Key synchronization method and device, central management equipment and storage medium

Abstract

The invention discloses a key synchronization method and device, central management equipment and a storage medium. The invention relates to the technical field of quantum communication. The method comprises the following steps: recording QKD key consumption of each pair of nodes in a historical period; predicting the QKD key consumption of each pair of nodes in the next period according to the QKD key consumption of each pair of nodes in the historical period to obtain a predicted value of the QKD key consumption of each pair of nodes in the next period; and for each pair of nodes, if the variation of the key consumption of the pair of nodes is greater than a preset value, optimizing a QKD key negotiation strategy of the pair of nodes based on the predicted value, and issuing the optimized QKD key negotiation strategy to the corresponding node, so that the corresponding node performs key synchronization in the next period according to the optimized QKD key negotiation strategy. According to the method, the QKD key negotiation strategy is optimized, and a proper number of QKD keys are generated by using the optimized QKD key negotiation strategy, so that the generation of a large number of redundant QKD keys can be effectively avoided, and the problem that the key storage cost is too high is solved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of quantum communication technology, and in particular to a key synchronization method, apparatus, central management device and storage medium. Background Technology

[0002] With the continuous advancement of quantum technology, traditional encryption techniques are becoming increasingly insecure, and the importance of quantum encryption is gradually becoming apparent, leading to a rapid increase in demand for quantum encryption. When QKD quantum key management services provide service capabilities across multiple regions nationwide, the deployment scheme employs a multi-regional active-active architecture and a distributed consistency cluster solution.

[0003] In the current QKD multi-node deployment QKD key synchronization solution, QKD key negotiation is carried out point-to-point to realize a fixed QKD key resource pool between two nodes. However, as the number of nodes increases, each node needs to negotiate QKD keys with other nodes to generate a large number of QKD keys, which will generate a large number of redundant QKD keys, resulting in excessively high key storage costs. Summary of the Invention

[0004] This invention provides a key synchronization method, apparatus, central management device, and storage medium to solve the problem that existing key synchronization solutions generate a large number of redundant QKD keys, resulting in excessively high key storage costs.

[0005] According to one aspect of the present invention, a key synchronization method is provided, applied to a central management device, comprising:

[0006] Record the QKD key consumption of each pair of nodes reported by each node within the historical period to obtain the QKD key consumption of each pair of nodes in the historical period.

[0007] Based on the QKD key consumption of each pair of nodes in the historical period, the QKD key consumption of each pair of nodes in the next period is predicted, and the predicted value of the QKD key consumption of each pair of nodes in the next period is obtained.

[0008] For each pair of nodes, if the change in key consumption of a pair of nodes is greater than a preset value, the QKD key negotiation strategy of the pair of nodes is optimized based on the predicted value, and the optimized QKD key negotiation strategy is sent to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

[0009] According to another aspect of the present invention, a key synchronization device is provided, comprising:

[0010] The recording module is used to record the QKD key consumption of each pair of nodes reported by each node within the historical period, so as to obtain the QKD key consumption of each pair of nodes in the historical period.

[0011] The prediction module is used to predict the QKD key consumption of each pair of nodes in the next period based on the QKD key consumption of each pair of nodes in the historical period, and obtain the predicted value of the QKD key consumption of each pair of nodes in the next period.

[0012] The optimization module is used to optimize the QKD key negotiation strategy of a pair of nodes based on the predicted value if the change in the key consumption of a pair of nodes is greater than a preset value. The optimized QKD key negotiation strategy is then distributed to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: at least one processor;

[0014] and a memory communicatively connected to the at least one processor;

[0015] The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the key synchronization method according to any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the key synchronization method according to any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the key synchronization method described in any embodiment of the present invention.

[0018] The technical solution of this invention optimizes the QKD key negotiation strategy and generates an appropriate number of QKD keys using the optimized QKD key negotiation strategy, thereby solving the problem of excessively high key storage costs and effectively avoiding the generation of a large number of redundant QKD keys.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating a key synchronization method provided in Embodiment 1 of the present invention;

[0022] Figure 2 This is a flowchart illustrating a key synchronization method provided in Embodiment 2 of the present invention;

[0023] Figure 3 This is a flowchart illustrating a key synchronization method provided in Embodiment 3 of the present invention;

[0024] Figure 4 This is a flowchart illustrating a key synchronization method provided in Embodiment 4 of the present invention;

[0025] Figure 5 A flowchart illustrating a key synchronization method provided in a specific embodiment of the present invention;

[0026] Figure 6 This is a schematic diagram of a key synchronization device provided in Embodiment 5 of the present invention;

