Service key distribution method and device, equipment and storage medium

Abstract

The invention provides a service key distribution method and device, equipment and a storage medium, and relates to the technical field of communication, and the method comprises the steps: obtaining the attribute information, related to service key distribution, of each node in a quantum communication network; determining a target key distribution path based on the attribute information and the service security level requirement of each node; generating a path strategy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used for indicating whether encryption and decryption operation and forwarding behavior are carried out at the target node; sending the path strategy to a source node in the target key distribution path; and the source node is used for distributing the service key to the destination node in the target key distribution path through the at least one intermediate node in the target key distribution path based on the path policy, so that the distribution of the service key is realized, and the security of service key distribution is improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a service key distribution method, apparatus, device and storage medium. Background Technology

[0002] Existing business keys are encrypted using symmetric and asymmetric encryption algorithms during transmission. However, both symmetric and asymmetric encryption algorithms can be cracked by quantum computers, leading to the theft and tampering of business keys during transmission. Summary of the Invention

[0003] This application provides a business key distribution method, apparatus, device, and storage medium to solve the problem of business keys being stolen and tampered with during transmission.

[0004] This application provides a business key distribution method applied to a quantum key distribution controller, including: Obtain attribute information related to business key distribution for each node in the quantum communication network; Based on the attribute information and business security level requirements of each node, the target key distribution path is determined; A path policy is generated based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The path policy is sent to the source node in the target key distribution path; the source node is used to distribute the business key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy.

[0005] According to the business key distribution method provided in this application, determining the target key distribution path based on the attribute information and business security level requirements of each node includes: Based on the attribute information of each node and the business security level requirements, at least one key distribution path is determined; The target key distribution path is determined based on the priority of each of the at least one key distribution path.

[0006] According to a business key distribution method provided in this application, the step of generating a path strategy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path includes: The path strategy is generated based on the target key distribution path, the reserved resources of the node quantum key of each target node in the target key distribution path, and the target type corresponding to each target node.

[0007] According to a business key distribution method provided in this application, the reserved resources are reserved based on slice identifiers or application identifiers, and the quantum key distribution controller establishes an association table between the slice identifiers or application identifiers and the reserved resources of the node quantum keys.

[0008] According to a business key distribution method provided in this application, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0009] According to the business key distribution method provided in this application, the quantum security comprehensive performance level is determined based on at least one of the following: the remaining amount of node quantum keys, the node quantum key generation rate, the node quantum key exchange rate, the node quantum key storage resources, and the quantum channel bandwidth.

[0010] According to a business key distribution method provided in this application, when the intermediate node does not have a built-in or externally connected quantum security device, the path strategy also includes a segment identifier corresponding to the intermediate node that does not have a built-in or externally connected quantum security device. The segment identifier indicates that the intermediate node that does not have a built-in or externally connected quantum security device only forwards the message.

[0011] According to the business key distribution method provided in this application, the update cycle of the node quantum key is configured based on the security requirements of the business and the amount of communication data.

[0012] According to the service key distribution method provided in this application, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0013] This application also provides a business key distribution method, applied to a source node, including: The system receives a path policy sent by a quantum key distribution controller. The path policy is generated based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. Based on the path strategy, generate the first message corresponding to the business key; The first message is forwarded to at least one intermediate node in the target key distribution path; the at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message.

[0014] According to the business key distribution method provided in this application, the step of generating a first message corresponding to the business key based on the path strategy includes: The slice identifier or application identifier of the source node is parsed, and the reserved resources of the node quantum key of the source node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. The path strategy is parsed to obtain the target type; Based on the target type, the business key is encrypted using the node quantum key corresponding to the reserved resource to obtain the first ciphertext; Based on the first ciphertext, the first message corresponding to the business key is generated.

[0015] According to the business key distribution method provided in this application, the step of generating the first message corresponding to the business key based on the first ciphertext includes: The first ciphertext is used as or placed in the payload of the first message to obtain the first message corresponding to the service key.

[0016] According to the business key distribution method provided in this application, the method further includes: Multiple ciphertext fragments of the first ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each ciphertext fragment is quantum encrypted and stored in the payload of each message along with the corresponding ciphertext fragment.

[0017] According to the business key distribution method provided in this application, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0018] According to a business key distribution method provided in this application, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0019] According to the business key distribution method provided in this application, the quantum security comprehensive performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

[0020] According to the business key distribution method provided in this application, the update cycle of the node quantum key is configured based on the security requirements of the business and the amount of communication data.

[0021] According to the service key distribution method provided in this application, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0022] This application provides a business key distribution method, applied to at least one intermediate node, including: The system receives a first message corresponding to the service key forwarded by the source node. This first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The first message is parsed to obtain the service key and the target type; Based on the service key and the target type, generate a second message corresponding to the service key; The second message is forwarded to the destination node in the target key distribution path.

[0023] According to the business key distribution method provided in this application, the step of parsing the first message to obtain the business key and the target type includes: The segment identifier in the segment routing header of the first message is parsed to obtain the target type; The first ciphertext is determined based on the payload in the segment routing header of the first message; Based on the target type, the first ciphertext is decrypted to obtain the business key.

[0024] According to a business key distribution method provided in this application, the step of generating a second message corresponding to the business key based on the business key and the target type includes: The slice identifier or application identifier of the intermediate node is parsed, and the reserved resources of the node quantum key of the intermediate node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. Based on the target type and the reserved resources, the business key is encrypted using the node quantum key reserved by the intermediate node to obtain the second ciphertext; Based on the second ciphertext, the second message corresponding to the business key is generated.

[0025] According to the business key distribution method provided in this application, the step of generating the second message corresponding to the business key based on the second ciphertext includes: The second ciphertext is used as or placed in the payload of the second message to obtain the second message corresponding to the service key.

[0026] According to the business key distribution method provided in this application, the method further includes: Multiple ciphertext fragments of the second ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each ciphertext fragment is quantum encrypted and stored in the payload of each message along with the corresponding ciphertext fragment.

[0027] According to the business key distribution method provided in this application, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0028] According to a business key distribution method provided in this application, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0029] According to the business key distribution method provided in this application, the quantum security comprehensive performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

[0030] According to the business key distribution method provided in this application, the update cycle of the node quantum key is configured based on the security requirements of the business and the amount of communication data.

[0031] According to the service key distribution method provided in this application, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0032] This application also provides a business key distribution method, applied to a destination node, including: The system receives a second message sent by at least one intermediate node. The second message is generated based on the service key and target type obtained by the at least one intermediate node parsing the first message forwarded by the source node. The first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The second message is parsed to obtain the service key.

[0033] According to the business key distribution method provided in this application, the step of parsing the second message to obtain the business key includes: The segment identifier in the segment routing header of the second message is parsed to obtain the target type; The second ciphertext is determined based on the payload in the segment routing header of the second message; Based on the target type, the second ciphertext is decrypted to obtain the business key.

[0034] According to the business key distribution method provided in this application, the method further includes: The slice identifier or application identifier of the destination node is parsed, and the reserved resources of the node quantum key of the destination node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key.

[0035] According to the business key distribution method provided in this application, the method further includes: Multiple ciphertext fragments of the second ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each ciphertext fragment is quantum encrypted and stored in the payload of multiple messages along with the corresponding ciphertext fragment. Combine the ciphertext fragments.

[0036] According to the business key distribution method provided in this application, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0037] According to a business key distribution method provided in this application, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0038] According to the business key distribution method provided in this application, the quantum security comprehensive performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

[0039] According to the business key distribution method provided in this application, the update cycle of the node quantum key is configured based on the security requirements of the business and the amount of communication data.

[0040] According to the service key distribution method provided in this application, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0041] This application also provides a business key distribution device applied to a quantum key distribution controller, comprising: The acquisition module is used to acquire attribute information related to business key distribution for each node in the quantum communication network; The determination module is used to determine the target key distribution path based on the attribute information and business security level requirements of each node; The first generation module is used to generate a path strategy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations are performed and whether forwarding behavior is performed at the target node. The first forwarding module is used to send the path policy to the source node in the target key distribution path; the source node is used to distribute the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy.

[0042] This application also provides a business key distribution device, applied to a source node, comprising: The first receiving module is used to receive a path strategy sent by the quantum key distribution controller; the path strategy is generated based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; The second generation module is used to generate a first message corresponding to the business key based on the path strategy. The second forwarding module is used to forward the first message to at least one intermediate node in the target key distribution path; the at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message.

[0043] This application also provides a business key distribution device, applied to at least one intermediate node, comprising: The second receiving module is used to receive a first message corresponding to the service key forwarded by the source node; the first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The first parsing module is used to parse the first message to obtain the service key and the target type; The third generation module is used to generate a second message corresponding to the business key based on the business key and the target type; The third forwarding module is used to forward the second message to the destination node in the target key distribution path.

[0044] This application also provides a business key distribution device, applied to a destination node, comprising: The third receiving module is used to receive a second message sent by at least one intermediate node. The second message is generated based on the service key and target type obtained by the at least one intermediate node parsing the first message forwarded by the source node. The first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The second parsing module is used to parse the second message to obtain the service key.

[0045] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any of the above-described business key distribution methods.

[0046] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the business key distribution method as described above.

[0047] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the above-described business key distribution methods.

[0048] The business key distribution method, apparatus, device, and storage medium provided in this application acquire attribute information related to business key distribution for each node in a quantum communication network through a quantum key distribution controller; determine a target key distribution path based on the attribute information and business security level requirements of each node; generate a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; send the path policy to the source node in the target key distribution path; the source node is used to distribute the business key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy. By determining the target key distribution path based on the attribute information and business security level requirements of each node; and generating a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the source node in the target key distribution path distributes the business key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path, thereby achieving business key distribution and improving the security of business key distribution. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a schematic diagram of the structure of the SRv6 message provided in this application.

[0051] Figure 2 This is a schematic diagram of the HMAC TLV provided in this application.

[0052] Figure 3 This is one of the flowcharts illustrating the business key distribution method provided in this application.

[0053] Figure 4 This is a schematic diagram of the OSPF Intra-Area-TE-LSA-Link-TLV provided in this application.

[0054] Figure 5 This is the second flowchart of the business key distribution method provided in this application.

[0055] Figure 6 This is the third flowchart of the business key distribution method provided in this application.

[0056] Figure 7 This is the fourth flowchart of the business key distribution method provided in this application.

[0057] Figure 8 This is a schematic diagram illustrating the interaction between the quantum key distribution controller, source node, at least one intermediate node, and destination node provided in this application.

[0058] Figure 9 This is a schematic diagram of the framework for business key distribution provided in this application.

[0059] Figure 10 This is one of the structural schematic diagrams of the business key distribution device provided in this application.

[0060] Figure 11 This is the second schematic diagram of the business key distribution device provided in this application.

[0061] Figure 12 This is the third schematic diagram of the business key distribution device provided in this application.

