version number.

4. The method of claim 1, wherein, The receiving source user node key distribution request, calculating the key distribution relay path based on the relay node topology relationship diagram, selecting the key from the key resource pool, and issuing the key distribution relay path and the selected key resource batch number to each node under the path, including: the key distribution request of the source user node includes: target node identification, key distribution number, key distribution period; when the key distribution number is multiple, the key resource pool determines the key resource batch number of each relay node to be called based on the key distribution period.

5. The method of claim 1, wherein, Receiving the shared key XOR value generated by each relay node, performing shared key XOR value completion to obtain the full set of key XOR values, including: determining all preset key XOR relationships in the set based on the relay node topology relationship diagram and the key XOR relationship union; comparing each received shared key XOR value generated by the relay node with the preset key XOR relationship one by one, and screening out the key XOR relationship that has not been uploaded; performing a secondary XOR operation on the shared key XOR value of each relay node that has been uploaded to obtain the XOR value corresponding to the unuploaded key XOR relationship; merge the shared key XOR value generated by the relay node with the XOR value corresponding to the unuploaded key XOR relationship to obtain the full set of key XOR values covering all preset relationships in the key XOR relationship union.

6. The method of claim 1, wherein, Receiving the XOR value provided by the source user node and the adjacent relay node of the user node under the key distribution relay path, including: receiving the XOR value of the source user node: the XOR value is obtained by performing XOR operation on the distribution key and the user shared key, wherein the distribution key is the key generated by the source user node to be distributed to the target user node, and the user shared key is the shared key generated by the source user node and the adjacent relay node under the key distribution relay path through the quantum key distribution protocol; receiving the XOR value of the adjacent relay node of the user node: the XOR value is obtained by performing XOR operation on the user shared key and the relay shared key, wherein the user shared key is generated by the user node and the adjacent relay node under the key distribution relay path through the quantum key distribution protocol, and the relay shared key is generated by the adjacent relay node and the adjacent relay node based on the quantum key distribution protocol; the adjacent relay node of the user node is the relay node adjacent to the source user node and the target user node under the key distribution relay path.

7. The method of claim 1, wherein, The key resource pool is divided and managed according to the key resource batch number, each key resource batch number stores the full set of key XOR values corresponding thereto, and the elements in the full set of key XOR values of the same batch number are stored according to the relay node partition; the key resource pool updates the key resource after completing the key distribution relay each time, and deletes the key resource information used in the key distribution relay path. 8.A centralized management and control based quantum key distribution relay method, applied to a relay node, and having the characteristics that, including: The receiving management center issues a key XOR relationship compression set and corresponding key resource batch number; other relay nodes connected to the quantum channel generate relay shared keys through a quantum key distribution protocol, store them in a local key resource pool based on the corresponding key resource batch number, and calculate the XOR value of the relay shared keys corresponding to the key XOR relationship based on the key XOR relationship compression set and return it to the management center; the receiving management center issues a key distribution relay request, which includes a key distribution relay path and the key resource batch number selected for the path; if adjacent to a user node, the relay shared key bound to the selected key resource batch number is retrieved from the local key resource pool, a user shared key is generated with the adjacent user node on the key distribution relay path through a quantum key distribution protocol, the retrieved relay shared key is XORed with the user shared key generated by the adjacent user node, and the operation result is uploaded to the management center; the local password resource pool is updated, and the relay shared key bound to the key resource batch number selected for the path is deleted; wherein the local key resource pool stores the relay shared keys generated in advance by each relay node and the adjacent relay node through a quantum key distribution protocol during idle time, which are calculated based on the key XOR relationship compression set issued by the management center; the key resources in the local key resource pool are managed according to the key resource batch number, and the key resource batch number is consistent with the key resource batch number of the corresponding batch in the key resource pool on the management center side; the key resource pool updates the key resources and deletes the used key resource information after each key distribution relay is completed. 9.A centralized management and control based quantum key distribution relay method, applied to a user node, and characterized in that, It includes: When the user node is a source user node: initiate a key distribution request to the management center; receive the key distribution relay path and the key resource batch number selected for the path issued by the management center; generate a distribution key to be distributed to a target user node through a quantum random number generator; The adjacent relay nodes on the key distribution relay path generate a user shared key through a quantum key distribution protocol; calculate the XOR value of the distribution key and the user shared key, and upload the XOR value to the management center; when the user node is a target user node: receive the key distribution relay path and the key resource batch number selected for the path issued by the management center; generate a user shared key through a quantum key distribution protocol with the adjacent relay nodes on the key distribution relay path; the user shared key is XORed with the relay shared key matching the key resource batch number selected for the path, which is called by the adjacent relay node from the local resource pool, and the XOR operation result is uploaded to the management center by the adjacent relay node; receive the quantum key distribution relay XOR result obtained by the XOR operation of each node on the key distribution relay path based on the quantum key distribution relay XOR result issued by the management center; the quantum key distribution relay XOR result is the result of XOR combining each shared key XOR value in the order of node adjacency on the key distribution relay path by the management center; perform XOR operation on the quantum key distribution relay XOR result and the user shared key to obtain the distribution key sent by the source user node.

10. A quantum key distribution network controller, characterized by, The quantum key distribution network controller comprises a memory and a processor, wherein the processor runs a program corresponding to executable program code stored in the memory by reading the executable program code, to implement the centralized management-based quantum key distribution relay method according to any one of claims 1-7.

11. A centralized management quantum key distribution relay system, comprising a management center, a relay node, and a user node, characterized in that: The management center is configured to execute the method according to claims 1-7; the relay node is configured to execute the method according to claim 8; and the user node is configured to execute the method according to claim 9.

Images