[0027] Figure 7 This is a schematic diagram of the structure of a central management device for a key synchronization method according to an embodiment of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention. It should be understood that the various steps described in the method embodiments of the present invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0029] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] It should be noted that the terms "a" and "a plurality of" used in this invention are illustrative rather than restrictive. Those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0032] The names of the messages or information exchanged between the multiple devices in the embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0033] Example 1

[0034] Figure 1 This is a flowchart illustrating a key synchronization method provided in Embodiment 1 of the present invention. This method is applicable to the deployment of QKD quantum key management services across multiple domains and nodes. The method can be executed by a key synchronization device, which can be implemented by software and / or hardware and is generally integrated into a central management device. In this embodiment, the central management device includes, but is not limited to, a computer device.

[0035] like Figure 1 As shown, a key synchronization method provided in Embodiment 1 of the present invention includes the following steps:

[0036] S110. Record the QKD key consumption of each pair of nodes reported by each node during the historical period to obtain the QKD key consumption of each pair of nodes during the historical period.

[0037] In this context, a node can be understood as an area where the QKD quantum key management service is deployed. When one node initiates QKD key negotiation with another node, these two nodes form a node pair. When a communication terminal of one node in a node pair sends a message to the communication terminal of the other node in the pair, it needs to encrypt the message using a QKD key negotiated in advance through the QKD key negotiation strategy. Upon receiving the encrypted message, the peer node decrypts the encrypted message using the QKD key negotiated in advance through the QKD key negotiation strategy.

[0038] A cycle can be a time period, such as 10 days, 1 month, or 1 week. Historical cycles can include the current cycle and cycles preceding it.

[0039] In this embodiment, a certain number of QKD keys are required when a pair of nodes communicate once. Each node periodically reports the QKD keys consumed when communicating with other nodes' communication terminals in each period to the central management device. The central management device can record the QKD key consumption of each pair of nodes reported by each node in each period to obtain the QKD key consumption of each pair of nodes in historical periods.

[0040] QKD utilizes the properties of quantum mechanics to allow communicating parties to generate a shared, completely random key. Its core advantage is physical security; any eavesdropping will interfere with the quantum state and be detected by both parties. The quantum key is a product of the QKD process. It is not used to encrypt the message itself, but rather serves as the "codebook" in a "one-time codebook" for encrypting and decrypting subsequent communication data.

[0041] S120. Based on the QKD key consumption of each pair of nodes in the historical period, predict the QKD key consumption of each pair of nodes in the next period, and obtain the predicted value of the QKD key consumption of each pair of nodes in the next period.

[0042] In this embodiment, different methods are selected for prediction based on the amount of QKD key consumption in the historical period. The double exponential smoothing method can be used to predict the QKD key consumption of each pair of nodes in the next period, or the double exponential smoothing method can be used to predict the QKD key consumption of each pair of nodes in the next period.

[0043] If the QKD key consumption in the historical period has been changing, for example, the QKD key consumption from the first period to the fifth period in the historical period has been changing, then the double exponential smoothing method can be used to predict the QKD key consumption of each pair of nodes in the next period.

[0044] If the QKD key consumption in the historical period is insufficient, the double exponential smoothing method can be used to predict the QKD key consumption for each pair of nodes in the next period.

[0045] S130. For each pair of nodes, if the change in the key consumption of a pair of nodes is greater than a preset value, then the QKD key negotiation strategy of the pair of nodes is optimized based on the predicted value, and the optimized QKD key negotiation strategy is sent to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

[0046] The process of QKD key negotiation strategy is the same for each pair of nodes. Here, we take a pair of nodes as an example for explanation.

[0047] In this embodiment, if the change between the key consumption of a pair of nodes in the next cycle and the key consumption of the pair of nodes in the current cycle exceeds a preset value, the QKD key negotiation strategy is optimized so that the pair of nodes can negotiate QKD keys in the next cycle using the optimized QKD key negotiation strategy, such that the QKD key consumption is equal to the sum of the predicted value of the QKD key consumption of the pair of nodes in the next cycle and the number of security keys of the pair of nodes.

[0048] The number of security keys for the node pair can be understood as the lower limit of the number of keys in the key resource pool of the node pair. The number of security keys for the node pair is determined based on the predicted value of the QKD key consumption of the node pair in the next period and the volatility of the key consumption of the node pair in the historical period.

[0049] In this embodiment, if the key balance of a node pair in the key resource pool is lower than the threshold, the corresponding communication terminal is triggered to perform key negotiation.

[0050] In this embodiment, if the optimized QKD key negotiation strategy leads to key backlog, the unoptimized QKD key negotiation strategy will continue to be used.