[0062] Figure 13 This is the fourth structural schematic diagram of the business key distribution device provided in this application.

[0063] Figure 14 This is a schematic diagram of the physical structure of an electronic device provided in this application. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0065] To facilitate understanding of the various embodiments of this application, the relevant technical knowledge of this application will first be introduced.

[0066] I. Introduction to SRv6 Technology Internet Protocol Version 6 (IPv6) Segment Routing IPv6 (SRv6) is a protocol designed based on source routing principles for forwarding IPv6 packets over a network. Based on the IPv6 forwarding plane, SRv6 inserts a Segment Routing Header (SRH) into IPv6 packets, pushes an explicit IPv6 address stack onto the SRH, and performs hop-by-hop forwarding by continuously updating the destination address and offset address stack through intermediate nodes.

[0067] Figure 1 This is a schematic diagram of the structure of the SRv6 message provided in this application, as shown below. Figure 1 As shown, the SRv6 Segment Identifier (SID) is used to identify an SRv6 segment. The Locator is an identifier assigned to a network node for routing and forwarding packets. In the SRv6 SID, the Locator is a variable-length section to adapt to networks of different sizes. The Locator identifier has two important attributes: routable and aggregable. The Function expresses the forwarding action to be performed by the instruction, equivalent to the opcode of a computer instruction. In SRv6 network programming, different forwarding behaviors are expressed by different Functions. The Argument is an optional field used to carry parameters required when executing the instruction. These parameters may contain flow, service, or any other relevant information. The new Segment Routing Header (SRH) carries a sequence of SRv6 SIDs, enabling flexible programming of SRv6 network paths and various functions. The SRH can also include an optional Type-Length-Value (TLV) field for carrying variable-length data, providing better scalability for SRv6.

[0068] II. Keyed Hashed Message Authentication Code (HMAC): Message authentication based on a hash key. To enhance security and address the risks associated with leaked SIDs to external domains, SRv6 adds an HMAC mechanism to verify SRHs, ensuring that incoming packets from external domains originate from trusted data sources and that SIDs are not leaked to external domains.

[0069] HMAC TLV is optional and is used to verify whether the source of the message allows the use of the current segment in the destination address (DA) of the message, and to ensure that the message is not modified during transmission.

[0070] HMAC information is the result calculated from a sample text (TXT) using a specific key and algorithm. The destination node corresponding to DA will encrypt the same sample TXT using the same pre-shared key and algorithm stored locally, and then compare the encryption result with the HAMC field to see if they match.

[0071] Figure 2 This is a schematic diagram of the HMAC TLV structure provided in this application, as shown below. Figure 2 As shown, D is 1, indicating that a reduced segment list is used and destination address verification is disabled. HMAC Key ID: Used to uniquely identify the pre-shared key and algorithm used to generate the HMAC, i.e.<pre-shared key,algorithm> HMAC TLV is used to verify whether the SRH applied to the packet was selected by the authorizing party and to ensure that the segment list is not modified after generation. It also allows verification that the current segment (in the authorizing segment list) has been authorized. The HMAC field is the output of the HMAC calculation and is defined as follows: Key: A pre-shared key identified by the HMAC Key ID; HMAC algorithm: identified by HMAC Key ID (cryptographic hash function such as Message-Digest Algorithm 5 (MD-5), Secure Hash Algorithm 1 (SHA-1), SHA-256); Text: A combination of IPv6 header and SRH, received at the node that verifies HMAC; the text includes: IPv6 header, index of the last valid entry of SRH, flags, HMAC length of less than 16 bits, HMACKey ID, and all addresses in the segment list.

[0072] The HMAC digest is truncated to 32 octets and placed in the HMAC field of the HMAC TLV.

[0073] If HMAC authentication succeeds, processing continues as normal; if authentication fails, an Internet Control Message Protocol (ICMP) error message (such as parameter problem, error code, pointing to HMAC TLV) will be generated and logged, and the packet will be discarded.

[0074] III. Quantum Key Distribution Network (QKDN) Quantum Key Distribution (QKD) is a technology that achieves secure key distribution based on quantum mechanical principles (such as the uncertainty principle and the no-cloning theorem). Its core objective is to enable legitimate communicating parties to generate a shared key in the presence of potential eavesdroppers. By using quantum states (such as the polarization and phase states of photons) as information carriers, the communicating parties can transmit the key through a quantum channel and verify its security through a classical channel. This ensures that if the key is eavesdropped on during the distribution process, it will be detected in real time, thus achieving theoretically unconditionally secure key distribution.

[0075] QKDN is a quantum communication network system built on QKD technology. It aims to connect multiple QKD nodes into a network to achieve secure key distribution and management over long distances and for multiple users. Its core is to solve the problem of limited transmission distance in a single QKD link (such as photon attenuation in optical fibers, which typically results in a transmission distance of ≤100 kilometers) by extending the communication range through relay technology.

[0076] Transmitting qubits between two nodes over long distances is challenging because channel attenuation and the no-cloning principle prevent qubits from being copied and amplified by repeaters. Entanglement becomes a crucial resource for long-distance quantum communication. After establishing end-to-end entanglement, a qubit can be transferred from the source node to the destination node via entanglement swapping, a process known as quantum teleportation.

[0077] There are three networking methods for QKD networks: optical switching / beam splitter schemes, quantum repeater schemes, and trusted repeater schemes. The optical switching / beam splitter scheme utilizes optical switches or beam splitters to achieve multi-user QKD link switching, thereby enabling key distribution among multiple users. However, due to the transmission distance limitation caused by quantum signal attenuation, this method cannot achieve long-distance transmission and is therefore unsuitable for large-scale networking. The quantum repeater scheme uses the principle of quantum entanglement to achieve the storage and forwarding of quantum states, theoretically enabling long-distance key distribution. However, the quantum memory or quantum error correction technology required for this scheme is still immature and has not yet reached a practical level. The trusted repeater scheme connects multiple point-to-point QKD links to achieve end-to-end key distribution, thus enabling long-distance key distribution. This is currently the widely adopted solution in QKD networks.

[0078] Existing business keys are encrypted using symmetric and asymmetric encryption algorithms during transmission. However, both symmetric and asymmetric encryption algorithms can be cracked by quantum computers, leading to the theft and tampering of business keys during transmission.

[0079] As a core routing technology in the IPv6 era, SRv6 possesses path programmability and dynamic scheduling capabilities. The ultimate end-to-end secure transmission of service keys through SRv6 paths combined with quantum key distribution relay is currently still in the early stages of research.

[0080] To address the potential for theft or tampering in existing business key transmission processes, this application proposes a scheme to encrypt and securely distribute current business keys using quantum keys.

[0081] The following is combined with Figures 3-8 Describe the business key distribution method of this application.

[0082] Figure 3 This is one of the flowcharts illustrating the business key distribution method provided in this application, such as... Figure 3 As shown, the method is applied to a quantum key distribution controller (i.e., a QKD controller) and includes the following steps 301-304.

[0083] Step 301: Obtain the attribute information related to business key distribution for each node in the quantum communication network.

[0084] Specifically, the service key can be represented by K1 and is used to encrypt service data. Each node in the quantum communication network corresponds to a node quantum key; for example, node A corresponds to Kab, node B to Kbc, and node C to Kcd. The service key can be generated based on quantum states (such as photon polarization) by a QKD system, or it can be a classical key for the end-to-end service layer, calculated using a key exchange algorithm such as RSA or DH. The node quantum key is the link relay key used to protect the service key K1. It is generated by the QKD system based on quantum states and is a shared quantum key between adjacent nodes. Each node includes multiple node quantum keys and node quantum key storage resources. Each node can reserve resources for service keys and can also generate node quantum keys.

[0085] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0086] Specifically, the update cycle of the node quantum key can be flexibly configured based on the security requirements of the business and the amount of communication data. For example, a larger update cycle can be set when the security requirements are low, and a smaller update cycle can be set when the security requirements are relatively high.

[0087] Based on the business security level requirements issued by the QKD management system, the QKD controller determines the task that needs to be performed for business key distribution. The quantum communication system includes multiple communication links, each containing multiple nodes, such as a router, a source node (e.g., A), at least one intermediate node (e.g., B or C), and a destination node (e.g., D). Each node can have a built-in QKD board or be connected to an external QKD board.

[0088] QKD information flooding involves each node using an Interior Gateway Protocol (IGP). Each node uses the IGP to collect link path state information, including bandwidth, flow engineering metrics (TE Metric), affinity properties, and attributes related to quantum key distribution. These attributes include whether quantum security is supported and the overall quantum security performance level. The overall quantum security performance level is divided into high, medium, and low levels. Whether quantum security is supported is determined by an internal or external QKD board. The overall quantum security performance level is based on at least one of the following: the node's remaining quantum key quantity, the node's quantum key generation rate, the node's quantum key exchange rate, the node's quantum key storage resources, and the quantum channel bandwidth.

[0089] It should be noted that the attribute information is carried and extended through the IGP Open Shortest Path First (OSPF) Intra-Area-TE-LSA-Link-TLV. Figure 4 This is a schematic diagram of the OSPF Intra-Area-TE-LSA-Link-TLV structure provided in this application, as shown below. Figure 4 As shown, the TLV carries whether it supports quantum security and the overall quantum security performance level, as well as the remaining amount of node quantum keys, node quantum key generation rate, and node quantum key exchange rate to determine the overall quantum security performance level.

[0090] Each node can report attribute information related to business key distribution to the quantum key distribution controller. Alternatively, the quantum key distribution controller can periodically collect attribute information collected by each node in the quantum layer using the IGP protocol, thereby obtaining the attribute information related to business key distribution of each node in the quantum communication network.

[0091] Optionally, the quantum key distribution controller can also combine the SRv6 path status with the remaining quantum key quantity and storage resources of each node to perform a comprehensive calculation of security and network connection status, and eliminate nodes with a remaining quantum key quantity below a preset threshold, thereby eliminating the corresponding link.

[0092] Step 302: Determine the target key distribution path based on the attribute information and business security level requirements of each node.

[0093] Specifically, the quantum key distribution controller can determine the target key distribution path based on the attribute information of each node and the business security level requirements. The target key distribution path refers to an SRv6 path that meets the requirements of the business security level and the service level agreement (SLA). For example, the target key distribution path is ABCD.

[0094] Step 303: Generate a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations are performed and whether forwarding behavior is performed at the target node.

[0095] Specifically, the SRv6 path SID list segment in the SRv6 message adds a target type (i.e., a Function type). The Function type indicates that the key needs to be encrypted or decrypted at this node, and also indicates the corresponding forwarding behavior to the next hop. The target type is the function type corresponding to the segment identifier in the segment routing header of the message, i.e., the SIDFunction type. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The path policy refers to the SRv6 Policy, which indicates the operations performed by each target node in the target key distribution path corresponding to the segment identifier in the segment routing header of the message. The operations include encryption / decryption operations and forwarding operations.

