Key charging method and authentication method for quantum local area network

Abstract

The invention discloses a key charging method and an authentication method for a quantum local area network. The quantum local area network comprises a quantum key charging machine, a first centralized control station, a first target key distribution center and a second target key distribution center, and the method comprises the steps that the quantum key charging machine sends a key charging request to the first centralized control station, and the key charging request comprises a first key charging request. And under the condition that the key charging request is a first key charging request, the first centralized control station sends a first quantum key in the generated cross-domain authentication key to a second target key distribution center. The second target key distribution center stores the first quantum key. And the first centralized control station sends a second quantum key in the cross-domain authentication key and the cross-domain authentication identification information to the quantum key charging machine. And the quantum key charging machine performs charging processing on the terminal key storage medium according to the second quantum key and the cross-domain authentication identification information. In this way, the preset correspondence of the cross-domain key is realized, so that the cross-domain authentication process is simplified.

Description

Technical Field

[0001] This application relates to the field of quantum encrypted communication, and more specifically, to a key injection method, a terminal key storage medium, and an authentication method for quantum local area networks. Background Technology

[0002] Quantum communication has become an important technology in current communication methods, capable of providing quantum-encrypted communication services. When initiating quantum communication, a quantum key is randomly selected from the key storage device to establish a connection with the backend and verify identity information, achieving quantum-encrypted authentication to ensure communication security. However, key distribution centers in different quantum local area networks cannot share pre-set keys. During the cross-regional transition phase, quantum communication services require cross-domain auxiliary authentication, a complex process that may lead to excessive latency or interruption of quantum communication services during cross-regional transitions. Summary of the Invention

[0003] This application provides a key filling method, a terminal key storage medium, and an authentication method for quantum local area networks.

[0004] This application provides a key injection method for a quantum local area network (QLAN). The QLAN includes a quantum key injection machine, a first control station, a first target key distribution center, and a second target key distribution center. The second target key distribution center and the first target key distribution center are located in different QLANs, while the first target key distribution center and the quantum key injection machine are located in the same QLAN. The method includes: The quantum key injector sends a key injecting request to the first central control station, the key injecting request including a first key injecting request; When the key injection request is the first key injection request, the first central control station will send the first quantum key in the generated cross-domain authentication key to the second target key distribution center; The second target key distribution center stores the first quantum key; The first centralized control station sends the second quantum key and cross-domain authentication identification information from the cross-domain authentication key to the quantum key filling machine, wherein the cross-domain authentication identification information is associated with the location information of the second target key distribution center; The quantum key filling machine fills the terminal key storage medium with the second quantum key and the cross-domain authentication identifier information.

[0005] Thus, the quantum key injector sends a key injecting request to the first central control station, which includes a first key injecting request. Next, when the key injecting request is the first key injecting request, the first central control station sends the first quantum key from the generated cross-domain authentication key to the second target key distribution center. Subsequently, the second target key distribution center stores the first quantum key. Then, the first central control station sends the second quantum key and cross-domain authentication identification information from the cross-domain authentication key to the quantum key injector, where the cross-domain authentication identification information is associated with the location information of the second target key distribution center. Finally, the quantum key injector injects the terminal key storage medium according to the second quantum key and the cross-domain authentication identification information. In this way, by sending and storing the first quantum key to the second target key distribution center across the quantum local domain, and simultaneously injecting the terminal key storage medium with the second quantum key associated with its location information and the cross-domain authentication identification information, pre-configured correspondence of cross-domain keys is achieved, thereby simplifying the cross-domain authentication process. Furthermore, the cross-domain authentication identification information is associated with the location information of the second target key distribution center, enabling the terminal device to quickly complete authentication by matching the corresponding key distribution center through the identification information after crossing domains, without the need for additional cross-domain verification steps, thereby improving the authentication efficiency of quantum encrypted communication across quantum local area networks.

[0006] In some embodiments, the quantum local area network further includes a second central control station, and the method further includes: If the second control station receives an encryption assistance request sent by the quantum key injection machine, the second control station generates an auxiliary symmetric key, which includes an auxiliary encryption key and an auxiliary decryption key; The second control station sends the auxiliary encryption key to the first control station; The second central control station sends the auxiliary decryption key to the second target key distribution center and the quantum key filling machine.

[0007] Thus, if the second control station receives an encryption assistance request from the quantum key injector, it generates an auxiliary symmetric key, which includes an auxiliary encryption key and an auxiliary decryption key. Next, the second control station sends the auxiliary encryption key to the first control station. Finally, the second control station sends the auxiliary decryption key to the second target key distribution center and the quantum key injector. In this way, by introducing the auxiliary symmetric key generated by the second control station, the first control station uses the auxiliary encryption key to encrypt the quantum symmetric key before transmission, and the second target key distribution center and the quantum key injector decrypt the key using the auxiliary decryption key. This avoids the risk of plaintext leakage when the first control station and the quantum key injector transmit the key over a classical network, reducing the possibility of key eavesdropping or theft.

[0008] In some embodiments, the method further includes: The first centralized control station encrypts the first quantum key according to the auxiliary encryption key to determine the first encrypted information; The first centralized control station sends the first encrypted information to the second target key distribution center; The first centralized control station encrypts the second quantum key and the cross-domain authentication identifier information according to the auxiliary encryption key to determine the second encrypted information; The first central control station sends the second encrypted information to the quantum key injection machine.

[0009] Thus, the first control station encrypts the first quantum key using the auxiliary encryption key to determine the first encrypted information. Next, the first control station sends the first encrypted information to the second target key distribution center. Then, the first control station encrypts the second quantum key and cross-domain authentication identifier information using the auxiliary encryption key to determine the second encrypted information. Finally, the first control station sends the second encrypted information to the quantum key injection machine. This ensures that only the second target key distribution center and the quantum key injection machine, which possess the auxiliary decryption key, can decrypt and obtain valid information. Even if an unauthorized party intercepts the transmitted encrypted information, they cannot crack the original quantum key and identifier information, thereby effectively reducing the risk of key eavesdropping, theft, and misuse during transmission, and further ensuring the security of the cross-domain quantum key injection process.

[0010] In some embodiments, the method further includes: The second target key distribution center decrypts the first encrypted information using the auxiliary decryption key to obtain the first quantum key; The quantum key injection machine decrypts the second encrypted information according to the auxiliary decryption key to obtain the second quantum key and the cross-domain authentication identifier information; The quantum key filling machine fills the terminal key storage medium with the second quantum key and the cross-domain authentication identifier information.

[0011] Thus, the second target key distribution center decrypts the first encrypted information using the auxiliary decryption key to obtain the first quantum key. Next, the quantum key injection machine decrypts the second encrypted information using the auxiliary decryption key to obtain the second quantum key and cross-domain authentication identifier information. Finally, the quantum key injection machine injects the terminal key storage medium using the second quantum key and cross-domain authentication identifier information. This ensures that only authorized parties who have obtained the auxiliary decryption key beforehand can correctly obtain the first quantum key, the second quantum key, and the cross-domain authentication identifier information. Unauthorized parties, even if they intercept the encrypted information, cannot decrypt it to obtain valid content, thereby avoiding the risk of key theft and misuse during transmission and injection.

[0012] In some implementations, the key injection request further includes a second key injection request, the second key injection request being used to request a local area network authentication key, and the method further includes: In the case that the key filling request is the second key filling request, the first centralized control station sends the third quantum key from the local area network authentication key to the first target key distribution center based on the quantum channel; The first target key distribution center stores the third quantum key; The first centralized control station, based on a classical network, sends the fourth quantum key from the local area network authentication key and the local area network authentication identification information corresponding to the fourth quantum key to the quantum key filling machine. The local area network authentication identification information is associated with the location information of the first target key distribution center. The quantum key filling machine fills the terminal key storage medium with the fourth quantum key and the local area network authentication identifier information.