[0051] The key synchronization method provided in Embodiment 1 of this invention first records the QKD key consumption of each pair of nodes reported by each node during a historical period, obtaining the QKD key consumption of each pair of nodes in the historical period; then, based on the QKD key consumption of each pair of nodes in the historical period, the QKD key consumption of each pair of nodes in the next period is predicted, obtaining the predicted value of the QKD key consumption of each pair of nodes in the next period; finally, for each pair of nodes, if the change in the key consumption of a pair of nodes is greater than a preset value, the QKD key negotiation strategy of the pair of nodes is optimized based on the predicted value, and the optimized QKD key negotiation strategy is distributed to the corresponding node so that the corresponding node performs key synchronization in the next period according to the optimized QKD key negotiation strategy. The above method, by optimizing the QKD key negotiation strategy and using the optimized QKD key negotiation strategy to generate an appropriate number of QKD keys, can effectively avoid generating a large number of redundant QKD keys and solve the problem of excessively high key storage costs.

[0052] Example 2

[0053] Figure 2 This is a flowchart illustrating a key synchronization method according to Embodiment 2 of the present invention. Embodiment 2 is an optimization based on the above embodiments. For details not covered in this embodiment, please refer to Embodiment 1.

[0054] like Figure 2 As shown, a key synchronization method provided in Embodiment 2 of the present invention includes the following steps:

[0055] S210. Record the QKD key consumption of each pair of nodes reported by each node during the historical period to obtain the QKD key consumption of each pair of nodes during the historical period.

[0056] S220. If the number of periods included in the historical period is less than the preset value, the weighted average method is used to predict the QKD key consumption of each pair of nodes in the next period, and the predicted value of the QKD key consumption of each pair of nodes in the next period is obtained.

[0057] The preset value can be understood as the number of cycles set in advance. For example, if the historical cycle includes 3 cycles and the preset value is 5, then the number of cycles included in the historical cycle is less than the preset value.

[0058] Specifically, the weighted average method is used to predict the QKD key consumption of each pair of nodes in the next cycle, and the predicted value of the QKD key consumption of each pair of nodes in the next cycle is obtained. This includes: calculating the ratio of the QKD key consumption of each pair of nodes in the historical cycle to the number of cycles included in the historical cycle, and obtaining the predicted value of the QKD key consumption of each pair of nodes in the next cycle.

[0059] S230. If the number of periods included in the historical period is greater than or equal to the preset value, the double exponential smoothing method is used to predict the QKD key consumption of each pair of nodes in the next period, and the predicted value of the QKD key consumption of each pair of nodes in the next period is obtained.

[0060] The execution of steps S220 and S230 is not in any particular order; they are executed according to the conditions that are met.

[0061] Specifically, the weighted average method is used to predict the QKD key consumption of each node pair in the next period, and the predicted value of the QKD key consumption of each node pair in the next period is obtained. This includes: for each node pair, calculating the product of the number of prediction periods and the key consumption trend value to obtain a first value; calculating the sum of the first value and the key consumption benchmark value to obtain a second value; and using the second value as the predicted value of the QKD key consumption of the node pair in the next period.

[0062] Among them, the key consumption trend value reflects the historical periodic key consumption trend of a pair of nodes, and the key consumption baseline value reflects the current key consumption baseline value of a pair of nodes. The corresponding formula for the weighted average method is as follows:

[0063]

[0064]

[0065]

[0066] In the above formula, This represents the key consumption of a pair of nodes in the t-th time window of a historical period. Represents the smoothing coefficient. This represents the baseline key consumption value for a pair of nodes in the t-th time window of a historical period. , This represents the key consumption trend value of a pair of nodes in the t-th time window of a historical period. , This represents the predicted key consumption of a pair of nodes over the next k periods. The predicted QKD key consumption for a pair of nodes in the next period is calculated with k taking the value 1.

[0067] For example, if a cycle consists of 30 days, then a time window is 1 day.

[0068] S240. For each pair of nodes, if the change in the key consumption of a pair of nodes is greater than a preset value, then the QKD key negotiation strategy of the pair of nodes is optimized based on the predicted value, and the optimized QKD key negotiation strategy is sent to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

[0069] Embodiment 2 of this invention provides a key synchronization method that specifies the implementation of predicting the QKD key consumption of each pair of nodes in the next cycle. This method adaptively selects either a weighted average method or a double exponential smoothing method to predict the QKD key consumption of each pair of nodes in the next cycle based on the key consumption of each pair of nodes in historical cycles, effectively improving prediction accuracy.