[0096] The quantum key distribution controller can generate a path policy (i.e., SRv6 Policy) based on the target key distribution path and the target type corresponding to each target node in the target key distribution path.

[0097] Optionally, if the intermediate node does not have a built-in or externally connected quantum security device, the path strategy also includes a segment identifier corresponding to the intermediate node that does not have a built-in or externally connected quantum security device. The segment identifier indicates that the intermediate node that does not have a built-in or externally connected quantum security device only forwards the message.

[0098] Specifically, quantum-safe devices can be QKD boards. In cases where intermediate nodes (such as nodes B or C) do not have built-in or external quantum-safe devices, for scenarios with low to medium security requirements, the path strategy can also arrange segment identifiers corresponding to intermediate nodes that do not have built-in or external quantum-safe devices. Intermediate nodes that do not have built-in or external quantum-safe devices only perform relay forwarding, that is, they forward packets without processing them.

[0099] Step 304: Send the path policy to the source node in the target key distribution path; the source node is used to distribute the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy.

[0100] Specifically, the quantum key distribution controller sends the generated path policy to the source node in the target key distribution path, for example, the source node is node A.

[0101] Optionally, the quantum key distribution controller can also configure an association table between slice identifiers or application identifiers and reserved resources of node quantum keys, and distribute the association table to each node.

[0102] The source node parses the slice identifier or application identifier and retrieves the reserved resources of the source node's quantum key by querying the association table between the slice identifier or application identifier and the reserved resources of the node's quantum key. The source node also parses the path policy to obtain the target type. The association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0103] The source node (e.g., node A) encrypts the business key (K1) based on the target type using the quantum key (e.g., Kab) corresponding to the reserved resources, to obtain the first ciphertext. The encryption operation can be XOR encryption or symmetric encryption. The first ciphertext is used as or placed in the payload of the first message (SRv6 message) to obtain the first message corresponding to the business key, and the first message is forwarded to at least one intermediate node (e.g., node B, node C).

[0104] It should be noted that each intermediate node forwards the business key hop by hop. After parsing the slice identifier or application identifier, each intermediate node queries the reserved resources of the node quantum key through the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. Based on the target type and the reserved resources, the business key is encrypted using the node quantum key reserved by the intermediate node.

[0105] To ensure the security of the service key and the long-distance decay of the quantum state, the intermediate node receives the first message and verifies it using the HMAC mechanism. If the verification is successful, it parses the segment identifier in the segment routing header of the first message to obtain the target type. Based on the payload in the segment routing header of the first message, it determines the first ciphertext and decrypts it using the node quantum key (e.g., Kab) corresponding to the source node (e.g., node A) to obtain the service key (K1). The decryption operation can use XOR or symmetric decryption. Based on the target type and reserved resources, the intermediate node encrypts the service key (K1) using the node quantum key (e.g., Kbc) to obtain the second ciphertext. The encryption operation can use XOR or symmetric encryption. The second ciphertext is then used as or placed in the payload of the second message to obtain the second message corresponding to the service key, and the second message is forwarded to the destination node (e.g., node D).

[0106] It should be noted that when there are multiple intermediate nodes, each intermediate node uses the same method, employing the HMAC mechanism to verify the received message. If the verification is successful, the service key is decrypted, and the decrypted service key is encrypted to obtain ciphertext, which is used as or placed in the payload of a new message. The new message is then forwarded to the next intermediate node, and so on, until the intermediate nodes finish forwarding. The last intermediate node then forwards the final second message to the destination node.

[0107] The destination node decrypts the second message to obtain the service key. Simultaneously, the destination node stores a table recording the association between the slice identifier or application identifier and the reserved resources for the node's quantum key, so that the service key can be used for decryption when subsequently receiving service data corresponding to the slice identifier or application identifier.

[0108] Since the decryption and encryption of the business key are performed at the source node and at least one intermediate node (e.g., node B, node C), there is a risk of plaintext exposure. To mitigate this risk, multiple ciphertext fragments of the first or second ciphertext can be transmitted in batches as multiple packets. Simultaneously, the sequence number of each ciphertext fragment is quantum encrypted and placed in the payload of the corresponding packet along with the encrypted sequence number. The encrypted sequence number is placed in a specific field within the payload, such as the beginning or end. The ciphertext fragments are then combined at the destination node (tail node).

[0109] The service key distribution method provided in this application obtains service key distribution-related attribute information of each node in a quantum communication network through a quantum key distribution controller; determines a target key distribution path based on the attribute information and service security level requirements of each node; generates a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; sends the path policy to the source node in the target key distribution path; the source node is used to distribute the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy. By determining the target key distribution path based on the attribute information and service security level requirements of each node; and generating a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the source node in the target key distribution path distributes the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path, thereby achieving service key distribution and improving the security of service key distribution.

[0110] Optionally, the specific implementation of step 302 above includes: Based on the attribute information of each node and the business security level requirements, at least one key distribution path is determined; based on the priority of each of the at least one key distribution path, a target key distribution path is determined.

[0111] Specifically, based on the attribute information of each node and the service security level requirements, the quantum key distribution controller can use the KSP algorithm (K shortest path algorithm) to determine at least one key distribution path when applying IGP computation, such as K key relay paths. This ensures that if one key relay fails, there is an alternative path available, improving the success rate of user key exchange services. Then, based on the priority of each of the at least one key distribution path, the highest priority key distribution path is selected as the target key distribution path.

[0112] Optionally, the specific implementation of step 303 above includes: The path strategy is generated based on the target key distribution path, the reserved resources of the node quantum key of each target node in the target key distribution path, and the target type corresponding to each target node.

[0113] Specifically, the reserved resources of the node quantum key can be reserved through slice ID or application ID (such as ARN ID), and an association table is established between the slice ID or application ID and the reserved resources of the node quantum key. The specific location of the slice ID or application ID in the SRv6 message can be located in the source address in the IPv6 extension header.

[0114] Figure 5 This is the second flowchart illustrating the business key distribution method provided in this application, as shown below. Figure 5 As shown, it is applied to the source node, including steps 501-503.

[0115] Step 501: Receive the path policy sent by the quantum key distribution controller; the path policy is generated based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node.

[0116] Specifically, the service key can be represented by K1 and is used to encrypt service data. Each node in the quantum communication network corresponds to a node quantum key; for example, node A corresponds to Kab, node B to Kbc, and node C to Kcd. The service key can be generated based on quantum states (such as photon polarization) through a QKD system, or it can be a classical key for the end-to-end service layer, calculated using a key exchange algorithm such as RSA or DH. The node quantum key is a link relay key used to protect the service key (K1). It is generated by the QKD system based on quantum states and is a shared quantum key between adjacent nodes. Each node includes multiple node quantum keys and node quantum key storage resources. Each node can reserve resources for the service key and can also generate its own node quantum key.

[0117] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0118] Specifically, the update cycle of the node quantum key can be flexibly configured based on the security requirements of the business and the amount of communication data. For example, a larger update cycle can be set when the security requirements are low, and a smaller update cycle can be set when the security requirements are relatively high.

[0119] Based on the business security level requirements issued by the QKD management system, the QKD controller determines the task that needs to be performed for business key distribution. The quantum communication system includes multiple communication links, each containing multiple nodes, such as a router, a source node (e.g., node A), at least one intermediate node (e.g., node B or node C), and a destination node (e.g., node D). Each node can have a built-in QKD board or be connected to an external QKD board.

[0120] QKD information flooding involves each node using an Interior Gateway Protocol (IGP). Each node uses the IGP to collect link path state information, including bandwidth, flow engineering metrics (TE Metric), affinity properties, and attributes related to quantum key distribution. These attributes include whether quantum security is supported and the overall quantum security performance level. The overall quantum security performance level is divided into high, medium, and low levels. Whether quantum security is supported is determined by an internal or external QKD board. The overall quantum security performance level is based on at least one of the following: the node's remaining quantum key quantity, the node's quantum key generation rate, the node's quantum key exchange rate, the node's quantum key storage resources, and the quantum channel bandwidth.

[0121] It should be noted that the attribute information is extended via the IGP Open Shortest Path First (OSPF) Intra-Area-TE-LSA-Link-TLV. For example... Figure 4 As shown, the TLV carries whether it supports quantum security and the overall quantum security performance level, as well as the remaining amount of node quantum keys, node quantum key generation rate, and node quantum key exchange rate to determine the overall quantum security performance level.

[0122] Each node can report attribute information related to business key distribution to the quantum key distribution controller. Alternatively, the quantum key distribution controller can periodically collect attribute information collected by each node in the quantum layer using the IGP protocol, thereby obtaining the attribute information related to business key distribution of each node in the quantum communication network.

[0123] Optionally, the quantum key distribution controller can also combine the SRv6 path status with the remaining quantum key quantity and storage resources of each node to perform a comprehensive calculation of security and network connection status, and eliminate nodes with a remaining quantum key quantity below a preset threshold, thereby eliminating the corresponding link.

[0124] The SRv6 path SID list in the SRv6 message adds a target type (i.e., Function type). The Function type indicates that the key needs to be encrypted or decrypted at this node, and also indicates the corresponding forwarding behavior to the next hop. The target type is the function type corresponding to the segment identifier in the segment routing header of the message, i.e., the SID Function type. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The path policy refers to the SRv6 Policy, which indicates the operations performed by each target node in the target key distribution path corresponding to the segment identifier in the segment routing header of the message. The operations include encryption / decryption operations and forwarding operations.

[0125] Based on the attribute information of each node and the service security level requirements, the quantum key distribution controller can use the KSP algorithm to determine at least one key distribution path when applying IGP computation, such as K key relay paths. This ensures that if one key relay fails, there is an alternative path available, improving the success rate of user key exchange services. Then, based on the priority of each of the at least one key distribution path, the highest priority key distribution path is selected as the target key distribution path.

[0126] The quantum key distribution controller can generate a path policy (i.e., SRv6 Policy) based on the target key distribution path and the target type corresponding to each target node in the target key distribution path.

[0127] Optionally, if the intermediate node does not have a built-in or externally connected quantum security device, the path strategy also includes a segment identifier corresponding to the intermediate node that does not have a built-in or externally connected quantum security device. The segment identifier indicates that the intermediate node that does not have a built-in or externally connected quantum security device only forwards the message.

[0128] Specifically, quantum-safe devices can be QKD boards. In cases where intermediate nodes (such as nodes B or C) do not have built-in or external quantum-safe devices, for scenarios with low to medium security requirements, the path strategy can also arrange segment identifiers corresponding to intermediate nodes that do not have built-in or external quantum-safe devices. Intermediate nodes that do not have built-in or external quantum-safe devices only perform relay forwarding, that is, they forward packets without processing them.

[0129] The quantum key distribution controller sends the generated path policy to the source node in the target key distribution path, for example, the source node is node A.