[0013] Thus, when the key filling request is the second key filling request, based on the quantum channel, the first central control station sends the third quantum key from the local area network authentication key to the first target key distribution center. Next, the first target key distribution center stores the third quantum key. Then, based on the classical network, the first central control station sends the fourth quantum key from the local area network authentication key and the corresponding local area network authentication identifier to the quantum key filling machine. The local area network authentication identifier is associated with the location information of the first target key distribution center. Finally, the quantum key filling machine fills the terminal key storage medium according to the fourth quantum key and the local area network authentication identifier. In this way, sending the third quantum key to the first target key distribution center within the same local area network via the quantum channel utilizes the security of the quantum encryption channel to ensure the security and reliability of the keys stored in the key distribution centers within the local area network. Simultaneously, sending the fourth quantum key and the local area network authentication identifier associated with the location of the first target key distribution center to the quantum key filling machine via the classical network establishes a correspondence between the keys filled in the terminal key storage medium and the key distribution centers within the same quantum local area network.

[0014] In some implementations, the key injection request further includes a third key injection request, which is used to request a targeted authentication key. The method further includes: If the key injection request is the third key injection request, the first central control station will send the fifth quantum key from the generated targeted authentication key to the first target key distribution center; The first target key distribution center stores the fifth quantum key; The first centralized control station stores the sixth quantum key from the targeted authentication key; Based on a preset encryption algorithm, the first centralized control station encrypts the sixth quantum key and the directional authentication identifier information corresponding to the directional authentication key to generate first confidential information, wherein the directional authentication identifier information is associated with the location information of the first centralized control station; The first centralized control station sends the first confidential information to the quantum key injection machine; The quantum key filling machine fills the terminal key storage medium with the first confidential information.

[0015] Thus, when the key injection request is the third key injection request, the first centralized control station sends the fifth quantum key from the generated targeted authentication key to the first target key distribution center. Next, the first target key distribution center stores the fifth quantum key. Then, the first centralized control station stores the sixth quantum key from the targeted authentication key. Next, based on a preset encryption algorithm, the first centralized control station encrypts the sixth quantum key and the targeted authentication identifier information corresponding to the targeted authentication key to generate first confidential information, wherein the targeted authentication identifier information is associated with the location information of the first centralized control station. Subsequently, the first centralized control station sends the first confidential information to the quantum key injection machine. Finally, the quantum key injection machine injects the terminal key storage medium according to the first confidential information. In this way, by sending the fifth quantum key from the targeted authentication key to the first target key distribution center for storage, while the first centralized control station itself stores the sixth quantum key, a key correspondence relationship is established between the key distribution center and the centralized control station, providing a foundation for authentication in subsequent targeted scenarios. Furthermore, the targeted authentication identifier information is associated with the location information of the first centralized control station, which means that the targeted authentication key filled in the terminal key storage medium can only be matched with that specific centralized control station, thus strictly limiting the service range.

[0016] This application provides a terminal key storage medium that stores a targeted authentication key, a local area network authentication key, a cross-domain authentication key, targeted authentication identification information corresponding to the targeted authentication key, local area network authentication identification information corresponding to the local area network authentication key, and cross-domain authentication identification information corresponding to the cross-domain authentication key, all obtained by key injection based on the above-described key injection method.

[0017] Thus, the structure of the terminal key storage medium, which stores directional authentication keys, local area network authentication keys, cross-domain authentication keys, and corresponding identification information, achieves orderly management of different types of quantum keys. Furthermore, it enables terminal devices to quickly match the corresponding authentication key and identification information from the terminal key storage medium based on the service type and location information when requesting different types of quantum encrypted communication services, simplifying the authentication process.

[0018] This application provides an authentication method based on the aforementioned terminal key storage medium, the method comprising: In response to the key service selection operation, determine the target service type; Based on the target service type and the current location information of the sending terminal, the target authentication key and the target identification information corresponding to the target authentication key are obtained from the terminal key storage medium. Identity authentication is performed based on the target authentication key and the target identification information.

[0019] In response to the key service selection operation, the target service type is determined. Next, based on the target service type and the current location information of the sending terminal, the target authentication key and the corresponding target identification information are retrieved from the terminal's key storage medium. Finally, authentication is performed based on the target authentication key and the target identification information. This approach, by combining the target service type and the sending terminal's current location information to select the corresponding key and identification information for authentication, ensures the targeting and accuracy of the authentication process. Furthermore, dynamically selecting the authentication key based on the service type and the sending terminal's current location information simplifies the authentication process in different scenarios.

[0020] In some implementations, the target service type includes a first type of service, and the step of obtaining a target authentication key and target identification information corresponding to the target authentication key from the terminal key storage medium based on the target service type and the current location information of the sending terminal includes: When the target service type is a first type of service, first target identification information that matches the current location information is filtered from the identification information stored in the terminal key storage medium; If the first target identification information exists in the terminal key storage medium, a local area network authentication key corresponding to the first target identification information is randomly selected from the terminal key storage medium to confirm the target authentication key.

[0021] Thus, when the target service type is Type I, the system filters the identification information stored in the terminal key storage medium to select the first target identification information that matches the current location information. Next, if the first target identification information exists in the terminal key storage medium, the system randomly selects the local area network (LAN) authentication key corresponding to the first target identification information from the terminal key storage medium to confirm the target authentication key. By filtering the first target identification information that matches the current location information, the system ensures that in Type I service scenarios, the terminal device only calls the LAN authentication key corresponding to the key distribution center of the current quantum LAN, avoiding incorrect key use across LANs and ensuring authentication accuracy. Furthermore, by quickly locating the required key through matching the current location information with the identification information, the system simplifies the authentication steps within the quantum LAN, avoids unnecessary cross-domain verification, and thus improves the authentication efficiency of quantum encrypted communication within the quantum LAN.

[0022] In some embodiments, the method further includes: If the first target identifier information is not present in the terminal key storage medium, the authentication process is interrupted.

[0023] Thus, if the first target identification information is not present in the terminal key storage medium, the authentication process is interrupted. This prevents unauthorized devices from accessing the encrypted communication services of the quantum local area network, avoids information leakage or network security risks caused by unauthorized access, and ensures that only legitimate terminal devices that have been pre-loaded with the corresponding authentication key can pass authentication, thereby maintaining the security and control effectiveness of services within the quantum local area network.

[0024] In some embodiments, the method further includes: If the terminal key storage medium does not contain a local area network authentication key corresponding to the first target identification information, the authentication process is interrupted.

[0025] Thus, if the terminal key storage medium does not contain a local area network authentication key corresponding to the first target identification information, the authentication process is interrupted. This effectively prevents unauthorized devices from accessing the encrypted communication service of the quantum local area network, avoiding the risk of unauthorized access due to a missing authentication key.

[0026] In some implementations, the target service type includes a second type of service, and the step of obtaining the target authentication key from the terminal key storage medium based on the target service type and the location information of the sending terminal includes: When the target service type is the second type of service, second target identification information that matches the current location information is filtered from the identification information stored in the terminal key storage medium; If the target identification information exists in the terminal key storage medium, a targeted authentication key corresponding to the second target identification information is randomly selected from the terminal key storage medium to confirm the target authentication key.