[0070] Example 3

[0071] Figure 3 This is a flowchart illustrating a key synchronization method according to Embodiment 3 of the present invention. Embodiment 3 is an optimization based on the above embodiments. For details not covered in this embodiment, please refer to Embodiment 1 or Embodiment 2.

[0072] like Figure 3 As shown, a key synchronization method provided in Embodiment 3 of the present invention includes the following steps:

[0073] S310. Record the QKD key consumption of each pair of nodes reported by each node during the historical period to obtain the QKD key consumption of each pair of nodes during the historical period.

[0074] S320. For a pair of nodes, determine whether the change in the key consumption of the pair of nodes is greater than a preset value.

[0075] Among them, it is determined whether the change in the key consumption of a pair of nodes in the next cycle exceeds a preset value compared with the key consumption of the pair of nodes in the current cycle.

[0076] S330. If so, then based on the predicted value of the QKD key consumption of a pair of nodes in the next period and the volatility of the key consumption of a pair of nodes in the historical period, determine the lower limit of the number of keys in the key resource pool, and use the lower limit as the number of security keys for the pair of nodes.

[0077] Furthermore, based on the predicted QKD key consumption of a pair of nodes in the next cycle and the volatility of key consumption of a pair of nodes in historical cycles, a lower limit for the number of keys in the key resource pool is determined, including:

[0078] In this embodiment, if the change in key consumption of a pair of nodes in the next cycle is less than or equal to a preset value compared to the change in key consumption of the pair of nodes in the current cycle, then the QKD key negotiation strategy will not be optimized.

[0079] S3301. Determine the security factor based on the key consumption volatility of a pair of nodes within the historical period and the average key consumption of a pair of nodes within the historical period.

[0080] The key consumption volatility σ of a pair of nodes within a historical period can be represented by the standard deviation of key consumption of a pair of nodes within that historical period. The formula for calculating the key consumption volatility is as follows:

[0081]

[0082]

[0083] In the above formula, n represents the number of time windows included in the historical period. This represents the average key consumption of a pair of nodes in each time window within a historical period.

[0084] Among them, the safety factor The corresponding calculation formula is as follows:

[0085]

[0086] It should be noted that, The larger, The larger the size, the higher the safety stock ratio; even Extremely small, such as A certain number of keys still need to be retained in the key resource pool to prevent sudden demand.

[0087] S3302. Calculate the product of the security factor and the predicted value of the QKD key consumption of a pair of nodes in the next cycle to obtain the lower limit of the number of keys in the key resource pool.

[0088] The lower limit of the number of keys in the key resource pool is the security inventory of keys in the key resource pool. The formula for calculating the security inventory S is as follows:

[0089]

[0090] S340. Calculate the sum of the predicted QKD key consumption of the pair of nodes in the next cycle and the number of security keys of the pair of nodes to obtain the key consumption of the pair of nodes in the next cycle.

[0091] The formula for calculating the key consumption of a pair of nodes in the next cycle is as follows:

[0092]

[0093] S350. Generate an optimized QKD key negotiation strategy for the pair of nodes based on the key consumption amount for the next cycle of the pair of nodes.

[0094] The number of keys negotiated by the nodes using the optimized QKD key negotiation strategy is the key consumption amount for the next cycle.

[0095] Embodiment 3 of this invention provides a key synchronization method that specifies the process of optimizing a QKD key negotiation strategy. This method uses the predicted QKD key consumption of a pair of nodes in the next cycle and the number of security keys to generate an optimized QKD key negotiation strategy for the pair of nodes, enabling the optimized QKD key negotiation strategy to generate an appropriate number of QKD keys.

[0096] Example 4

[0097] Figure 4 This is a flowchart illustrating a key synchronization method according to Embodiment 4 of the present invention. Embodiment 4 is an optimization based on the above embodiments. For details not covered in this embodiment, please refer to Embodiments 1 to 3.

[0098] like Figure 4 As shown, Embodiment 4 of the present invention provides a key synchronization method, which includes the following steps:

[0099] S410. For a pair of nodes, including a first node and a second node, assign node identifiers to the first node and the second node, and send the generated default QKD key negotiation strategy to the first node.

[0100] In this embodiment, the central management device assigns node identifiers to the first node and the second node, and sends the generated default QKD key negotiation policy to the first node, so that when the first node initiates key negotiation with the second node, the first node negotiates the key with the second node according to the default QKD key negotiation policy to obtain the first QKD key. The first QKD key is written into the key resource pool of the first node and the key resource pool of the second node respectively.

[0101] S420: Receive the information of the first communication terminal reported by the first node and the information of the second communication terminal reported by the second node, and push the information of the first communication terminal and the information of the second communication terminal to all nodes in the network.