[0130] Optionally, the quantum key distribution controller can also configure an association table between slice identifiers or application identifiers and reserved resources of node quantum keys, and distribute the association table to each node.

[0131] Step 502: Based on the path strategy, generate the first message corresponding to the business key.

[0132] Specifically, the source node can generate the first message corresponding to the business key based on the path policy.

[0133] Step 503: Forward the first message to at least one intermediate node in the target key distribution path; the at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message.

[0134] Specifically, there can be one or more intermediate nodes. The source node forwards the first message to at least one intermediate node (e.g., node B, node C) in the target key distribution path.

[0135] It should be noted that each intermediate node forwards the service key hop by hop. After each intermediate node parses the message to obtain the slice identifier or application identifier, it queries the reserved resources of the node quantum key of the intermediate node through the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. Based on the target type and the reserved resources, the service key is encrypted using the node quantum key reserved by the intermediate node.

[0136] To ensure the security of the service key and the long-distance decay of the quantum state, the intermediate node receives the first message and verifies it using the HMAC mechanism. If the verification is successful, it parses the segment identifier in the segment routing header of the first message to obtain the target type. Based on the payload in the segment routing header of the first message, it determines the first ciphertext and decrypts it using the node quantum key (e.g., Kab) corresponding to the source node (e.g., node A) to obtain the service key (K1). The decryption operation can use XOR or symmetric decryption. Based on the target type and reserved resources, the intermediate node encrypts the service key (K1) using the node quantum key (e.g., Kbc) to obtain the second ciphertext. The encryption operation can use XOR or symmetric encryption. The second ciphertext is then used as or placed in the payload of the second message to obtain the second message corresponding to the service key, and the second message is forwarded to the destination node (e.g., node D).

[0137] It should be noted that when there are multiple intermediate nodes, each intermediate node uses the same method, employing the HMAC mechanism to verify the received message. If the verification is successful, the service key is decrypted, and the decrypted service key is encrypted to obtain ciphertext, which is used as or placed in the payload of a new message. The new message is then forwarded to the next intermediate node, and so on, until the intermediate nodes finish forwarding. The last intermediate node then forwards the final second message to the destination node.

[0138] The destination node decrypts the second message to obtain the service key. Simultaneously, the destination node stores a table recording the association between the slice identifier or application identifier and the reserved resources for the node's quantum key, so that the service key can be used for decryption when subsequently receiving service data corresponding to the slice identifier or application identifier.

[0139] The service key distribution method provided in this application receives a path policy sent by a quantum key distribution controller through a source node. The path policy is generated based on a target key distribution path and a target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. Based on the path policy, a first message corresponding to the service key is generated. The first message is forwarded to at least one intermediate node in the target key distribution path. The at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message. By receiving a path strategy sent by the quantum key distribution controller, where the path strategy is determined by the quantum key distribution controller based on the attribute information of each node and the business security level requirements, the source node can generate a first message corresponding to the business key based on the path strategy. Then, based on the first message, the business key is distributed to the destination node in the target key distribution path, thereby realizing the distribution of the business key and improving the security of the business key distribution.

[0140] Optionally, the specific implementation of step 502 above includes: Parse the slice identifier or application identifier of the source node, and query the reserved resources of the node quantum key of the source node through the association table between the slice identifier or application identifier and the reserved resources of the node quantum key; parse the path strategy to obtain the target type; based on the target type, encrypt the service key using the node quantum key corresponding to the reserved resources to obtain the first ciphertext; based on the first ciphertext, generate the first message corresponding to the service key.

[0141] Specifically, the source node parses the slice identifier or application identifier of the source node, and queries the reserved resources of the node quantum key through the association table between the slice identifier or the application identifier and the reserved resources of the node quantum key; the source node parses the path strategy to obtain the target type.

[0142] Optionally, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0143] Based on the target type, the source node uses the node quantum key (e.g., Kab) corresponding to the reserved resources to encrypt the business key (K1) to obtain the first ciphertext. The encryption operation can be XOR encryption or symmetric encryption. Based on the first ciphertext, the source node generates the first message corresponding to the business key.

[0144] Optionally, generating the first message corresponding to the business key based on the first ciphertext includes: The first ciphertext is used as or placed in the payload of the first message to obtain the first message corresponding to the service key.

[0145] Specifically, the source node can obtain the first message corresponding to the business key by using the first ciphertext as or placing it in the payload of the first message (SRv6 message).

[0146] Optionally, the method further includes: Multiple ciphertext fragments of the first ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each ciphertext fragment is quantum encrypted and stored in the payload of each first message along with the corresponding ciphertext fragment.

[0147] Specifically, since the business key decryption and encryption operations are performed at the source node, there is a risk of plaintext exposure. Multiple first ciphertext fragments can be transmitted in batches as multiple messages. At the same time, the sequence number of each first ciphertext fragment is quantum encrypted and placed in the payload of the corresponding message along with the corresponding first ciphertext fragment. The encrypted sequence number is placed in a specific field in the payload, such as the beginning or the end.

[0148] Figure 6 This is the third flowchart illustrating the business key distribution method provided in this application, as shown below. Figure 6 As shown, it is applied to at least one intermediate node, including steps 601-604.

[0149] Step 601: Receive the first message corresponding to the service key forwarded by the source node; the first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on the target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node.

[0150] Specifically, the service key can be represented by K1 and is used to encrypt service data. Each node in the quantum communication network corresponds to a node quantum key; for example, node A corresponds to Kab, node B to Kbc, and node C to Kcd. The service key can be generated based on quantum states (such as photon polarization) by a QKD system, or it can be a classical key for the end-to-end service layer, calculated using a key exchange algorithm such as RSA or DH. The node quantum key is the link relay key used to protect the service key K1. It is generated by the QKD system based on quantum states and is a shared quantum key between adjacent nodes. Each node includes multiple node quantum keys and node quantum key storage resources. Each node can reserve resources for service keys and can also generate node quantum keys.

[0151] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0152] Specifically, the update cycle of the node quantum key can be flexibly configured based on the security requirements of the business and the amount of communication data. For example, a larger update cycle can be set when the security requirements are low, and a smaller update cycle can be set when the security requirements are relatively high.

[0153] Based on the business security level requirements issued by the QKD management system, the QKD controller determines the task that needs to be performed for business key distribution. The quantum communication system includes multiple communication links, each containing multiple nodes, such as a router, a source node (e.g., node A), at least one intermediate node (e.g., node B or node C), and a destination node (e.g., node D). Each node can have a built-in QKD board or be connected to an external QKD board.

[0154] QKD information flooding involves each node using an Interior Gateway Protocol (IGP). Each node uses the IGP to collect link path state information, including bandwidth, flow engineering metrics (TE Metric), affinity properties, and attributes related to quantum key distribution. These attributes include whether quantum security is supported and the overall quantum security performance level. The overall quantum security performance level is divided into high, medium, and low levels. Whether quantum security is supported is determined by an internal or external QKD board. The overall quantum security performance level is based on at least one of the following: the node's remaining quantum key quantity, the node's quantum key generation rate, the node's quantum key exchange rate, the node's quantum key storage resources, and the quantum channel bandwidth.

[0155] It should be noted that the attribute information is extended via the IGP Open Shortest Path First (OSPF) Intra-Area-TE-LSA-Link-TLV. For example... Figure 4 As shown, the TLV carries whether it supports quantum security and the overall quantum security performance level, as well as the remaining amount of node quantum keys, node quantum key generation rate, and node quantum key exchange rate to determine the overall quantum security performance level.

[0156] Each node can report attribute information related to business key distribution to the quantum key distribution controller. Alternatively, the quantum key distribution controller can periodically collect attribute information collected by each node in the quantum layer using the IGP protocol, thereby obtaining the attribute information related to business key distribution of each node in the quantum communication network.

[0157] Optionally, the quantum key distribution controller can also combine the SRv6 path status with the remaining quantum key quantity and storage resources of each node to perform a comprehensive calculation of security and network connection status, and eliminate nodes with a remaining quantum key quantity below a preset threshold, thereby eliminating the corresponding link.

[0158] The SRv6 path SID list in the SRv6 message adds a target type (i.e., Function type). The Function type indicates that the key needs to be encrypted / decrypted at this node, and also indicates the corresponding forwarding behavior to the next hop. The target type is the function type corresponding to the segment identifier in the segment routing header of the message, i.e., the SID Function type. The target type is used to indicate whether encryption / decryption operations and forwarding behavior should be performed at the target node. The path policy refers to the SRv6 Policy. The path policy indicates the operations performed at each target node in the target key distribution path corresponding to the segment identifier in the segment routing header of the message. The operations include encryption / decryption operations and forwarding operations.

[0159] Based on the attribute information of each node and the service security level requirements, the quantum key distribution controller can use the KSP algorithm to determine at least one key distribution path when applying IGP computation, such as K key relay paths. This ensures that if one key relay fails, there is an alternative path available, improving the success rate of user key exchange services. Then, based on the priority of each of the at least one key distribution path, the highest priority key distribution path is selected as the target key distribution path.

[0160] The quantum key distribution controller can generate a path policy (i.e., SRv6 Policy) based on the target key distribution path and the target type corresponding to each target node in the target key distribution path.

[0161] Optionally, if the intermediate node does not have a built-in or externally connected quantum security device, the path strategy also includes a segment identifier corresponding to the intermediate node that does not have a built-in or externally connected quantum security device. The segment identifier indicates that the intermediate node that does not have a built-in or externally connected quantum security device only forwards the message.

[0162] Specifically, quantum-safe devices can be QKD boards. In cases where intermediate nodes (such as nodes B or C) do not have built-in or external quantum-safe devices, for scenarios with low to medium security requirements, the path strategy can also arrange segment identifiers corresponding to intermediate nodes that do not have built-in or external quantum-safe devices. Intermediate nodes that do not have built-in or external quantum-safe devices only perform relay forwarding, that is, they forward packets without processing them.

[0163] The quantum key distribution controller sends the generated path policy to the source node in the target key distribution path, for example, the source node is node A.

[0164] Optionally, the quantum key distribution controller can also configure an association table between slice identifiers or application identifiers and reserved resources of node quantum keys, and distribute the association table to each node.

[0165] The source node forwards the first message to at least one intermediate node (e.g., node B, node C) in the target key distribution path. At least one intermediate node receives the first message sent by the source node.

[0166] It should be noted that each intermediate node forwards the service key hop by hop. After each intermediate node parses the message to obtain the slice identifier or application identifier, it queries the reserved resources of the node quantum key of the intermediate node through the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. Based on the target type and the reserved resources, the service key is encrypted using the node quantum key reserved by the intermediate node.

[0167] Step 602: Parse the first message to obtain the service key.

[0168] Specifically, to ensure the security of the business key and the long-distance decay of the quantum state, at least one intermediate node receives the first message and verifies it using the HMAC mechanism. If the verification is successful, the first message is parsed to obtain the business key.