[0027] Thus, when the target service type is the second type of service, the system filters the identification information stored in the terminal key storage medium to select the second target identification information that matches the current location information. Next, if the target identification information exists in the terminal key storage medium, a targeted authentication key corresponding to the second target identification information is randomly selected from the terminal key storage medium to confirm the target authentication key. In this way, by filtering the second target identification information that matches the current location information, it ensures that in the second type of service scenario, the terminal device only calls the targeted authentication key of the specific central control station corresponding to the current local scenario, strictly limiting the service scope and achieving precise control over the users of a single service type.

[0028] In some embodiments, the method further includes: If the second target identification information is not present in the terminal key storage medium, the authentication process is interrupted.

[0029] Thus, if the second target identification information is not present in the terminal key storage medium, the authentication process is interrupted. This prevents unauthorized devices from accessing the encrypted communication services of the quantum local area network, avoids information leakage or network security risks caused by unauthorized access, and ensures that only legitimate terminal devices that have been pre-loaded with the corresponding authentication key can pass authentication, thereby maintaining the security and control effectiveness of services within the quantum local area network.

[0030] In some embodiments, the method further includes: If the terminal key storage medium does not contain a targeted authentication key corresponding to the second target identification information, the authentication process is interrupted.

[0031] Thus, if the terminal key storage medium does not contain a targeted authentication key corresponding to the second target identification information, the authentication process is interrupted. This effectively prevents unauthorized devices from accessing the encrypted communication services of the quantum local area network, avoiding the risk of unauthorized access due to a missing authentication key.

[0032] In some implementations, the step of performing identity authentication based on the target authentication key and the target identification information includes: The target authentication key is sent to the target node, so that the target node can perform a key comparison based on the target authentication key and its own pre-stored authentication key, thereby confirming the quantum local area network access permission of the sending terminal. The target node is a network node in the quantum local area network associated with the target identification information.

[0033] Thus, the target authentication key is sent to the target node, allowing the target node to compare the target authentication key with its own pre-stored authentication key, thereby confirming the sending terminal's access permission to the quantum local area network (QLAN). The target node is a network node in the QLAN associated with the target identification information. By sending the target authentication key to the target node associated with the target identification information and having the target node perform the key comparison, unauthorized devices can be effectively prevented from accessing the QLAN, ensuring network security. Furthermore, authentication is completed through direct key comparison, simplifying the authentication process and improving authentication efficiency.

[0034] Additional aspects and advantages of embodiments of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of embodiments of this application. Attached Figure Description

[0035] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, wherein: Figure 1 This is one of the flowcharts illustrating the key filling method according to an embodiment of this application; Figure 2 This is a second flowchart illustrating the key filling method according to an embodiment of this application; Figure 3 This is the third flowchart illustrating the key filling method according to the embodiments of this application; Figure 4 This is the fourth flowchart illustrating the key filling method according to the embodiments of this application; Figure 5 This is the fifth flowchart illustrating the key filling method according to the embodiments of this application; Figure 6 This is the sixth flowchart illustrating the key filling method according to the embodiments of this application; Figure 7 This is one of the flowcharts illustrating the authentication method of the embodiments of this application; Figure 8 This is a second flowchart illustrating the authentication method of the implementation method of this application; Figure 9 This is the third flowchart illustrating the authentication method of the implementation method of this application; Figure 10 This is the fourth flowchart illustrating the authentication method of the implementation method of this application; Figure 11 This is the fifth flowchart illustrating the authentication method of the implementation method of this application; Figure 12 This is the sixth flowchart illustrating the authentication method of the implementation method of this application; Figure 13 This is the seventh flowchart illustrating the authentication method of the embodiments of this application; Figure 14 This is the eighth flowchart illustrating the authentication method of the implementation method of this application. Detailed Implementation

[0036] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the embodiments of this application, and should not be construed as limiting the embodiments of this application.

[0037] Quantum communication, with its high security thanks to quantum encryption technology, has become a key technology in the current communication field. Its core lies in using quantum keys for authentication and encrypted communication. When initiating quantum communication, the terminal device randomly selects a quantum key from a key storage device, establishes a connection with the backend, and verifies identity information, thus ensuring the absolute security of the communication content. However, in related technologies, each quantum local area network (QLAN) is independently configured with a key distribution center. This center is responsible for generating, distributing keys, and authenticating identities. Furthermore, the pre-set authentication keys are only stored within the key distribution center of this specific QLAN and cannot be shared between different QLANs. That is, the quantum key in the key storage device corresponds only to a single key distribution center. The lack of a directly usable authentication key when crossing domains further prolongs the authentication period, potentially leading to excessive latency or interruption of quantum communication services during cross-regional transitions.

[0038] For example, when a user roams from one quantum local area network (e.g., domain A) to another (e.g., domain B) carrying a key storage device, the key distribution center in domain B, lacking the user's pre-installed authentication key, must initiate a cross-domain auxiliary authentication process. This means the key distribution center in domain B must first request verification from the key distribution center in the user's original domain, domain A. Only after receiving the verification result from domain A can the user's permissions be confirmed. This process is not only cumbersome but also incurs additional communication overhead due to cross-domain information exchange.

[0039] Based on the above issues, please refer to Figure 1 This application provides a key injection method for a quantum local area network (QLAN). The QLAN includes a quantum key injection machine, a first control station, a first target key distribution center, and a second target key distribution center. The second target key distribution center and the first target key distribution center are located in different QLANs, while the first target key distribution center and the quantum key injection machine are located in the same QLAN. The method includes: 011: The quantum key generator sends a key injection request to the first central control station; 012: In the case of a key injection request being the first key injection request, the first central control station sends the first quantum key from the generated cross-domain authentication key to the second target key distribution center; 013: The second target key distribution center stores the first quantum key; 014: The first central control station sends the second quantum key and cross-domain authentication identifier information from the cross-domain authentication key to the quantum key filling machine; 015: The quantum key filling machine fills the terminal key storage medium with the second quantum key and cross-domain authentication identifier information.

[0040] Specifically, a quantum local area network (QLAN) refers to a metropolitan area-wide local communication network built based on quantum communication technology. A QLAN includes nodes such as a key distribution center, several control stations, and quantum key injection machines, forming the basic network environment for quantum key injection and encrypted communication. The QLAN connects devices through a quantum encryption network and classical channels (used to transmit encrypted information), providing quantum encrypted communication support for communication terminals within the area.

[0041] The first control station is one of the core nodes for quantum key generation and distribution. It can connect to the key distribution center through a quantum encryption network, providing authentication and subsequent encrypted communication services for devices connected to the quantum local area network. During the key filling process, the first control station can generate quantum keys according to the requests of the quantum key filling machine and distribute the keys according to a preset strategy.

[0042] It should be noted that the term "first control station" does not refer to a specific control station, but rather to any control station node in a quantum local area network (QLAN) that performs key generation, distribution, and response to key injection requests. The core role of the first control station is as the "key processing hub" in the quantum key injection process. Based on the request type (directed key or LAN key) sent by the quantum key injector, it executes the corresponding preset distribution strategy to complete the generation, encryption, and transmission of the quantum symmetric key. In practical applications, multiple control stations may exist within a quantum LAN. When a control station is selected by the quantum key injector and receives an injection request, that control station becomes the "first control station" in the current process. The term "first control station" is not a physical or numbered limitation on the control station, but rather clarifies the functional positioning of the control station responsible for processing key requests in a specific injection scenario, reflecting the adaptability of the key injection method for quantum LANs provided in this application to multi-control station collaborative scenarios.

[0043] A quantum key injector is a dedicated device used to write quantum keys into quantum key storage devices (such as quantum SIM cards). It is typically fixed within a quantum key injector station and connected to a quantum local area network via a central control station. During the key injector process, the quantum key injector reads information from the key storage device, obtains the injector scheme, sends a key injector request to the central control station, and then writes the received key into the storage device.