[0102] In this embodiment, the central management device receives information about a first communication terminal reported by the first node and information about a second communication terminal reported by the second node, and pushes the information about the first and second communication terminals to all nodes in the network. This allows the first communication terminal to obtain a QKD key from the key resource pool of the first node when communicating with the second communication terminal. The first communication terminal then uses the QKD key to encrypt the message and sends the encrypted message to the second communication terminal. The second communication terminal obtains the QKD key from the key resource pool of the second node to decrypt the encrypted message. The QKD key is either the first QKD key or the second QKD key, and the beginning of the key identifier corresponding to the second QKD key is symmetrical to the beginning of the key identifier corresponding to the first QKD key.

[0103] The central management device serves as the network management center for all nodes of the QKD key management system. Each new node needs to register with the central management device.

[0104] In this embodiment, a node pair consisting of a first node and a second node is used as an example. After the central management device approves the registration information of the first node and the second node (that is, the first node and the second node are successfully registered with the central management device), it assigns node identifier 1 to the first node and node identifier 2 to the second node. It also generates a default QKD key negotiation strategy between the first node and nodes already registered with the central management device (excluding the first node), as well as a default QKD key negotiation strategy between the second node and nodes already registered with the central management device (excluding the second node). For example, if the nodes already registered with the central management device include the first node, the second node, and the third node, then a default QKD key negotiation strategy is generated between the first node and the second node, and between the first node and the third node. Similarly, a default QKD key negotiation strategy is generated between the second node and the first node, and between the second node and the third node. Node ID 1 negotiates keys with corresponding nodes (the second and third nodes) according to the issued QKD key negotiation strategy, and writes the negotiated QKD key into the key resource pools of the first node and the second node. The node ID of the node that initiated the key negotiation is used as the beginning of the key; for example, the key ID corresponding to the key generated by the first and second nodes starts with node ID 1-node ID 2. The first node issues the first communication terminal, and the second node issues the second communication terminal. The first node reports the issued first communication terminal to the central management device in real time. The central management device records the information of the first communication terminal and the node ID 1 of the first node to which the first communication terminal belongs, and pushes the recorded information to all nodes in the network. At the same time, the second node also reports the issued first communication terminal to the central management device in real time. The second communication terminal is recorded by the central management device, which records the information of the second communication terminal and the node identifier 2 of the second node to which the second communication terminal belongs. When the first communication terminal sends a message to the second communication terminal, the first communication terminal first queries the first node for the node identifier (i.e., node identifier 2) of the node to which the second communication terminal belongs, and obtains a QKD key with a key identifier starting with either node identifier 1-node identifier 2 or node identifier 2-node identifier 1 from the key resource pool of the first node. The first communication terminal uses the QKD key with a key identifier starting with either node identifier 1-node identifier 2 or node identifier 2-node identifier 1 as the session key to encrypt the message. After receiving the encrypted message, the second communication terminal obtains the corresponding key from the key resource pool of the second node according to the key identifier to decrypt the encrypted message.

[0105] S430. Record the QKD key consumption of each pair of nodes reported by each node during the historical period to obtain the QKD key consumption of each pair of nodes during the historical period.

[0106] S440. Based on the QKD key consumption of each pair of nodes in the historical period, predict the QKD key consumption of each pair of nodes in the next period, and obtain the predicted value of the QKD key consumption of each pair of nodes in the next period.

[0107] S450. For each pair of nodes, if the change in the key consumption of a pair of nodes is greater than a preset value, then the QKD key negotiation strategy of the pair of nodes is optimized based on the predicted value, and the optimized QKD key negotiation strategy is sent to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

[0108] The key synchronization method provided in Embodiment 4 of this invention, compared to existing technologies where each node has a corresponding key resource pool for the generated QKD key, stores the QKD keys generated by one node and those generated by other nodes within that node's key resource pool. This saves on the number of key resource pools and network resources. Furthermore, this method uses a central management device for unified management, reducing the number of direct interactions between nodes, simplifying network complexity, and improving network stability.

[0109] Based on the technical solutions of the above embodiments, this invention provides a specific implementation method.