[0169] Step 603: Based on the service key and the target type, generate a second message corresponding to the service key.

[0170] Specifically, at least one intermediate node can generate a second message corresponding to the business key based on the business key and the target type.

[0171] Step 604: Forward the second message to the destination node in the target key distribution path.

[0172] Specifically, at least one intermediate node forwards the second message to the destination node in the target key distribution path.

[0173] The destination node parses the second message to obtain the service key. Simultaneously, the destination node stores a table recording the association between the slice identifier or application identifier and the reserved resources for the node's quantum key, so that the service key can be used for decryption when subsequently receiving service data corresponding to the slice identifier or application identifier.

[0174] The service key distribution method provided in this application receives a first message corresponding to a service key forwarded by a source node through at least one intermediate node. The first message is generated by the source node based on a path policy, which is sent to the source node by a quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and a target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type indicates whether encryption / decryption operations and forwarding behavior are performed at the target node. The first message is parsed to obtain the service key and the target type. Based on the service key and the target type, a second message corresponding to the service key is generated. The second message is forwarded to the destination node in the target key distribution path. By parsing the first message through at least one intermediate node to obtain the service key and target type, generating the second message based on the service key and target type, and forwarding the second message to the destination node in the target key distribution path, the service key distribution is achieved, thereby improving the security of the service key distribution.

[0175] Optionally, the specific implementation of step 602 above includes: The segment identifier in the segment routing header of the first message is parsed to obtain the target type; Based on the payload in the segment routing header of the first message, the first ciphertext is determined; based on the target type, the first ciphertext is decrypted to obtain the service key.

[0176] Specifically, at least one intermediate node parses the segment identifier in the segment routing header of the first message to obtain the target type; reads the payload in the segment routing header of the first message to determine the first ciphertext; based on the target type, the first ciphertext is decrypted using the node quantum key (e.g., Kab) corresponding to the source node (e.g., node A) to obtain the business key (K1), wherein the decryption operation can be XOR decryption or symmetric decryption operation.

[0177] Optionally, the specific implementation of step 603 above includes: Parse the slice identifier or application identifier of the intermediate node, and query the reserved resources of the node quantum key of the intermediate node through the association table between the slice identifier or application identifier and the reserved resources of the node quantum key; based on the target type and the reserved resources, encrypt the business key using the node quantum key reserved by the intermediate node to obtain the second ciphertext; based on the second ciphertext, generate the second message corresponding to the business key.

[0178] Specifically, the intermediate node parses the slice identifier or application identifier of the intermediate node, and retrieves the reserved resources of the node quantum key by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key.

[0179] Optionally, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0180] Based on the target type and the reserved resources, the business key (K1) is encrypted using the node quantum key (e.g., Kbc) reserved by the intermediate node to obtain the second ciphertext. The encryption operation can be XOR encryption or symmetric encryption. Based on the second ciphertext, the second message corresponding to the business key can be generated.

[0181] Optionally, generating the second message corresponding to the business key based on the second ciphertext includes: The second ciphertext is used as or placed in the payload of the second message to obtain the second message corresponding to the service key.

[0182] Specifically, the intermediate node uses the second ciphertext as or places it in the payload of the second message to obtain the second message corresponding to the business key.

[0183] It should be noted that when there are multiple intermediate nodes, each intermediate node uses the same method, employing the HMAC mechanism to verify the received message. If the verification is successful, the service key is decrypted, and the decrypted service key is encrypted to obtain ciphertext, which is used as or placed in the payload of a new message. The new message is then forwarded to the next intermediate node, and so on, until the intermediate nodes finish forwarding. The last intermediate node then forwards the final second message to the destination node.

[0184] Optionally, the method further includes: Multiple ciphertext fragments of the second ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each second ciphertext fragment is quantum encrypted and stored in the payload of each message along with the corresponding second ciphertext fragment.

[0185] Specifically, since the decryption and encryption of the business key at intermediate nodes pose a risk of plaintext exposure, multiple ciphertext fragments can be transmitted in batches as multiple messages. Simultaneously, the sequence number of each ciphertext fragment is quantum encrypted and placed along with the corresponding ciphertext fragment in the payload of the corresponding message. The encrypted sequence number is placed in a specific field within the payload, such as the beginning or end. The ciphertext fragments are then combined at the destination node (tail node).

[0186] Figure 7 This is the fourth flowchart of the business key distribution method provided by the present invention, as shown below. Figure 7 As shown, the method is applied to the target node and includes steps 701-702.

[0187] Step 701: Receive a second message sent by at least one intermediate node; the second message is generated based on the service key and target type obtained by the at least one intermediate node parsing the first message forwarded by the source node, the first message is generated by the source node based on a path policy, the path policy is sent to the source node by the quantum key distribution controller, the path policy is generated by the quantum key distribution controller based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node.

[0188] Specifically, the service key can be represented by K1 and is used to encrypt service data. Each node in the quantum communication network corresponds to a node quantum key; for example, node A corresponds to Kab, node B to Kbc, and node C to Kcd. The service key can be generated based on quantum states (such as photon polarization) by a QKD system, or it can be a classical key for the end-to-end service layer, calculated using a key exchange algorithm such as RSA or DH. The node quantum key is the link relay key used to protect the service key K1. It is generated by the QKD system based on quantum states and is a shared quantum key between adjacent nodes. Each node includes multiple node quantum keys and node quantum key storage resources. Each node can reserve resources for service keys and can also generate node quantum keys.

[0189] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0190] Specifically, the update cycle of the node quantum key can be flexibly configured based on the security requirements of the business and the amount of communication data. For example, a larger update cycle can be set when the security requirements are low, and a smaller update cycle can be set when the security requirements are relatively high.

[0191] Based on the business security level requirements issued by the QKD management system, the QKD controller determines the task that needs to be performed for business key distribution. The quantum communication system includes multiple communication links, each containing multiple nodes, such as a router, a source node (e.g., node A), at least one intermediate node (e.g., node B or node C), and a destination node (e.g., node D). Each node can have a built-in QKD board or be connected to an external QKD board.

[0192] QKD information flooding involves each node using an Interior Gateway Protocol (IGP). Each node uses the IGP to collect link path state information, including bandwidth, flow engineering metrics (TE Metric), affinity properties, and attributes related to quantum key distribution. These attributes include whether quantum security is supported and the overall quantum security performance level. The overall quantum security performance level is divided into high, medium, and low levels. Whether quantum security is supported is determined by an internal or external QKD board. The overall quantum security performance level is based on at least one of the following: the node's remaining quantum key quantity, the node's quantum key generation rate, the node's quantum key exchange rate, the node's quantum key storage resources, and the quantum channel bandwidth.

[0193] It should be noted that the attribute information is extended via the IGP Open Shortest Path First (OSPF) Intra-Area-TE-LSA-Link-TLV. For example... Figure 4 As shown, the TLV carries whether it supports quantum security and the overall quantum security performance level, as well as the remaining amount of node quantum keys, node quantum key generation rate, and node quantum key exchange rate to determine the overall quantum security performance level.

[0194] Each node can report attribute information related to business key distribution to the quantum key distribution controller. Alternatively, the quantum key distribution controller can periodically collect attribute information collected by each node in the quantum layer using the IGP protocol, thereby obtaining the attribute information related to business key distribution of each node in the quantum communication network.

[0195] Optionally, the quantum key distribution controller can also combine the SRv6 path status with the remaining quantum key quantity and storage resources of each node to perform a comprehensive calculation of security and network connection status, and eliminate nodes with a remaining quantum key quantity below a preset threshold, thereby eliminating the corresponding link.

[0196] The SRv6 path SID list in the SRv6 message adds a target type (i.e., Function type). The Function type indicates that the key needs to be encrypted / decrypted at this node, and also indicates the corresponding forwarding behavior to the next hop. The target type is the function type corresponding to the segment identifier in the segment routing header of the message, i.e., the SID Function type. The target type is used to indicate whether encryption / decryption operations and forwarding behavior should be performed at the target node. The path policy refers to the SRv6 Policy. The path policy indicates the operations performed at each target node in the target key distribution path corresponding to the segment identifier in the segment routing header of the message. The operations include encryption / decryption operations and forwarding operations.

[0197] Based on the attribute information of each node and the service security level requirements, the quantum key distribution controller can use the KSP algorithm to determine at least one key distribution path when applying IGP computation, such as K key relay paths. This ensures that if one key relay fails, there is an alternative path available, improving the success rate of user key exchange services. Then, based on the priority of each of the at least one key distribution path, the highest priority key distribution path is selected as the target key distribution path.

[0198] The quantum key distribution controller can generate a path policy (i.e., SRv6 Policy) based on the target key distribution path and the target type corresponding to each target node in the target key distribution path.

[0199] Optionally, if the intermediate node does not have a built-in or externally connected quantum security device, the path strategy also includes a segment identifier corresponding to the intermediate node that does not have a built-in or externally connected quantum security device. The segment identifier indicates that the intermediate node that does not have a built-in or externally connected quantum security device only forwards the message.

[0200] Specifically, quantum-safe devices can be QKD boards. In cases where intermediate nodes (such as nodes B or C) do not have built-in or external quantum-safe devices, for scenarios with low to medium security requirements, the path strategy can also arrange segment identifiers corresponding to intermediate nodes that do not have built-in or external quantum-safe devices. Intermediate nodes that do not have built-in or external quantum-safe devices only perform relay forwarding, that is, they forward packets without processing them.

[0201] The quantum key distribution controller sends the generated path policy to the source node in the target key distribution path, for example, the source node is node A, the intermediate nodes are nodes B and C, and the destination node is node D.

[0202] Optionally, the quantum key distribution controller can also configure an association table between slice identifiers or application identifiers and reserved resources of node quantum keys, and distribute the association table to each node.

[0203] The source node forwards the first message to at least one intermediate node (e.g., node B, node C) in the target key distribution path. At least one intermediate node receives the first message sent by the source node. The intermediate node parses the first message to obtain the service key and target type; based on the service key and target type, it generates a second message corresponding to the service key; and forwards the second message to the destination node in the target key distribution path.

[0204] Step 702: Parse the second message to obtain the service key.

[0205] Specifically, the destination node parses the second message to obtain the service key. Simultaneously, the destination node stores a table recording the association between the slice identifier or application identifier and the reserved resources for the node's quantum key, so that the service key can be used for decryption when subsequently receiving service data corresponding to the slice identifier or application identifier.

[0206] The present invention provides a service key distribution method in which a destination node receives a second message sent by at least one intermediate node. The second message is generated based on a service key and a target type obtained by parsing a first message forwarded by a source node from the at least one intermediate node. The first message is generated by the source node based on a path policy, which is sent to the source node by a quantum key distribution controller. This path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type indicates whether encryption / decryption operations and forwarding behavior are performed at the target node. The second message is parsed to obtain the service key. By forwarding the message through the source node and at least one intermediate node, the service key is distributed, thereby improving the security of the service key distribution.