[0044] The key distribution center is the core node within a quantum local area network that centrally manages keys. Its main responsibilities include generating session keys and distributing them to both communicating parties, as well as providing authentication services to ensure that only authorized users can obtain the session keys. During key filling, it receives and stores the keys sent by the central control station for subsequent authentication with the key storage device. In other words, by verifying the matching of pre-set keys between the key distribution center and the key storage device (or the relevant central control station), it ensures that only communication terminals holding legitimate keys can pass authentication and obtain the session keys for quantum encrypted communication services.

[0045] The first target key distribution center refers to the key distribution center that is located in the same quantum local area network as the quantum key generator.

[0046] The second target key distribution center refers to a key distribution center located in a different quantum local area network than the first target key distribution center, and belongs to a cross-domain key management node.

[0047] A key injection request refers to a request message sent by the quantum key injector to the first central control station to apply for a specific type of quantum key injection, including a first key injection request, a key requirement determination based on the terminal key storage medium, and an instruction to start the key injection process.

[0048] Cross-domain authentication keys refer to keys that can be authenticated by any central control station and key distribution center (provided that the key distribution center has pre-stored the corresponding authentication key). They can be used to solve identity authentication problems in cross-domain scenarios and support quantum encrypted communication services without geographical restrictions.

[0049] The first quantum key refers to the quantum key generated by the first central control station, sent to the second target key distribution center, and stored by the second target key distribution center.

[0050] The second quantum key refers to the quantum key generated by the first control station and sent to the quantum key filling machine, which corresponds to the first quantum key.

[0051] Cross-domain authentication identification information refers to the tagging information associated with the location information (such as IP address) of the second target key distribution center. This information is used by terminal devices to quickly match the corresponding second target key distribution center when crossing domains, achieving accurate authentication.

[0052] First, the quantum key injector sends a key injecting request containing the first key injecting request (used to apply for a cross-domain authentication key) to the first central control station, thus initiating the injecting process.

[0053] In this way, by pre-setting corresponding authentication keys in the cross-domain second target key distribution center and the terminal key storage medium, and associating them with corresponding identification information, the terminal device can quickly match the corresponding cross-domain key distribution center to complete authentication after crossing domains, thus providing a foundation for cross-domain quantum encrypted communication.

[0054] In summary, the key injection method for quantum local area networks provided in this application involves a quantum key injection machine sending a key injection request to a first central control station, the request including a first key injection request. Next, if the key injection request is the first key injection request, the first central control station sends the first quantum key from the generated cross-domain authentication key to a second target key distribution center. Subsequently, the second target key distribution center stores the first quantum key. Then, the first central control station sends the second quantum key and cross-domain authentication identification information from the cross-domain authentication key to the quantum key injection machine, wherein the cross-domain authentication identification information is associated with the location information of the second target key distribution center. Finally, the quantum key injection machine injects the terminal key storage medium according to the second quantum key and the cross-domain authentication identification information. Thus, by sending and storing the first quantum key to the second target key distribution center across the quantum local area, and simultaneously injecting the terminal key storage medium with the second quantum key associated with its location information and the cross-domain authentication identification information, pre-configured correspondence of cross-domain keys is achieved, thereby simplifying the cross-domain authentication process. Furthermore, the cross-domain authentication identification information is associated with the location information of the second target key distribution center, enabling the terminal device to quickly complete authentication by matching the corresponding key distribution center through the identification information after crossing domains, without the need for additional cross-domain verification steps, thereby improving the authentication efficiency of quantum encrypted communication across quantum local area networks.

[0055] Please see Figure 2 In some implementations, the quantum local area network further includes a second central control station, and the method further includes: 016: If the second control station receives an encryption assistance request from the quantum key injector, the second control station generates an auxiliary symmetric key, which includes an auxiliary encryption key and an auxiliary decryption key; 017: The second control station sends an auxiliary encryption key to the first control station; 018: The second central control station sends the auxiliary decryption key to the second target key distribution center and the quantum key injection machine.

[0056] Specifically, when transmitting quantum keys over classical networks, they are vulnerable to eavesdropping through methods such as traffic interception and network sniffing, causing the "quantum-level security" of the quantum key to fail during transmission. For these reasons, encryption can be used to assist in transmitting quantum keys over classical networks, thus mitigating the security vulnerabilities of quantum keys transmitted through classical channels.

[0057] A cryptographic assistance request refers to a request sent by the quantum key generator to the second control station, requesting the second control station to provide cryptographic assistance services. The quantum key generator sends this request when the key injection request involves a first key injection request (requesting a directed key), or both requests simultaneously, in order to enhance the security of key transmission with the help of the second control station's cryptographic assistance.

[0058] The auxiliary symmetric key refers to the symmetric key generated by the second central control station after receiving the encryption assistance request. It includes an auxiliary encryption key and an auxiliary decryption key, which are used in pairs to encrypt and protect the transmission process of the quantum symmetric key, thereby enhancing the security of classical network transmission during the key filling process.

[0059] The auxiliary encryption key refers to a part of the auxiliary symmetric key, which is sent from the second control station to the first control station for the first control station to encrypt the quantum symmetric key to be distributed, so as to prevent the key from being stolen during transmission.

[0060] The auxiliary decryption key refers to another part of the auxiliary symmetric key, which is sent by the second central control station to the second target key distribution center and the quantum key injector. It is used to decrypt the quantum symmetric key encrypted by the first central control station to obtain the original quantum symmetric key, ensuring that the key distribution center and the quantum key injector can correctly receive and use the key.

[0061] Thus, if the second control station receives an encryption assistance request from the quantum key injector, it generates an auxiliary symmetric key, which includes an auxiliary encryption key and an auxiliary decryption key. Next, the second control station sends the auxiliary encryption key to the first control station. Finally, the second control station sends the auxiliary decryption key to the second target key distribution center and the quantum key injector. In this way, by introducing the auxiliary symmetric key generated by the second control station, the first control station uses the auxiliary encryption key to encrypt the quantum symmetric key before transmission, and the second target key distribution center and the quantum key injector decrypt the key using the auxiliary decryption key. This avoids the risk of plaintext leakage when the first control station and the quantum key injector transmit the key over a classical network, reducing the possibility of key eavesdropping or theft.

[0062] Please see Figure 3 In some implementations, the method further includes: 019: The first central control station encrypts the first quantum key according to the auxiliary encryption key to determine the first encrypted information; 020: The first centralized control station sends the first encrypted information to the second target key distribution center; 021: The first centralized control station encrypts the second quantum key and cross-domain authentication identifier information based on the auxiliary encryption key to determine the second encrypted information; 022: The first central control station sends the second encrypted information to the quantum key filling machine.

[0063] Specifically, the first encrypted information refers to the information obtained after the first central control station encrypts the first quantum key in the quantum symmetric key using an auxiliary encryption key. The first encrypted information ensures the security of the first quantum key during transmission to the key distribution center, prevents the first quantum key from being stolen during transmission, and ensures that the key distribution center receives encrypted key information.

[0064] The double-encryption refers to the information obtained by first encrypting the second quantum key using a preset encryption algorithm (such as AES-256, SM4, or other symmetric encryption algorithms) at the first control station to generate the first confidential information, and then encrypting the first confidential information again using an auxiliary encryption key. Double encryption enhances the security of information related to the second quantum key during transmission to the quantum key injection machine, making it difficult to decrypt even if the information is intercepted during transmission without obtaining the auxiliary decryption key, thus better protecting the security of the second quantum key.

