Quantum key relay method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a quantum key relay method and device, electronic equipment and a readable storage medium, and belongs to the field of quantum communication networks. Comprising the following steps: acquiring a plurality of application tasks, and determining a task queue of the application tasks needing to be subjected to key relaying from the plurality of application tasks; obtaining network information of a quantum network, and determining a quantum key relay path of a target application task based on the network information; and if the determination is successful, sending a key relay instruction to each node in the quantum key relay path, so that a source node in each node generates a shared key and sends the shared key to a destination node through an intermediate node, and sending a key identifier of the shared key to an application program corresponding to the target application task, and the application program carries out encrypted communication based on the key identifier. The key distribution method and device solve the core problems of low key distribution efficiency and resource waste in a traditional scheme.

Description

Technical Field

[0001] This application belongs to the field of quantum communication networks, and specifically relates to a quantum key relay method, device, electronic device and readable storage medium. Background Technology

[0002] With the development of quantum computing technology, quantum key distribution (QKD), as a secure communication method based on quantum mechanics, has attracted widespread attention due to its unconditional security. QKD can guarantee that the two communicating parties generate secure keys that cannot be cracked even by attackers with powerful computing capabilities.

[0003] However, traditional QKD systems have some limitations: 1) Limited key distribution distance: Due to signal attenuation during quantum channel transmission, the key distribution distance of traditional QKD systems is limited, making it difficult to meet the needs of long-distance communication.

[0004] 2) Complex network management: In traditional QKD networks, key management requires manual configuration and maintenance, making network management complex and difficult to expand.

[0005] To address these issues, researchers have proposed quantum key relay (QKR) technology. QKR expands the coverage of QKD networks by introducing trusted relay nodes into the QKD network, breaking down long-distance key distribution into multiple short-distance key distribution processes.

[0006] However, existing QKR solutions still have the following shortcomings: 1) Static routing: Most existing QKR schemes use static routing strategies, which leads to low key distribution efficiency.

[0007] 2) Low resource utilization: The existing QKR solution has low network resource utilization, resulting in some network resources not being fully utilized and causing resource waste. Summary of the Invention

[0008] In view of the above problems, embodiments of this application are proposed to provide a quantum key relay method, a quantum key relay device, an electronic device, and a readable storage medium that overcome or at least partially solve the above problems.

[0009] To solve the above-mentioned technical problems, this application is implemented as follows: In a first aspect, embodiments of this application provide a quantum key relay method, the method comprising: Obtain multiple application tasks, and determine the task queue of application tasks that need key relay from the multiple application tasks; Obtain the network information of the quantum network, and determine the quantum key relay path of the target application task based on the network information; the target application task is the application task with the highest priority in the task queue. If successful, a key relay instruction is sent to each node in the quantum key relay path, so that the source node in each node generates a shared key and sends it to the destination node through the intermediate node. In addition, the key identifier of the shared key is sent to the application corresponding to the target application task, so that the application performs encrypted communication based on the key identifier.

[0010] In one or more embodiments, determining the task queue of application tasks requiring key relay from a plurality of application tasks includes: From the applications corresponding to each application task, determine the candidate applications with quantum key application permissions, and the candidate application tasks corresponding to each candidate application. Identify the application tasks that require key relay from among the candidate application tasks; The application tasks that require key relay are sorted according to their priority to obtain a task queue.

[0011] In one or more embodiments, the application task includes a source node and a destination node; determining the application task requiring key relay from among the candidate application tasks includes: Determine whether the source node and destination node in each candidate application task are directly connected; Among the candidate application tasks, those whose source and destination nodes are not directly connected are designated as target application tasks.

[0012] In one or more embodiments, obtaining the network information of the quantum network includes: Obtain the key generation rate and the key pool size in the quantum network; Obtain the topology graph of the quantum network, and use the topology graph to generate the current undirected graph.