[0207] Optionally, the specific implementation of step 702 above includes: The segment identifier in the segment routing header of the second message is parsed to obtain the target type; the second ciphertext is determined based on the payload in the segment routing header of the second message; and the second ciphertext is decrypted based on the target type to obtain the service key.

[0208] Specifically, the destination node parses the segment identifier in the segment routing header of the second message to obtain the target type; reads the payload in the segment routing header of the second message to determine the second ciphertext; and based on the target type, decrypts the second ciphertext using the node quantum key (e.g., Kbc) corresponding to at least one intermediate node (e.g., node C) to obtain the service key (K1). The decryption operation can employ XOR decryption or symmetric decryption.

[0209] Optionally, the method further includes: The slice identifier or application identifier of the destination node is parsed, and the reserved resources of the node quantum key of the destination node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key.

[0210] Specifically, the destination node can parse the slice identifier or application identifier of the destination node, and query the reserved resources of the node quantum key of the destination node through the association table between the slice identifier or application identifier and the reserved resources of the node quantum key.

[0211] Optionally, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0212] Optionally, the method further includes: The second ciphertext fragments are transmitted in multiple batches as multiple messages. At the same time, the sequence number of each second ciphertext fragment is quantum encrypted and stored in the payload of the multiple messages along with the corresponding second ciphertext fragment. The second ciphertext fragments are then combined.

[0213] Specifically, since the decryption and encryption of the business key at intermediate nodes pose a risk of plaintext exposure, multiple ciphertext fragments can be transmitted in batches as multiple messages. Simultaneously, the sequence number of each ciphertext fragment is quantum encrypted and placed along with the corresponding ciphertext fragment in the payload of the corresponding message. The encrypted sequence number is placed in a specific field within the payload, such as the beginning or end. The ciphertext fragments are then combined at the destination node (tail node).

[0214] Figure 8 This is a schematic diagram illustrating the interaction between the quantum key distribution controller, source node, at least one intermediate node, and destination node provided in this application, as shown below. Figure 8 As shown, it includes steps 801-810.

[0215] Step 801: The quantum key distribution controller acquires the attribute information related to business key distribution for each node in the quantum communication network.

[0216] Step 802: The quantum key distribution controller determines the target key distribution path based on the attribute information of each node and the business security level requirements.

[0217] Step 803: The quantum key distribution controller generates a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations are performed at the target node and whether forwarding behavior is performed.

[0218] Step 804: The quantum key distribution controller sends the path policy to the source node in the target key distribution path.

[0219] Step 805: The source node generates the first message corresponding to the business key based on the path policy.

[0220] Step 806: The source node forwards the first message to at least one intermediate node in the target key distribution path.

[0221] Step 807: At least one intermediate node parses the first message to obtain the service key and target type.

[0222] Step 808: At least one intermediate node generates a second message corresponding to the business key based on the business key and the target type.

[0223] Step 809: The intermediate node forwards the second message to the destination node in the target key distribution path.

[0224] Step 810: The destination node parses the second message to obtain the service key.

[0225] Figure 9 This is a schematic diagram of the business key distribution framework provided in this application, as shown below. Figure 9 As shown, it includes a QKD management system, a QKD controller, a router, a source node A, an intermediate node B, an intermediate node C, and a destination node D.

[0226] The QKD management system issues service security level requirements to the QKD controller. Based on these requirements, the QKD controller determines which service key distribution task needs to be performed. The quantum communication system includes multiple communication links, each with multiple nodes. QKD information is flooded, and each node uses an Interior Gateway Protocol (IGP).

[0227] Each node uses the IGP protocol to collect link path status information, which includes bandwidth information, flow engineering metrics (TE Metric), affinity attributes, and attributes related to quantum key distribution. Among these attributes, the attribute information includes whether quantum security is supported and the overall quantum security performance level. The overall quantum security performance level is divided into high, medium, and low levels. Whether quantum security is supported is determined by internal or external QKD boards. The overall quantum security performance level is determined based on at least one of the following: the node's remaining quantum key quantity, the node's quantum key generation rate, the node's quantum key exchange rate, the node's quantum key storage resources, and the quantum channel bandwidth.

[0228] Each node can report attribute information related to business key distribution to the quantum key distribution controller. Alternatively, the quantum key distribution controller can periodically collect attribute information collected by each node in the quantum layer using the IGP protocol, thereby obtaining the attribute information related to business key distribution of each node in the quantum communication network.

[0229] The quantum key distribution controller can also combine the SRv6 path status with the remaining quantum key quantity and storage resources of each node to perform comprehensive calculations on security and network connection status, and eliminate nodes with a remaining quantum key quantity below a preset threshold, thereby eliminating the corresponding link.

[0230] Based on the attribute information of each node and the business security level requirements, the quantum key distribution controller can determine the target key distribution path. The target key path refers to an SRv6 path that meets the requirements of business security level, reserved quantum key resources, and Service Level Agreement (SLA). For example, the target key distribution path is ABCD.

[0231] The quantum key distribution controller can generate a path policy (i.e., SRv6 Policy) based on the target key distribution path and the target type corresponding to each target node in the target key distribution path.

[0232] The quantum key distribution controller sends the generated path policy to the source node in the target key distribution path, which is node A.

[0233] The quantum key distribution controller can also configure a table relating slice identifiers or application identifiers to reserved resources for node quantum keys and distribute it to each node.

[0234] Node A parses the slice identifier or application identifier of the source node, and queries the reserved resources of the node quantum key of the source node through the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. It parses the path strategy to obtain the target type. Based on the target type, it uses the node quantum key (e.g., Kab) corresponding to the source node (Node A) to encrypt the business key (K1) to obtain the first ciphertext. The encryption operation adopts XOR encryption, i.e., K1⊕Kab. The first ciphertext is used as or placed in the payload of the first message (SRv6 message) to obtain the first message corresponding to the business key. The first message is then forwarded to the intermediate node, which is Node B.

[0235] Node B uses the HMAC mechanism to verify the first message. If the verification is successful, it parses the segment identifier in the segment routing header of the first message to obtain the target type. Based on the payload in the segment routing header of the first message, it determines the first ciphertext and decrypts it using the quantum key (e.g., Kab) corresponding to the source node (e.g., Node A) to obtain the service key (K1). The decryption operation can use XOR decryption. Based on the target type, Node B uses the node quantum key (e.g., Kbc) corresponding to the intermediate node (Node B) to encrypt the service key (K1) to obtain the second ciphertext. The encryption operation can use XOR encryption, i.e., K1⊕Kbc. The second ciphertext is used as or placed in the payload of the second message to obtain the second message corresponding to the service key. The second message is then forwarded to the intermediate node, which is Node C.

[0236] Node C uses the HMAC mechanism to verify the second message. If the verification is successful, it parses the segment identifier in the segment routing header of the second message to obtain the target type. Based on the payload in the segment routing header of the second message, it determines the second ciphertext and decrypts it using the quantum key (e.g., Kbc) corresponding to the intermediate node (Node B) to obtain the service key (K1). The decryption operation can use XOR decryption. Node C uses the node quantum key (e.g., Kcd) corresponding to the intermediate node (Node C) to encrypt the service key (K1) to obtain a new second ciphertext. The encryption operation can use XOR encryption, i.e., K1⊕Kcd. The new second ciphertext is used as or placed in the payload of a new second message to obtain a new second message corresponding to the service key. The new second message is then forwarded to the destination node, which is Node D.

[0237] The D node parses the new second message to obtain the service key. Simultaneously, the destination node stores a table relating slice identifiers or application identifiers to the service key, so that the service key can be used for decryption when subsequently receiving service data corresponding to the slice identifier or application identifier.

[0238] This application provides a business key distribution method for scenarios with ultra-high security requirements (such as finance). It proposes an SRv6-based quantum key distribution scheme, enabling quantum-level network security protection even across IP bearer networks and enterprise networks. By implementing a trusted relay scheme for business keys using SRv6 technology, multiple point-to-point QKD links are connected to achieve end-to-end key distribution, thereby enabling secure key distribution over long distances.

[0239] The business key distribution apparatus provided in this application is described below. The business key distribution apparatus described below can be referred to in correspondence with the business key distribution method described above.

[0240] Figure 10 This is one of the structural schematic diagrams of the business key distribution device provided in this application, such as... Figure 10 As shown, the business key distribution device 1000, applied to a quantum key distribution controller, includes: an acquisition module 1001, a determination module 1002, a first generation module 1003, and a first forwarding module 1004; wherein, The acquisition module 1001 is used to acquire attribute information related to business key distribution for each node in the quantum communication network; The determining module 1002 is used to determine the target key distribution path based on the attribute information and business security level requirements of each node; The first generation module 1003 is used to generate a path strategy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The first sending module 1004 is used to send the path policy to the source node in the target key distribution path; the source node is used to distribute the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy.

[0241] The service key distribution apparatus provided in this application acquires attribute information related to service key distribution for each node in a quantum communication network; determines a target key distribution path based on the attribute information and service security level requirements of each node; generates a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; and sends the path policy to the source node in the target key distribution path. The source node distributes the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy. By determining the target key distribution path based on the attribute information and service security level requirements of each node, and generating a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the source node in the target key distribution path distributes the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path, thereby achieving service key distribution and improving the security of service key distribution.

[0242] Optionally, the determining module 1002 is specifically used for: Based on the attribute information of each node and the business security level requirements, at least one key distribution path is determined; The target key distribution path is determined based on the priority of each of the at least one key distribution path.

[0243] Optionally, the overall quantum security performance level is determined based on at least one of the following: the remaining amount of node quantum keys, the node quantum key generation rate, the node quantum key exchange rate, the node quantum key storage resources, and the quantum channel bandwidth.

[0244] Optionally, the first generation module 1003 is specifically used for: The path strategy is generated based on the target key distribution path, the reserved resources of the node quantum key of each target node in the target key distribution path, and the target type corresponding to each target node.

[0245] Optionally, the reserved resources are reserved based on slice identifiers or application identifiers, and an association table is established between the slice identifiers or application identifiers and the reserved resources of the node quantum key.

[0246] Optionally, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0247] Optionally, the overall quantum security performance level is determined based on at least one of the following: the remaining amount of node quantum keys, the node quantum key generation rate, the node quantum key exchange rate, the node quantum key storage resources, and the quantum channel bandwidth.

[0248] Optionally, if the intermediate node does not have a built-in or externally connected quantum security device, the path strategy also includes a segment identifier corresponding to the intermediate node that does not have a built-in or externally connected quantum security device. The segment identifier indicates that the intermediate node that does not have a built-in or externally connected quantum security device only forwards the message.