[0065] The first control station uses the auxiliary encryption key provided by the second control station to encrypt the first quantum key in the quantum symmetry key, generating the first encrypted information, and sends it to the key distribution center. Next, the first control station stores the second quantum key, first encrypting it using a preset encryption algorithm to generate the first confidential information, then using the auxiliary encryption key to encrypt the first confidential information a second time, generating the second encrypted information, which is then sent to the quantum key injection machine.

[0066] Thus, upon receiving a key injection request, the first control station generates a quantum symmetric key using a quantum random number generator. Alternatively, upon receiving a key injection request, the first control station determines the quantum symmetric key from a pre-stored set of quantum keys. This provides two key acquisition methods, allowing the first control station to choose the appropriate method based on the actual situation when receiving a key injection request.

[0067] Please see Figure 4 In some implementations, the method further includes: 023: The second target key distribution center decrypts the first encrypted information using the auxiliary decryption key to obtain the first quantum key; 024: The quantum key injection machine decrypts the second encrypted information according to the auxiliary decryption key to obtain the second quantum key and cross-domain authentication identifier information; 025: The quantum key filling machine fills the terminal key storage medium with the second quantum key and cross-domain authentication identifier information.

[0068] Specifically, the second target key distribution center uses the auxiliary decryption key provided by the second central control station to decrypt the first encrypted information received from the first central control station, obtain the first quantum key, and store it.

[0069] The quantum key injector also uses an auxiliary decryption key to decrypt the received secondary encrypted information, obtaining the first confidential information. Subsequently, the quantum key injector writes the decrypted first confidential information into the terminal key storage medium, completing the injection process.

[0070] Thus, the second target key distribution center decrypts the first encrypted information using the auxiliary decryption key to obtain the first quantum key. Next, the quantum key injection machine decrypts the second encrypted information using the auxiliary decryption key to obtain the second quantum key and cross-domain authentication identifier information. Finally, the quantum key injection machine injects the terminal key storage medium using the second quantum key and cross-domain authentication identifier information. This ensures that only authorized parties who have obtained the auxiliary decryption key beforehand can correctly obtain the first quantum key, the second quantum key, and the cross-domain authentication identifier information. Unauthorized parties, even if they intercept the encrypted information, cannot decrypt it to obtain valid content, thereby avoiding the risk of key theft and misuse during transmission and injection.

[0071] Please see Figure 5 The key injection request also includes a second key injection request, which is used to request a local area network authentication key. The method further includes: 026: In the case that the key filling request is the second key filling request, based on the quantum channel, the first centralized control station sends the third quantum key from the local area network authentication key to the first target key distribution center; 027: The first target key distribution center stores the third quantum key; 028: The first centralized control station, based on a classical network, sends the fourth quantum key from the local area network authentication key and the local area network authentication identifier information corresponding to the fourth quantum key to the quantum key filling machine; 029: The quantum key filling machine fills the terminal key storage medium with the fourth quantum key and the local area network authentication identifier information.

[0072] Specifically, a local area network (LAN) authentication key refers to an authentication key that is restricted to use within a specific quantum LAN. It is not restricted to which central control station it is connected to, but it can only be used with the key distribution center of that quantum LAN.

[0073] A quantum channel refers to a dedicated channel used to transmit quantum keys.

[0074] The third quantum key is generated by the first central control station, sent to the first target key distribution center (a key distribution center within the same quantum local area network) through the quantum encryption network, and stored by it. It is part of the local area network authentication key and is used for authentication storage on the key distribution center side.

[0075] The fourth quantum key, corresponding to the third quantum key, is the key sent by the first central control station to the quantum key filling machine through the classical network. It is another part of the local area network authentication key and is used to fill the terminal key storage medium to ensure that the terminal and the first target key distribution center have matching authentication keys.

[0076] The local area network authentication identifier information is associated with the location information (such as IP address) of the first target key distribution center, which is used by the terminal device to quickly match the corresponding key distribution center within the quantum local area network and achieve accurate authentication.

[0077] The filling process refers to the process by which a quantum key injector writes the received initial confidential information into the terminal key storage medium. Through the filling process, the terminal key storage medium stores the corresponding encrypted information, providing a key basis for subsequent operations such as identity authentication.

[0078] The first centralized control station sends the first quantum key from the quantum symmetric key to the key distribution center via a quantum channel. The key distribution center stores this key as the basis for comparison in subsequent authentication.

[0079] The first centralized control station stores the third quantum key from the local area network (LAN) authentication key. Then, the first centralized control station sends the fourth quantum key from the LAN authentication key and the corresponding LAN authentication identifier information to the quantum key injector. Next, the quantum key injector receives the fourth quantum key and the LAN authentication identifier information and writes them into the terminal key storage medium, completing the injecting process. At this point, the fourth quantum key in the terminal storage medium corresponds to the third quantum key stored in the first target key distribution center. In subsequent use, the communication terminal can authenticate with the first target key distribution center through any centralized control station within this quantum LAN, demonstrating the "LAN universal" characteristic of the LAN key.

[0080] Thus, when the key filling request is the second key filling request, based on the quantum channel, the first central control station sends the third quantum key from the local area network authentication key to the first target key distribution center. Next, the first target key distribution center stores the third quantum key. Then, based on the classical network, the first central control station sends the fourth quantum key from the local area network authentication key and the corresponding local area network authentication identifier to the quantum key filling machine. The local area network authentication identifier is associated with the location information of the first target key distribution center. Finally, the quantum key filling machine fills the terminal key storage medium according to the fourth quantum key and the local area network authentication identifier. In this way, sending the third quantum key to the first target key distribution center within the same local area network via the quantum channel utilizes the security of the quantum encryption channel to ensure the security and reliability of the keys stored in the key distribution centers within the local area network. Simultaneously, sending the fourth quantum key and the local area network authentication identifier associated with the location of the first target key distribution center to the quantum key filling machine via the classical network establishes a correspondence between the keys filled in the terminal key storage medium and the key distribution centers within the same quantum local area network.

[0081] Please see Figure 6 The key injection request also includes a third key injection request, which is used to request a targeted authentication key. The method also includes: 030: In the case of a third key injection request, the first central control station will send the fifth quantum key from the generated directed authentication key to the first target key distribution center; 031: The first target key distribution center stores the fifth quantum key; 032: The first centralized control station stores the sixth quantum key in the directed authentication key; 033: Based on the preset encryption algorithm, the first centralized control station encrypts the sixth quantum key and the directional authentication identifier information corresponding to the directional authentication key to generate the first confidential information; 034: The first centralized control station sends the first confidential information to the quantum key filling machine; 035: The quantum key filling machine fills the terminal key storage medium with the first confidential information.

[0082] Specifically, a quantum channel refers to a dedicated channel used for transmitting quantum keys.

[0083] The fifth quantum key is generated by the first central control station, sent to the first target key distribution center (a key distribution center within the same quantum local area network) through the quantum encryption network, and stored by it. It is part of the local area network authentication key and is used for authentication storage on the key distribution center side.

[0084] The sixth quantum key, corresponding to the fifth quantum key, is the key sent by the first central control station to the quantum key filling machine through the classical network. It is another part of the local area network authentication key and is used to fill the terminal key storage medium to ensure that the terminal and the first target key distribution center have matching authentication keys.

[0085] A preset encryption algorithm refers to a pre-defined algorithm used to encrypt the key, such as a symmetric encryption algorithm. The first central control station uses this algorithm to encrypt the second quantum key to ensure its security during transmission.