[0110] As one specific implementation method of this embodiment. Figure 5 A flowchart illustrating a key synchronization method provided in a specific embodiment of the present invention is shown below. Figure 5 As shown, the process includes the following:

[0111] The Beijing node (i.e., the first node) and the Shanghai node (i.e., the second node) submit registration information to the CM Management Center (i.e., the central management device). The CM Management Center reviews the registration information. If the Beijing node's registration information is approved, a unique identifier (i.e., the node identifier of the first node) QKMS001 is pushed to the Beijing node, and a key negotiation strategy (i.e., the default key negotiation strategy between the first and second nodes) is generated. A unique identifier (i.e., the node identifier of the second node) QKMS002 is pushed to the Shanghai node, and a key negotiation strategy (i.e., the default key negotiation strategy between the second and first nodes) is generated. The Beijing node initiates key negotiation with the Shanghai node, generating a QKD key pair with key identifiers starting with QKMS001-QKMS002 according to the key negotiation strategy (if the Shanghai node initiates key negotiation with the Beijing node, a QKD key pair with key identifiers starting with QKMS002-QKMS001 is generated). The QKD key pairs are stored in the key resource pools of the Beijing node and the Shanghai node, respectively. The Beijing node issues device A (i.e., the first communication device), and submits device A information in real time after issuance. Upon reaching the CM Management Center, the Shanghai node issues Device B (i.e., the second communication device). After issuance, it submits Device B information to the CM Management Center in real time. The CM Management Center pushes the relevant information of Device A to the Shanghai node and the relevant information of Device B to the Beijing node. When Device A sends a message to Device B, it requests a QKD key from the Beijing node. The Beijing node queries the node to which Device B belongs and obtains a QKD key pair starting with QKMS001-QKMS002 or QKMS002-QKMS001 from its key resource pool. It then returns the corresponding QKD key to Terminal A. Terminal A uses the corresponding QKD key to encrypt the message and sends the encrypted message to Terminal B. After receiving the encrypted message, Terminal B obtains a key from the key resource pool of the Shanghai node based on the key identifier and returns the key to Terminal B. Terminal B decrypts the encrypted message using the key pair. The Beijing and Shanghai nodes periodically report key consumption (i.e., key consumption amount) to the CM Management Center. The CM Management Center predicts the key consumption amount for the next cycle and optimizes the current key negotiation strategy, then distributes the optimized key negotiation strategy to the Beijing and Shanghai nodes.

[0112] Example 5

[0113] Figure 6 This is a schematic diagram of a key synchronization device provided in Embodiment 5 of the present invention. The device is applicable to the deployment of QKD quantum key management services across multiple nodes in a cross-domain environment. The device can be implemented by software and / or hardware and is generally integrated into a central management device. In this embodiment, the central management device includes, but is not limited to, computer equipment.

[0114] like Figure 6As shown, the device includes a recording module 110, a prediction module 120, and an optimization module 130.

[0115] The recording module 110 is used to record the QKD key consumption of each pair of nodes reported by each node during the historical period, so as to obtain the QKD key consumption of each pair of nodes during the historical period.

[0116] The prediction module 120 is used to predict the QKD key consumption of each pair of nodes in the next period based on the QKD key consumption of each pair of nodes in the historical period, and obtain the predicted value of the QKD key consumption of each pair of nodes in the next period.

[0117] The optimization module 130 is used to optimize the QKD key negotiation strategy of a pair of nodes based on the predicted value if the change in the key consumption of a pair of nodes is greater than a preset value. The optimized QKD key negotiation strategy is then sent to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

[0118] In this embodiment, the device first records the QKD key consumption of each pair of nodes reported by each node during the historical period through the recording module 110, thus obtaining the QKD key consumption of each pair of nodes in the historical period; then, the prediction module 120 predicts the QKD key consumption of each pair of nodes in the next period based on the QKD key consumption of each pair of nodes in the historical period, thus obtaining the predicted value of the QKD key consumption of each pair of nodes in the next period; finally, the optimization module 130 optimizes the QKD key negotiation strategy of the pair of nodes based on the predicted value if the change in the key consumption of a pair of nodes is greater than a preset value, and distributes the optimized QKD key negotiation strategy to the corresponding node so that the corresponding node performs key synchronization according to the optimized QKD key negotiation strategy in the next period.

[0119] This embodiment provides a key synchronization device that can effectively avoid generating a large number of redundant QKD keys and solve the problem of excessively high key storage costs.

[0120] Furthermore, the prediction module 120 includes:

[0121] The first prediction submodule is used to predict the QKD key consumption of each pair of nodes in the next period after determining that the number of periods included in the historical period is less than a preset value, by using a weighted average method.

[0122] The second prediction submodule is used to determine the QKD key consumption of each pair of nodes in the next period after determining that the number of periods included in the historical period is greater than or equal to a preset value, and then using the double exponential smoothing method to predict the QKD key consumption of each pair of nodes in the next period, so as to obtain the predicted value of the QKD key consumption of each pair of nodes in the next period.

[0123] Based on the above optimizations, the first prediction submodule is specifically used to: calculate the ratio of the QKD key consumption of each pair of nodes in the historical period to the number of periods included in the historical period, and obtain the predicted value of the QKD key consumption of each pair of nodes in the next period.