[0249] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0250] Optionally, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0251] Figure 11 This is the second structural schematic diagram of the business key distribution device provided in this application, as shown below. Figure 11 As shown, the service key distribution device 1100, applied to the source node, includes: a first receiving module 1101, a second generating module 1102, and a second forwarding module 1103; wherein, The first receiving module 1101 is used to receive a path strategy sent by the quantum key distribution controller; the path strategy is generated based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; The second generation module 1102 is used to generate a first message corresponding to the business key based on the path strategy; The second forwarding module 1103 is used to forward the first message to at least one intermediate node in the target key distribution path; the at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message.

[0252] The service key distribution apparatus provided in this application receives a path strategy sent by a quantum key distribution controller. The path strategy is generated based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. Based on the path strategy, a first message corresponding to the service key is generated. The first message is forwarded to at least one intermediate node in the target key distribution path. The at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message. By receiving a path strategy sent by the quantum key distribution controller, where the path strategy is determined by the quantum key distribution controller based on the attribute information of each node and the business security level requirements, the source node can generate a first message corresponding to the business key based on the path strategy. Then, based on the first message, the business key is distributed to the destination node in the target key distribution path, thereby realizing the distribution of the business key and improving the security of the business key distribution.

[0253] Optionally, the second generation module 1102 is specifically used for: The slice identifier or application identifier of the source node is parsed, and the reserved resources of the node quantum key of the source node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. The path strategy is parsed to obtain the target type; Based on the target type, the business key is encrypted using the node quantum key corresponding to the reserved resource to obtain the first ciphertext; Based on the first ciphertext, the first message corresponding to the business key is generated.

[0254] Optionally, the second generation module 1102 is further configured to: The first ciphertext is used as or placed in the payload of the first message to obtain the first message corresponding to the service key.

[0255] Optionally, the business key distribution device 1100 further includes: The first transmission module is used to transmit multiple first ciphertext fragments of the first ciphertext in multiple batches, and simultaneously store the sequence number of each first ciphertext fragment after quantum encryption and the corresponding first ciphertext fragment in the payload of each first message.

[0256] Optionally, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0257] Optionally, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0258] Optionally, the overall quantum security performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

[0259] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0260] Optionally, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0261] Figure 12 This is the third structural schematic diagram of the business key distribution device provided in this application, as shown below. Figure 12 As shown, the service key distribution device 1200, applied to at least one intermediate node, includes: a second receiving module 1201, a first parsing module 1202, a third generating module 1203, and a third forwarding module 1204; wherein, The second receiving module 1201 is configured to receive a second message sent by at least one intermediate node. The second message is generated based on the service key and target type obtained by the at least one intermediate node parsing the first message forwarded by the source node. The first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The first parsing module 1202 is used to parse the first message to obtain the service key and the target type; The third generation module 1203 is used to generate a second message corresponding to the service key based on the service key and the target type; The third forwarding module 1204 is used to forward the second message to the destination node in the target key distribution path.

[0262] The service key distribution apparatus provided in this application receives a second message sent by at least one intermediate node. The second message is generated based on a service key and a target type obtained by parsing a first message forwarded by a source node from the at least one intermediate node. The first message is generated by the source node based on a path policy, which is sent to the source node by a quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The first message is parsed to obtain the service key and the target type. Based on the service key and the target type, a second message corresponding to the service key is generated. The second message is forwarded to the destination node in the target key distribution path. The first message is parsed by at least one intermediate node to obtain the business key and target type; and a second message is generated based on the business key and target type, and the second message is forwarded to the destination node in the target key distribution path to realize the distribution of the business key and improve the security of business key distribution.

[0263] Optionally, the first parsing module 1202 is specifically used for: The segment identifier in the segment routing header of the first message is parsed to obtain the target type; The first ciphertext is determined based on the payload in the segment routing header of the first message; Based on the target type, the first ciphertext is decrypted to obtain the business key.

[0264] Optionally, the third generation module 1203 is specifically used for: The slice identifier or application identifier of the intermediate node is parsed, and the reserved resources of the node quantum key of the intermediate node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. Based on the target type and the reserved resources, the business key is encrypted using the node quantum key reserved by the intermediate node to obtain the second ciphertext; Based on the second ciphertext, the second message corresponding to the business key is generated.

[0265] Optionally, the third generation module 1203 is further configured to: The second ciphertext is used as or placed in the payload of the second message to obtain the second message corresponding to the service key.

[0266] Optionally, the business key distribution device 1200 further includes: The second transmission module is used to transmit multiple second ciphertext segments of the second ciphertext in multiple batches, and simultaneously to store the sequence number of each second ciphertext segment after quantum encryption and the corresponding second ciphertext segment in the payload of each message.

[0267] Optionally, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0268] Optionally, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0269] Optionally, the overall quantum security performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

[0270] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0271] Optionally, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0272] Figure 13 This is the fourth structural schematic diagram of the business key distribution device provided by the present invention, as shown below. Figure 13 As shown, the service key distribution device 1300, applied to the destination node, includes: a third receiving module 1301 and a second parsing module 1302; wherein, The third receiving module 1301 is used to receive a second message sent by at least one intermediate node; the second message is generated based on the service key and target type obtained by the at least one intermediate node parsing the first message forwarded by the source node, the first message is generated by the source node based on a path policy, the path policy is sent to the source node by the quantum key distribution controller, the path policy is generated by the quantum key distribution controller based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; The second parsing module 1302 is used to parse the second message to obtain the service key.

[0273] The present invention provides a service key distribution device that receives a second message sent by at least one intermediate node at a destination node. The second message is generated based on a service key and target type obtained by parsing a first message forwarded by a source node from the at least one intermediate node. The first message is generated by the source node based on a path policy, which is sent to the source node by a quantum key distribution controller. This path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type indicates whether encryption / decryption operations and forwarding behavior are performed at the target node. The second message is parsed to obtain the service key. By forwarding the message through the source node and at least one intermediate node, the service key is distributed, improving the security of the service key distribution.

[0274] Optionally, the second parsing module 1302 is specifically used for: The segment identifier in the segment routing header of the second message is parsed to obtain the target type; The second ciphertext is determined based on the payload in the segment routing header of the second message; Based on the target type, the second ciphertext is decrypted to obtain the business key.

[0275] Optionally, the service key distribution device 1300 further includes: The third transmission module is used to transmit multiple second ciphertext fragments of the second ciphertext in multiple batches of messages, and at the same time, it stores the sequence number of each second ciphertext fragment after quantum encryption and the corresponding second ciphertext fragment in the payload of multiple messages. The combination module is used to combine the various second ciphertext fragments.

[0276] Optionally, the association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

[0277] Optionally, the attribute information includes whether quantum security is supported and the overall performance level of quantum security.

[0278] Optionally, the overall quantum security performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

[0279] Optionally, the update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

[0280] Optionally, the target type is the function type corresponding to the segment identifier in the segment routing header of the message.

[0281] Figure 14 This is a schematic diagram of the physical structure of an electronic device provided in this application, such as... Figure 14 As shown, the electronic device 1400 may include: a processor 1410, a communications interface 1420, a memory 1430, and a communications bus 1440, wherein the processor 1410, the communications interface 1420, and the memory 1430 communicate with each other through the communications bus 1440. When the electronic device 1400 is a quantum key distribution controller, the processor 1410 can call logical instructions in the memory 1430 to execute a service key distribution method. This method includes: acquiring attribute information related to service key distribution for each node in the quantum communication network; determining a target key distribution path based on the attribute information of each node and service security level requirements; generating a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type indicating whether encryption / decryption operations and forwarding behavior are performed at the target node; sending the path policy to a source node in the target key distribution path; and the source node distributing the service key to a destination node in the target key distribution path through at least one intermediate node based on the path policy.

[0282] Optionally, when the electronic device 1400 is the source node, the processor 1410 can call logical instructions in the memory 1430 to execute a service key distribution method. This method includes: receiving a path strategy sent by a quantum key distribution controller; the path strategy is generated based on a target key distribution path and a target type corresponding to each target node in the target key distribution path, the target key distribution path being determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; generating a first message corresponding to the service key based on the path strategy; forwarding the first message to at least one intermediate node in the target key distribution path; the at least one intermediate node is used to forward the service key to a destination node in the target key distribution path based on the first message.

[0283] Optionally, when the electronic device 1200 is an intermediate node, the processor 1210 can call logical instructions in the memory 1230 to execute a service key distribution method. This method includes: receiving a first message corresponding to a service key forwarded by a source node; the first message being generated by the source node based on a path policy, which is sent to the source node by a quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and a target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; parsing the first message to obtain the service key and the target type; generating a second message corresponding to the service key based on the service key and the target type; and forwarding the second message to a destination node in the target key distribution path.

[0284] Furthermore, the logical instructions in the aforementioned memory 1230 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0285] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the business key distribution method provided by the above methods. The method includes: acquiring attribute information related to business key distribution for each node in a quantum communication network; determining a target key distribution path based on the attribute information and business security level requirements of each node; generating a path policy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; sending the path policy to a source node in the target key distribution path; and the source node is used to distribute the business key to a destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy.

[0286] Optionally, when the computer program is executed by the processor, the computer can execute the business key distribution method provided by the above methods, the method comprising: receiving a path policy sent by a quantum key distribution controller; the path policy being generated based on a target key distribution path and a target type corresponding to each target node in the target key distribution path, the target key distribution path being determined based on the attribute information and business security level requirements of each node in the quantum communication network; the target type being used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; generating a first message corresponding to the business key based on the path policy; forwarding the first message to at least one intermediate node in the target key distribution path; the at least one intermediate node being used to forward the business key to a destination node in the target key distribution path based on the first message.

[0287] Optionally, when the computer program is executed by the processor, the computer can execute the business key distribution method provided by the above methods. This method includes: receiving a first message corresponding to a business key forwarded by a source node; the first message being generated by the source node based on a path policy, the path policy being sent to the source node by a quantum key distribution controller, the path policy being generated by the quantum key distribution controller based on a target key distribution path and a target type corresponding to each target node in the target key distribution path, the target key distribution path being determined based on the attribute information and business security level requirements of each node in the quantum communication network; the target type being used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; parsing the first message to obtain the business key and the target type; generating a second message corresponding to the business key based on the business key and the target type; and forwarding the second message to a destination node in the target key distribution path.

[0288] In another aspect, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a service key distribution method provided by the methods described above. This method includes: acquiring attribute information related to service key distribution for each node in a quantum communication network; determining a target key distribution path based on the attribute information of each node and service security level requirements; generating a path policy based on the target key distribution path and a target type corresponding to each target node in the target key distribution path; the target type indicating whether encryption / decryption operations and forwarding operations are performed at the target node; sending the path policy to a source node in the target key distribution path; and the source node distributing the service key to a destination node in the target key distribution path through at least one intermediate node based on the path policy.