[0086] The local area network authentication identifier information is associated with the location information (such as IP address) of the first centralized control station, which is used by terminal devices to quickly match the corresponding key distribution center within the quantum local area network and achieve accurate authentication.

[0087] The first confidential information refers to the information generated after the first central control station encrypts the second quantum key using a preset encryption algorithm. This first confidential information ensures the secure transmission of the encrypted second quantum key to the quantum key injector, preventing it from being stolen during transmission.

[0088] The filling process refers to the process by which a quantum key injector writes the received initial confidential information into the terminal key storage medium. Through the filling process, the terminal key storage medium stores the corresponding encrypted information, providing a key basis for subsequent operations such as identity authentication.

[0089] Thus, when the key injection request is the third key injection request, the first centralized control station sends the fifth quantum key from the generated targeted authentication key to the first target key distribution center. Next, the first target key distribution center stores the fifth quantum key. Then, the first centralized control station stores the sixth quantum key from the targeted authentication key. Next, based on a preset encryption algorithm, the first centralized control station encrypts the sixth quantum key and the targeted authentication identifier information corresponding to the targeted authentication key to generate first confidential information, wherein the targeted authentication identifier information is associated with the location information of the first centralized control station. Subsequently, the first centralized control station sends the first confidential information to the quantum key injection machine. Finally, the quantum key injection machine injects the terminal key storage medium according to the first confidential information. In this way, by sending the fifth quantum key from the targeted authentication key to the first target key distribution center for storage, while the first centralized control station itself stores the sixth quantum key, a key correspondence relationship is established between the key distribution center and the centralized control station, providing a foundation for authentication in subsequent targeted scenarios. Furthermore, the targeted authentication identifier information is associated with the location information of the first centralized control station, which means that the targeted authentication key filled in the terminal key storage medium can only be matched with that specific centralized control station, thus strictly limiting the service range.

[0090] This application provides a terminal key storage medium that stores a targeted authentication key, a local area network authentication key, a cross-domain authentication key, targeted authentication identification information corresponding to the targeted authentication key, local area network authentication identification information corresponding to the local area network authentication key, and cross-domain authentication identification information corresponding to the cross-domain authentication key, all obtained by key injection based on the above-described key injection method.

[0091] Specifically, the terminal key storage medium stores three types of keys and their corresponding identification information in a categorized manner, enabling rapid authentication in local, LAN, and cross-domain scenarios, and adapting to different ranges of quantum encrypted communication service needs.

[0092] Thus, the structure of the terminal key storage medium, which stores directional authentication keys, local area network authentication keys, cross-domain authentication keys, and corresponding identification information, achieves orderly management of different types of quantum keys. Furthermore, it enables terminal devices to quickly match the corresponding authentication key and identification information from the terminal key storage medium based on the service type and location information when requesting different types of quantum encrypted communication services, simplifying the authentication process.

[0093] Please see Figure 7 This application provides an authentication method based on the aforementioned terminal key storage medium, the method comprising: 041: In response to the key service selection operation, determine the target service type; 042: Based on the target service type and the current location information of the sending terminal, obtain the target authentication key and the target identification information corresponding to the target authentication key from the terminal key storage medium; 043: Perform identity authentication based on the target authentication key and target identification information.

[0094] Specifically, the key service selection operation refers to the operation of a user or system selecting the type of quantum encrypted communication service.

[0095] The target service type refers to the specific service category determined based on the key service selection operation, including Type 1 service and Type 2 service. Type 1 service is a quantum encrypted communication service confined within a quantum local area network, requiring a connection to a key distribution center corresponding to the current location information of the sending terminal to achieve encrypted communication. Type 2 service is a localized quantum encrypted communication service, requiring a connection to a specific central control station to achieve encrypted communication (e.g., confined to a factory area or office building), using a directional key, which can only be successfully authenticated after connection between the specific central control station and the key distribution center.

[0096] Current location information refers to the current location of the transmitting terminal in the quantum local area network. It is the basis for determining whether the terminal is in the target quantum local area network and is used to match the corresponding authentication resources.

[0097] The target authentication key refers to the key selected from the terminal key storage medium for identity authentication based on the target service type and current location information.

[0098] Target identification information refers to the identification data corresponding to the target authentication key, which is associated with the location information (such as IP address) of a specific central control station or key distribution center, and is used by terminal devices to quickly match the corresponding authentication node.

[0099] In response to the key service selection operation, the target service type is determined. Next, based on the target service type and the current location information of the sending terminal, the target authentication key and the corresponding target identification information are retrieved from the terminal's key storage medium. Finally, authentication is performed based on the target authentication key and the target identification information. This approach, by combining the target service type and the sending terminal's current location information to select the corresponding key and identification information for authentication, ensures the targeting and accuracy of the authentication process. Furthermore, dynamically selecting the authentication key based on the service type and the sending terminal's current location information simplifies the authentication process in different scenarios.

[0100] Please see Figure 8 In some implementations, the target service type includes a first type of service. Step 042 (based on the target service type and the current location information of the sending terminal, obtaining the target authentication key and the target identification information corresponding to the target authentication key from the terminal key storage medium) includes: 0421: When the target service type is the first type of service, filter the first target identification information that matches the current location information from the identification information stored in the terminal key storage medium; 0422: If the first target identification information exists in the terminal key storage medium, randomly select the local area network authentication key corresponding to the first target identification information in the terminal key storage medium to confirm the target authentication key.

[0101] Specifically, the first target identification information is a marker associated with the location information (such as IP address and area code) of the first target key distribution center (the local key distribution center of the quantum local area network where the terminal is currently located). It is stored in the terminal key storage medium and is used to uniquely identify the authentication node of the quantum local area network. The function of the first target identification information is to establish the association between the terminal and the local key distribution center, ensuring that the corresponding key management node can be accurately matched during authentication.

[0102] Filtering the first target identifier information that matches the current location information can be understood as comparing the terminal's current location with the stored identifier information to determine whether the terminal is within a quantum local area network with a pre-set authentication key. If the match is successful, it indicates that the terminal has the basic capability to use the first type of service within that local area network.

[0103] Randomly selecting a local area network (LAN) authentication key from the terminal key storage medium that corresponds to the first target identifier information can be understood as follows: the LAN authentication key is an authentication key pre-stored in the terminal key storage medium that corresponds to the first target key distribution center (it can be a cross-domain key or a LAN key, depending on the current location of the user terminal). Furthermore, random selection reduces the risk of cracking caused by repeated use of a single key, while ensuring that the key used for each authentication matches the key stored in the local key distribution center.

[0104] The final target authentication key is the core credential for the terminal to authenticate its identity with the local key distribution center of the current quantum local area network. By comparing this key, the legitimacy of the terminal can be verified, allowing it to access the first type of service.

[0105] Thus, when the target service type is Type I, the system filters the identification information stored in the terminal key storage medium to select the first target identification information that matches the current location information. Next, if the first target identification information exists in the terminal key storage medium, the system randomly selects the local area network (LAN) authentication key corresponding to the first target identification information from the terminal key storage medium to confirm the target authentication key. By filtering the first target identification information that matches the current location information, the system ensures that in Type I service scenarios, the terminal device only calls the LAN authentication key corresponding to the key distribution center of the current quantum LAN, avoiding incorrect key use across LANs and ensuring authentication accuracy. Furthermore, by quickly locating the required key through matching the current location information with the identification information, the system simplifies the authentication steps within the quantum LAN, avoids unnecessary cross-domain verification, and thus improves the authentication efficiency of quantum encrypted communication within the quantum LAN.