[0124] The second prediction submodule is specifically used for: for each node pair, calculating the product of the prediction period number and the key consumption trend value to obtain a first value; calculating the sum of the first value and the key consumption baseline value to obtain a second value; and using the second value as the predicted value of the QKD key consumption of the node pair in the next period.

[0125] Furthermore, the optimization module 130 includes:

[0126] The determination submodule is used to determine the lower limit of the number of keys in the key resource pool based on the predicted value of the QKD key consumption of a pair of nodes in the next period and the volatility of the key consumption of a pair of nodes in the historical period, and to use the lower limit as the number of security keys for the pair of nodes.

[0127] The calculation submodule is used to calculate the sum of the predicted value of the QKD key consumption of the pair of nodes in the next cycle and the number of security keys of the pair of nodes, so as to obtain the key consumption of the pair of nodes in the next cycle.

[0128] A generation submodule is used to generate an optimized QKD key negotiation strategy for the pair of nodes based on the key consumption of the pair of nodes in the next cycle.

[0129] Based on the above technical solution, the sub-modules are determined to include:

[0130] The determining unit is used to determine the security factor based on the key consumption volatility of a pair of nodes within the historical period and the average key consumption of a pair of nodes within the historical period.

[0131] The calculation unit is used to calculate the product of the security factor and the predicted value of the QKD key consumption of a pair of nodes in the next cycle, so as to obtain the lower limit value of the number of keys in the key resource pool.

[0132] Furthermore, the device also includes a generation module and a push module. Before obtaining the QKD key consumption of each pair of nodes reported by each node in the current period, the generation module is used to assign node identifiers to a pair of nodes, including a first node and a second node, and to send the generated default QKD key negotiation strategy to the first node. This allows the first node to negotiate a first QKD key with the second node according to the default QKD key negotiation strategy when initiating key negotiation with the second node. The first QKD key is then written into the key resource pool of the first node and the key resource pool of the second node, respectively. The push module is used to receive information from the first communication terminal reported by the first node. The information of the second communication terminal reported by the second node is also shared, and the information of the first communication terminal and the information of the second communication terminal are pushed to all nodes in the network. This is so that when the first communication terminal communicates with the second communication terminal, the first communication terminal obtains a QKD key from the key resource pool of the first node, encrypts the message using the QKD key, and sends the encrypted message to the second communication terminal. The second communication terminal obtains the QKD key from the key resource pool of the second node to decrypt the encrypted message. The QKD key is either the first QKD key or the second QKD key, and the beginning of the key identifier corresponding to the second QKD key is symmetrical to the beginning of the key identifier corresponding to the first QKD key.

[0133] The above-described key synchronization device can execute the key synchronization method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0134] Example 6

[0135] Figure 7 A schematic diagram of a central management device 10, which can be used to implement embodiments of the present invention, is shown. The central management device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0136] like Figure 7As shown, the central management device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer programs stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the central management device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0137] Multiple components in the central management device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, optical disk, etc.; and a communication unit 19, such as a network card, modem, wireless transceiver, etc. The communication unit 19 allows the central management device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0138] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as key synchronization methods.

[0139] In some embodiments, the key synchronization method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the central management device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the key synchronization method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the key synchronization method by any other suitable means (e.g., by means of firmware).

[0140] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0141] In some embodiments, the key synchronization method may be implemented as a computer program, which is implicitly included in a computer program product. When executed by a processor, the computer program implements the key synchronization method of the present invention. The computer program product can be understood as a software product that primarily implements its solution through a computer program. The computer program used to implement the method of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer program causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a standalone software package, or entirely on a remote machine or server.

[0142] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0143] To provide user interaction, the systems and techniques described herein can be implemented on a central management device having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the central management device. Other types of devices can also be used to provide user interaction; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0144] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0145] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0146] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0147] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A key synchronization method, characterized in that, Applied to central management equipment, the method includes: Record the QKD key consumption of each pair of nodes reported by each node within the historical period to obtain the QKD key consumption of each pair of nodes in the historical period. Based on the QKD key consumption of each pair of nodes in the historical period, the QKD key consumption of each pair of nodes in the next period is predicted, and the predicted value of the QKD key consumption of each pair of nodes in the next period is obtained. For each pair of nodes, if the change in key consumption of a pair of nodes is greater than a preset value, the QKD key negotiation strategy of the pair of nodes is optimized based on the predicted value, and the optimized QKD key negotiation strategy is sent to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

2. The method according to claim 1, characterized in that, Based on the QKD key consumption of each pair of nodes in the historical period, the QKD key consumption of each pair of nodes in the next period is predicted, resulting in a predicted value of the QKD key consumption of each pair of nodes in the next period, including: If the number of periods included in the historical period is less than the preset value, the weighted average method is used to predict the QKD key consumption of each pair of nodes in the next period, and the predicted value of the QKD key consumption of each pair of nodes in the next period is obtained. If the number of periods included in the historical period is greater than or equal to the preset value, the double exponential smoothing method is used to predict the QKD key consumption of each pair of nodes in the next period, and the predicted value of the QKD key consumption of each pair of nodes in the next period is obtained.