[0289] Optionally, when executed by a processor, the computer program implements a service key distribution method provided by the above methods, the method comprising: receiving a path policy sent by a quantum key distribution controller; the path policy being generated based on a target key distribution path and a target type corresponding to each target node in the target key distribution path, the target key distribution path being determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type being used to indicate whether encryption / decryption operations and forwarding operations are performed at the target node; generating a first message corresponding to a service key based on the path policy; forwarding the first message to at least one intermediate node in the target key distribution path; the at least one intermediate node being used to forward the service key to a destination node in the target key distribution path based on the first message.

[0290] Optionally, when executed by a processor, the computer program implements the service key distribution method provided by the above methods, the method comprising: receiving a first message corresponding to a service key forwarded by a source node; the first message being generated by the source node based on a path policy, the path policy being sent to the source node by a quantum key distribution controller, the path policy being generated by the quantum key distribution controller based on a target key distribution path and a target type corresponding to each target node in the target key distribution path, the target key distribution path being determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type being used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; parsing the first message to obtain the service key and the target type; generating a second message corresponding to the service key based on the service key and the target type; and forwarding the second message to a destination node in the target key distribution path.

[0291] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0292] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0293] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A business key distribution method, characterized in that, Applications in quantum key distribution controllers include: Obtain attribute information related to business key distribution for each node in the quantum communication network; Based on the attribute information and business security level requirements of each node, the target key distribution path is determined; A path policy is generated based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The path policy is sent to the source node in the target key distribution path; the source node is used to distribute the business key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy.

2. The business key distribution method according to claim 1, characterized in that, The determination of the target key distribution path based on the attribute information and business security level requirements of each node includes: Based on the attribute information of each node and the business security level requirements, at least one key distribution path is determined; The target key distribution path is determined based on the priority of each of the at least one key distribution path.

3. The business key distribution method according to claim 1, characterized in that, The step of generating a path strategy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path includes: The path strategy is generated based on the target key distribution path, the reserved resources of the node quantum key of each target node in the target key distribution path, and the target type corresponding to each target node.

4. The business key distribution method according to claim 3, characterized in that, The reserved resources are reserved based on slice identifiers or application identifiers, and an association table is established between the slice identifiers or application identifiers and the reserved resources of the node quantum key.

5. The business key distribution method according to claim 1, characterized in that, The attribute information includes whether quantum security is supported and the overall performance level of quantum security.

6. The business key distribution method according to claim 5, characterized in that, The overall quantum security performance level is determined based on at least one of the following: the remaining amount of node quantum keys, the node quantum key generation rate, the node quantum key exchange rate, the node quantum key storage resources, and the quantum channel bandwidth.

7. The business key distribution method according to claim 1, characterized in that, In the case where the intermediate node does not have a built-in or externally connected quantum security device, the path strategy also includes a segment identifier corresponding to the intermediate node that does not have a built-in or externally connected quantum security device. The segment identifier indicates that the intermediate node that does not have a built-in or externally connected quantum security device only forwards the message.

8. The business key distribution method according to claim 3, characterized in that, The update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

9. The business key distribution method according to any one of claims 1 to 8, characterized in that, The target type is the function type corresponding to the segment identifier in the segment routing header of the message.

10. A business key distribution method, characterized in that, Applied to the source node, including: The system receives a path policy sent by a quantum key distribution controller. The path policy is generated based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. Based on the path strategy, generate the first message corresponding to the business key; The first message is forwarded to at least one intermediate node in the target key distribution path; the at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message.

11. The business key distribution method according to claim 10, characterized in that, The step of generating the first message corresponding to the business key based on the path strategy includes: The slice identifier or application identifier of the source node is parsed, and the reserved resources of the node quantum key of the source node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. The target type is obtained by parsing the path strategy; Based on the target type, the business key is encrypted using the node quantum key corresponding to the reserved resource to obtain the first ciphertext; Based on the first ciphertext, the first message corresponding to the business key is generated.

12. The business key distribution method according to claim 11, characterized in that, The step of generating the first message corresponding to the business key based on the first ciphertext includes: The first ciphertext is used as or placed in the payload of the first message to obtain the first message corresponding to the service key.

13. The business key distribution method according to claim 11, characterized in that, The method further includes: Multiple ciphertext fragments of the first ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each ciphertext fragment is quantum encrypted and stored in the payload of the multiple messages along with the corresponding ciphertext fragment.

14. The business key distribution method according to claim 11, characterized in that, The association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

15. The business key distribution method according to claim 10, characterized in that, The attribute information includes whether quantum security is supported and the overall performance level of quantum security.

16. The business key distribution method according to claim 15, characterized in that, The overall quantum security performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

17. The business key distribution method according to claim 11, characterized in that, The update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

18. The business key distribution method according to any one of claims 10 to 17, characterized in that, The target type is the function type corresponding to the segment identifier in the segment routing header of the message.

19. A business key distribution method, characterized in that, Applied to at least one intermediate node, including: The system receives a first message corresponding to the service key forwarded by the source node. This first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The first message is parsed to obtain the service key and the target type; Based on the service key and the target type, generate a second message corresponding to the service key; The second message is forwarded to the destination node in the target key distribution path.

20. The business key distribution method according to claim 19, characterized in that, The step of parsing the first message to obtain the service key and the target type includes: The segment identifier in the segment routing header of the first message is parsed to obtain the target type; The first ciphertext is determined based on the payload in the segment routing header of the first message; Based on the target type, the first ciphertext is decrypted to obtain the business key.

21. The business key distribution method according to claim 19, characterized in that, The step of generating a second message corresponding to the service key based on the service key and the target type includes: The slice identifier or application identifier of the intermediate node is parsed, and the reserved resources of the node quantum key of the intermediate node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key. Based on the target type and the reserved resources, the business key is encrypted using the node quantum key reserved by the intermediate node to obtain the second ciphertext; Based on the second ciphertext, the second message corresponding to the business key is generated.

22. The business key distribution method according to claim 21, characterized in that, The step of generating the second message corresponding to the business key based on the second ciphertext includes: The second ciphertext is used as or placed in the payload of the second message to obtain the second message corresponding to the service key.

23. The business key distribution method according to claim 21, characterized in that, The method further includes: Multiple ciphertext fragments of the second ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each second ciphertext fragment is quantum encrypted and stored in the payload of multiple messages along with the corresponding second ciphertext fragment.

24. The business key distribution method according to claim 21, characterized in that, The association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

25. The business key distribution method according to claim 19, characterized in that, The attribute information includes whether quantum security is supported and the overall performance level of quantum security.

26. The business key distribution method according to claim 25, characterized in that, The overall quantum security performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

27. The business key distribution method according to claim 21, characterized in that, The update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

28. The business key distribution method according to any one of claims 19 to 27, characterized in that, The target type is the function type corresponding to the segment identifier in the segment routing header of the message.

29. A business key distribution method, characterized in that, Applied to the destination node, including: The system receives a second message sent by at least one intermediate node. The second message is generated based on the service key and target type obtained by the at least one intermediate node parsing the first message forwarded by the source node. The first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The second message is parsed to obtain the service key.

30. The business key distribution method according to claim 29, characterized in that, The step of parsing the second message to obtain the service key includes: The segment identifier in the segment routing header of the second message is parsed to obtain the target type; The second ciphertext is determined based on the payload in the segment routing header of the second message; Based on the target type, the second ciphertext is decrypted to obtain the business key.

31. The business key distribution method according to claim 29, characterized in that, The method further includes: The slice identifier or application identifier of the destination node is parsed, and the reserved resources of the node quantum key of the destination node are obtained by querying the association table between the slice identifier or application identifier and the reserved resources of the node quantum key.

32. The business key distribution method according to claim 30, characterized in that, The method further includes: Multiple ciphertext fragments of the second ciphertext are transmitted in batches as multiple messages. At the same time, the sequence number of each ciphertext fragment is quantum encrypted and stored in the payload of multiple messages along with the corresponding ciphertext fragment. Combine each of the second ciphertext fragments.

33. The business key distribution method according to claim 31, characterized in that, The association table is configured and issued by the quantum key distribution controller or configured by each target node in the target key distribution path.

34. The business key distribution method according to claim 29, characterized in that, The attribute information includes whether quantum security is supported and the overall performance level of quantum security.

35. The business key distribution method according to claim 34, characterized in that, The overall quantum security performance level is determined based on at least one of the following: remaining quantum key quantity, quantum key generation rate, quantum key exchange rate, quantum key storage resources, and quantum channel bandwidth.

36. The business key distribution method according to claim 31, characterized in that, The update cycle of the node quantum key is configured based on the security requirements of the service and the amount of communication data.

37. The business key distribution method according to claim 29, characterized in that, The target type is the function type corresponding to the segment identifier in the segment routing header of the message.

38. A business key distribution device, characterized in that, Applications in quantum key distribution controllers include: The acquisition module is used to acquire attribute information related to business key distribution for each node in the quantum communication network; The determination module is used to determine the target key distribution path based on the attribute information and business security level requirements of each node; The first generation module is used to generate a path strategy based on the target key distribution path and the target type corresponding to each target node in the target key distribution path; the target type is used to indicate whether encryption / decryption operations are performed and whether forwarding behavior is performed at the target node. The first forwarding module is used to send the path policy to the source node in the target key distribution path; the source node is used to distribute the service key to the destination node in the target key distribution path through at least one intermediate node in the target key distribution path based on the path policy.

39. A business key distribution device, characterized in that, Applied to the source node, including: The first receiving module is used to receive a path strategy sent by the quantum key distribution controller; the path strategy is generated based on the target key distribution path and the target type corresponding to each target node in the target key distribution path, the target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node; The second generation module is used to generate a first message corresponding to the business key based on the path strategy. The second forwarding module is used to forward the first message to at least one intermediate node in the target key distribution path; the at least one intermediate node is used to forward the service key to the destination node in the target key distribution path based on the first message.

40. A business key distribution device, characterized in that, Applied to at least one intermediate node, including: The second receiving module is used to receive a first message corresponding to the service key forwarded by the source node; the first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network; the target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The first parsing module is used to parse the first message to obtain the service key and the target type; The third generation module is used to generate a second message corresponding to the business key based on the business key and the target type; The third forwarding module is used to forward the second message to the destination node in the target key distribution path.

41. A business key distribution device, characterized in that, Applied to the destination node, including: The third receiving module is used to receive a second message sent by at least one intermediate node. The second message is generated based on the service key and target type obtained by the at least one intermediate node parsing the first message forwarded by the source node. The first message is generated by the source node based on a path policy, which is sent to the source node by the quantum key distribution controller. The path policy is generated by the quantum key distribution controller based on a target key distribution path and the target type corresponding to each target node in the target key distribution path. The target key distribution path is determined based on the attribute information and service security level requirements of each node in the quantum communication network. The target type is used to indicate whether encryption / decryption operations and forwarding behavior are performed at the target node. The second parsing module is used to parse the second message to obtain the service key.

42. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the business key distribution method as described in any one of claims 1 to 37.

43. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the business key distribution method as described in any one of claims 1 to 37.

44. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the business key distribution method as described in any one of claims 1 to 37.

Images