[0106] Please see Figure 9 In some implementations, the method further includes: 0423: If the first target identification information is not present in the terminal key storage medium, the authentication process is interrupted.

[0107] Specifically, when the terminal key storage medium of the sending terminal does not store the first target identification information that matches the current location information, the system automatically terminates the identity authentication process based on the quantum local area network. If the first target identification information is missing, it means that the terminal has not obtained the authorization authentication information of the local area network in advance and does not have the permission to use the corresponding service, so authentication needs to be terminated.

[0108] Thus, if the terminal key storage medium does not contain the first target identification information, the authentication process is interrupted. This prevents unauthorized devices from accessing the encrypted communication services of the quantum local area network, avoids information leakage or network security risks caused by unauthorized access, and ensures that only legitimate terminal devices that have been pre-loaded with the corresponding authentication key can pass authentication, thereby maintaining the security and control effectiveness of services within the quantum local area network.

[0109] Please see Figure 10 In some implementations, the method further includes: 0424: If the terminal key storage medium does not contain a local area network authentication key corresponding to the first target identification information, the authentication process is interrupted.

[0110] Specifically, when the terminal key storage medium contains first target identification information matching the current location information (i.e., the terminal has been identified as a potential authorized device of the current quantum local area network), but does not store the local area network authentication key corresponding to this identification information, the identity authentication process is automatically terminated. In the authentication method provided in this application, the first target identification information is only an "index of the location key," while the local area network authentication key is the core credential for the terminal to complete identity authentication with the first target key distribution center of the current quantum local area network. If the local area network authentication key is missing, the authentication loses its substantive basis, and the process must be terminated.

[0111] Thus, if the terminal key storage medium does not contain a local area network authentication key corresponding to the first target identification information, the authentication process is interrupted. This effectively prevents unauthorized devices from accessing the encrypted communication service of the quantum local area network, avoiding the risk of unauthorized access due to a missing authentication key.

[0112] Please see Figure 11 In some implementations, the target service type includes a second type of service. Step 042 (obtaining the target authentication key from the terminal key storage medium based on the target service type and the location information of the sending terminal) includes: 0425: When the target service type is the second type of service, filter the second target identification information that matches the current location information from the identification information stored in the terminal key storage medium; 0426: If target identification information exists in the terminal key storage medium, randomly select the targeted authentication key corresponding to the second target identification information from the terminal key storage medium to confirm the target authentication key.

[0113] Specifically, the above describes the logic by which the sending terminal retrieves the target authentication key and corresponding identification information from the terminal key storage medium when the target service type is the second type. The second type of service corresponds to quantum encrypted communication services that are limited to more specific local scenarios (such as specific factory areas, office buildings, etc.). Its core is to accurately call the targeted authentication key corresponding to the local central control station to complete identity authentication by matching the current location information with the second target identification information, ensuring that the service is only valid within the specified local area.

[0114] The second type of service refers to quantum encrypted communication services implemented in specific local scenarios (such as a single factory area, office building, laboratory, etc.), which rely on a "directed authentication key" as the core authentication key. The second type of service must be authenticated through a specific central control station (rather than the key distribution center of the entire quantum local area network). That is, the terminal can only use the corresponding service within the coverage area of ​​the central control station, and cannot pass the authentication outside the coverage area.

[0115] The second target identification information refers to the tag information associated with the location information of a specific centralized control station (the node responsible for local scene authentication). It is stored in the terminal key storage medium and is used to uniquely identify the authentication resource corresponding to that centralized control station. The second target identification information can establish a direct association between the terminal and the local centralized control station, ensuring that the corresponding centralized control station can be accurately matched during authentication.

[0116] Filtering the second target identifier information that matches the current location information can be understood as comparing the current local location of the sending terminal with the stored second target identifier information to determine whether the sending terminal is within the coverage area of ​​the central control station corresponding to the targeted authentication key. If the match is successful, it indicates that the sending terminal has the basis to use the second type of service in this local scenario.

[0117] The final determined targeted authentication key (target authentication key) serves as the credential for the sending terminal to authenticate its identity with a specific central control station. By comparing this targeted authentication key, the central control station can verify the legitimacy of the terminal, and the sending terminal can also confirm the validity of the central control station, thereby establishing a secure quantum-encrypted communication link within a local scenario and enabling access control for the second type of service.

[0118] Thus, when the target service type is the second type of service, the system filters the identification information stored in the terminal key storage medium to select the second target identification information that matches the current location information. Next, if the target identification information exists in the terminal key storage medium, a targeted authentication key corresponding to the second target identification information is randomly selected from the terminal key storage medium to confirm the target authentication key. In this way, by filtering the second target identification information that matches the current location information, it ensures that in the second type of service scenario, the terminal device only calls the targeted authentication key of the specific central control station corresponding to the current local scenario, strictly limiting the service scope and achieving precise control over the users of a single service type.

[0119] Please see Figure 12 In some implementations, the method further includes: 0427: If the terminal key storage medium does not contain the second target identification information, the authentication process is interrupted.

[0120] Specifically, the authentication process based on the quantum local area network (QLAN) is automatically terminated when the terminal key storage medium of the sending terminal does not store the second target identifier information that matches the current location information. If the second target identifier information is missing, it means that the sending terminal has not obtained the authorization authentication information of the local area network in advance and does not have the right to use the corresponding service, so the authentication must be terminated.

[0121] Thus, if the terminal key storage medium does not contain the second target identification information, the authentication process is interrupted. This prevents unauthorized devices from accessing the encrypted communication services of the quantum local area network, avoids information leakage or network security risks caused by unauthorized access, and ensures that only legitimate terminal devices that have been pre-loaded with the corresponding authentication key can pass authentication, thereby maintaining the security and control effectiveness of services within the quantum local area network.

[0122] Please see Figure 13 In some implementations, the method further includes: 0428: If the terminal key storage medium does not contain a targeted authentication key corresponding to the second target identification information, the authentication process is interrupted.

[0123] Specifically, if the terminal key storage medium contains second target identification information matching the current location information (i.e., the sending terminal has been identified as a potential authorized device of the current quantum local area network), but does not store a directional authentication key corresponding to the second target identification information, the identity authentication process is automatically terminated. In the authentication method provided in this application, the second target identification information is only an "index of the positioning key," while the directional authentication key is the core credential for the terminal to complete identity authentication with the specific central control station of the current quantum local area network. If the directional authentication key is missing, the authentication loses its substantive basis, and the process must be terminated.

[0124] Thus, if the terminal key storage medium does not contain a targeted authentication key corresponding to the second target identification information, the authentication process is interrupted. This effectively prevents unauthorized devices from accessing the encrypted communication services of the quantum local area network, avoiding the risk of unauthorized access due to missing authentication keys.

[0125] Please see Figure 14 In some implementations, step 043 (performing identity authentication based on the target authentication key and target identification information) includes: 0431: Send the target authentication key to the target node so that the target node can compare the target authentication key with its own pre-stored authentication key and thus confirm the sending terminal's access rights to the quantum local area network.

[0126] Specifically, the sending terminal sends the determined target authentication key to the target node associated with the target identification information. The target node then compares its own pre-stored authentication key with the received target authentication key to determine whether the sending terminal has the authority to access the quantum local area network.

[0127] If the target service type is Type 1, the target identification information is the first target identification information, and the corresponding target node is the first target key distribution center of the current quantum local area network. If the target service type is Type 2, the target identification information is the second target identification information, and the corresponding target node is a specific central control station.