3. The method according to claim 2, characterized in that, The weighted average method is used to predict the QKD key consumption for each node pair in the next cycle, resulting in the predicted value of the QKD key consumption for each node pair in the next cycle, including: Calculate the ratio of the QKD key consumption of each pair of nodes in the historical period to the number of periods included in the historical period to obtain the predicted value of the QKD key consumption of each pair of nodes in the next period.

4. The method according to claim 2, characterized in that, The weighted average method is used to predict the QKD key consumption for each node pair in the next cycle, resulting in the predicted value of the QKD key consumption for each node pair in the next cycle, including: For each node pair, the first value is obtained by multiplying the number of prediction cycles by the key consumption trend value. The second value is obtained by summing the first value with the key consumption baseline value; The second value is used as the node's predicted QKD key consumption for the next cycle.

5. The method according to claim 1 or 2, characterized in that, Optimizing the QKD key negotiation strategy for the pair of nodes based on the predicted QKD key consumption for the next cycle includes: Based on the predicted QKD key consumption of a pair of nodes in the next cycle and the volatility of key consumption of a pair of nodes in historical cycles, a lower limit value for the number of keys in the key resource pool is determined, and the lower limit value is used as the number of security keys for the pair of nodes. The sum of the predicted QKD key consumption of the pair of nodes in the next cycle and the number of security keys of the pair of nodes is used to obtain the key consumption of the pair of nodes in the next cycle. An optimized QKD key negotiation strategy for the pair of nodes is generated based on the key consumption of the pair of nodes in the next cycle.

6. The method according to claim 5, characterized in that, Based on the predicted QKD key consumption of a pair of nodes in the next cycle and the volatility of key consumption of a pair of nodes in historical cycles, determine the lower limit of the number of keys in the key resource pool, including: The security factor is determined based on the volatility of key consumption of a pair of nodes within the historical period and the average key consumption of a pair of nodes within the historical period. The lower limit of the number of keys in the key resource pool is obtained by multiplying the security factor by the predicted value of the QKD key consumption of a pair of nodes in the next cycle.

7. The method according to claim 1, characterized in that, Before obtaining the QKD key consumption of each pair of nodes in the current period reported by each node, the method further includes: For a pair of nodes, including a first node and a second node, node identifiers are assigned to the first node and the second node, and a generated default QKD key negotiation strategy is distributed to the first node so that when the first node initiates key negotiation with the second node, the first node negotiates with the second node according to the default QKD key negotiation strategy to obtain a first QKD key. The first QKD key is written into the key resource pool of the first node and the key resource pool of the second node respectively. The system receives information about a first communication terminal reported by the first node and information about a second communication terminal reported by the second node, and pushes the information about the first and second communication terminals to all nodes in the network. This ensures that when the first and second communication terminals communicate, the first communication terminal obtains a QKD key from the key resource pool of the first node, encrypts the message using the QKD key, and sends the encrypted message to the second communication terminal. The second communication terminal then obtains the QKD key from the key resource pool of the second node to decrypt the encrypted message. The QKD key is either the first QKD key or the second QKD key, and the beginning of the key identifier corresponding to the second QKD key is symmetrical to the beginning of the key identifier corresponding to the first QKD key.

8. A key synchronization device, characterized in that, The device includes: The recording module is used to record the QKD key consumption of each pair of nodes reported by each node within the historical period, so as to obtain the QKD key consumption of each pair of nodes in the historical period. The prediction module is used to predict the QKD key consumption of each pair of nodes in the next period based on the QKD key consumption of each pair of nodes in the historical period, and obtain the predicted value of the QKD key consumption of each pair of nodes in the next period. The optimization module is used to optimize the QKD key negotiation strategy of a pair of nodes based on the predicted value if the change in the key consumption of a pair of nodes is greater than a preset value. The optimized QKD key negotiation strategy is then distributed to the corresponding node so that the corresponding node can perform key synchronization in the next cycle according to the optimized QKD key negotiation strategy.

9. A central management device, characterized in that, The central management equipment includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform the key synchronization method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the key synchronization method according to any one of claims 1-7.

Images