[0128] After receiving the target authentication key, the target node will compare it with its own pre-stored corresponding authentication key (which was distributed and stored by the central control station during the initial injection process: such as the third quantum key pre-stored by the first target key distribution center, or the targeted authentication key pre-stored by the central control station). If the two match, it indicates that the sending terminal is an authorized device that has undergone a legitimate injection process and has access rights. If they do not match, it indicates that the sending terminal may be an illegal device (not having obtained the key through a proper injection process) or that the key has been tampered with, and its access will be denied.

[0129] In this way, the target authentication key is sent to the target node, which then compares the target authentication key with its own pre-stored authentication key to confirm the sending terminal's access rights to the quantum local area network (QLAN). The target node is a network node in the QLAN associated with the target's identification information. By sending the target authentication key to the target node associated with the target identification information and having the target node perform the key comparison, unauthorized devices can be effectively prevented from accessing the QLAN, ensuring network security. Furthermore, authentication is completed through direct key comparison, simplifying the authentication process and thus improving authentication efficiency.

[0130] This application also provides a computer-readable storage medium containing a computer program. When the computer program is executed by one or more processors, it causes the one or more processors to perform the method of this application.

[0131] It is understood that a computer program includes computer program code. Computer program code can be in the form of source code, object code, executable files, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and software distribution media, etc.

[0132] In this specification, the terms "specifically," "furthermore," "particularly," "understandably," etc., refer to specific features, structures, materials, or characteristics described in connection with embodiments or examples that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0133] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as will be understood by those skilled in the art to which embodiments of this application pertain.

[0134] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A key injection method based on quantum local area networks, characterized in that, The quantum local area network includes a quantum key injection machine, a first centralized control station, a first target key distribution center, and a second target key distribution center. The second target key distribution center and the first target key distribution center are located in different quantum local area networks, while the first target key distribution center and the quantum key injection machine are located in the same quantum local area network. The method includes: The quantum key injector sends a key injecting request to the first central control station, the key injecting request including a first key injecting request; If the key injection request is the first key injection request, the first central control station will send the first quantum key from the generated cross-domain authentication key to the second target key distribution center; The second target key distribution center stores the first quantum key; The first centralized control station sends the second quantum key and cross-domain authentication identification information from the cross-domain authentication key to the quantum key filling machine, wherein the cross-domain authentication identification information is associated with the location information of the second target key distribution center; The quantum key filling machine fills the terminal key storage medium with the second quantum key and the cross-domain authentication identifier information.

2. The method according to claim 1, characterized in that, The quantum local area network also includes a second central control station, and the method further includes: If the second control station receives an encryption assistance request sent by the quantum key injection machine, the second control station generates an auxiliary symmetric key, which includes an auxiliary encryption key and an auxiliary decryption key; The second control station sends the auxiliary encryption key to the first control station; The second central control station sends the auxiliary decryption key to the second target key distribution center and the quantum key filling machine.

3. The method according to claim 2, characterized in that, The method further includes: The first centralized control station encrypts the first quantum key according to the auxiliary encryption key to determine the first encrypted information; The first centralized control station sends the first encrypted information to the second target key distribution center; The first centralized control station encrypts the second quantum key and the cross-domain authentication identifier information according to the auxiliary encryption key to determine the second encrypted information; The first central control station sends the second encrypted information to the quantum key injection machine.

4. The method according to claim 3, characterized in that, The method further includes: The second target key distribution center decrypts the first encrypted information using the auxiliary decryption key to obtain the first quantum key; The quantum key injection machine decrypts the second encrypted information according to the auxiliary decryption key to obtain the second quantum key and the cross-domain authentication identifier information; The quantum key filling machine fills the terminal key storage medium with the second quantum key and the cross-domain authentication identifier information.

5. The method according to claim 1, characterized in that, The key injection request further includes a second key injection request, which is used to request a local area network authentication key. The method further includes: In the case that the key filling request is the second key filling request, the first centralized control station sends the third quantum key from the local area network authentication key to the first target key distribution center based on the quantum channel; The first target key distribution center stores the third quantum key; The first centralized control station, based on a classical network, sends the fourth quantum key from the local area network authentication key and the local area network authentication identification information corresponding to the fourth quantum key to the quantum key filling machine. The local area network authentication identification information is associated with the location information of the first target key distribution center. The quantum key filling machine fills the terminal key storage medium with the fourth quantum key and the local area network authentication identifier information.

6. The method according to claim 1, characterized in that, The key injection request further includes a third key injection request, which is used to request a targeted authentication key. The method further includes: If the key injection request is the third key injection request, the first central control station will send the fifth quantum key from the generated targeted authentication key to the first target key distribution center; The first target key distribution center stores the fifth quantum key; The first centralized control station stores the sixth quantum key from the targeted authentication key; Based on a preset encryption algorithm, the first centralized control station encrypts the sixth quantum key and the directional authentication identifier information corresponding to the directional authentication key to generate first confidential information, wherein the directional authentication identifier information is associated with the location information of the first centralized control station; The first centralized control station sends the first confidential information to the quantum key injection machine; The quantum key filling machine fills the terminal key storage medium with the first confidential information.

7. A terminal key storage medium, characterized in that, The terminal key storage medium stores a targeted authentication key, a local area network authentication key, a cross-domain authentication key, targeted authentication identification information corresponding to the targeted authentication key, local area network authentication identification information corresponding to the local area network authentication key, and cross-domain authentication identification information corresponding to the cross-domain authentication key, all obtained by key injection based on the key injection method according to any one of claims 1-6.

8. An authentication method, characterized in that, The method is based on the terminal key storage medium as described in claim 7, and the method includes: In response to the key service selection operation, determine the target service type; Based on the target service type and the current location information of the sending terminal, the target authentication key and the target identification information corresponding to the target authentication key are obtained from the terminal key storage medium. Identity authentication is performed based on the target authentication key and the target identification information.

9. The method according to claim 8, characterized in that, The target service type includes a first type of service. The step of obtaining a target authentication key and corresponding target identification information from the terminal key storage medium based on the target service type and the current location information of the sending terminal includes: When the target service type is a first type of service, first target identification information that matches the current location information is filtered from the identification information stored in the terminal key storage medium; If the first target identification information exists in the terminal key storage medium, a local area network authentication key corresponding to the first target identification information is randomly selected from the terminal key storage medium to confirm the target authentication key.

10. The method according to claim 9, characterized in that, The method further includes: If the first target identifier information is not present in the terminal key storage medium, the authentication process is interrupted.

11. The method according to claim 9, characterized in that, The method further includes: If the terminal key storage medium does not contain a local area network authentication key corresponding to the first target identification information, the authentication process is interrupted.

12. The method according to claim 8, characterized in that, The target service type includes a second type of service. The step of obtaining the target authentication key from the terminal key storage medium based on the target service type and the location information of the sending terminal includes: When the target service type is the second type of service, second target identification information that matches the current location information is filtered from the identification information stored in the terminal key storage medium; If the target identification information exists in the terminal key storage medium, a targeted authentication key corresponding to the second target identification information is randomly selected from the terminal key storage medium to confirm the target authentication key.

13. The method according to claim 12, characterized in that, The method further includes: If the second target identification information is not present in the terminal key storage medium, the authentication process is interrupted.

14. The method according to claim 12, characterized in that, The method further includes: If the terminal key storage medium does not contain a targeted authentication key corresponding to the second target identification information, the authentication process is interrupted.

15. The method according to claim 12, characterized in that, The step of performing identity authentication based on the target authentication key and the target identification information includes: The target authentication key is sent to the target node, so that the target node can perform a key comparison based on the target authentication key and its own pre-stored authentication key, thereby confirming the quantum local area network access permission of the sending terminal. The target node is a network node in the quantum local area network associated with the target identification information.

Images