[0013] In one or more embodiments, determining the quantum key relay path for the target application task based on the network information includes: S1. Determine the highest priority target application task from the task queue, and initialize k=1; S2. Determine the current candidate path using the current undirected graph of the quantum network; S3. Can the current candidate path perform key relay? If yes, proceed to S4; if no, proceed to S5. S4. Use the current candidate path as a quantum key relay path; S5. Does k exceed the threshold? If yes, proceed to S6; otherwise, proceed to S7. S6. Block the target application task; S7. Update the current undirected graph to obtain the updated undirected graph; S8. Based on the updated undirected graph, determine the updated candidate path, take the updated undirected graph as the current undirected graph, and take the updated candidate path as the current candidate path, execute S2, and k=k+1.

[0014] In one or more embodiments, determining the current candidate path using the current undirected graph of the quantum network includes: Initialize the candidate path set; Determine the source node and destination node from the target application task; The shortest path between the source node and the destination node is calculated using a breadth-first search algorithm and the current undirected graph, and the shortest path is stored in the candidate path set.

[0015] In one or more embodiments, verifying whether the current candidate path can perform key relay includes: S31. Traverse each link in the current candidate path and determine the link task corresponding to each link; S32. For any target link in each link, sort the link tasks assigned to the target link according to the duration of the task to obtain the link task queue. S33. Calculate the key amount of the key pool of the target link at the initial time according to the link task queue; S34. Is the key quantity less than the key quantity threshold? If yes, delete the link from the current undirected graph; if no, proceed to S35. S35. Are there any unprocessed links in each link? If yes, execute S32; otherwise, end the process.

[0016] In one or more embodiments, updating the current undirected graph to obtain an updated undirected graph includes: The links in the current candidate paths whose key amount is less than the key amount threshold are removed from the current undirected graph to obtain the updated undirected graph.

[0017] In one or more embodiments, determining the updated candidate path based on the updated undirected graph includes: S81. Initialize the empty set; S82. Calculate the k-th candidate path using the updated undirected graph; S83. For any target node in the k-th candidate path, obtain the root path of the target node by traversal; S84. Delete the target edge and all nodes before the target node from the updated undirected graph; the target edge is the edge corresponding to the link formed by the target node and the next node. S85. Check whether the prefix of the path in the candidate path set is the same as the root path. If yes, proceed to S86; if no, proceed to S6. S86. Delete all edges located after the target node in the updated undirected graph to obtain a temporary undirected graph; S87. Using the target node as the source node and the destination node of the kth candidate path as the destination node, calculate the shortest path between the source node and the destination node using the breadth-first search algorithm and the temporary undirected graph. S88. Is the shortest path empty? If yes, execute S6; if no, execute S89. S89. Merge the shortest path with the root path to obtain a temporary path; S810. Is the temporary path in the candidate path set? If yes, execute S811; if no, execute S812. S811. Use the temporary path as the updated candidate path; S812. Store the temporary path in the empty set; S813. Is the empty set empty? If yes, execute S6; if no, execute S814. S814. Transfer the shortest path in the empty set to the candidate path set as the updated candidate path, and execute S3.

[0018] In one or more embodiments, it further includes: If failure is determined, the target application task is stored in a blocking queue.

[0019] Secondly, embodiments of this application provide a quantum key relay device, the device comprising: The first processing module is used to acquire multiple application tasks and determine the task queue of application tasks that need to perform key relay from the multiple application tasks. The second processing module is used to acquire network information of the quantum network and determine the quantum key relay path of the target application task based on the network information; the target application task is the application task with the highest priority in the task queue. The sending module is configured to, if successful, send a key relay instruction to each node in the quantum key relay path, so that the source node in each node generates a shared key and sends it to the destination node through an intermediate node, and send the key identifier of the shared key to the application corresponding to the target application task, so that the application performs encrypted communication based on the key identifier.

[0020] In one or more embodiments, the first processing module includes: The first determining submodule is used to determine, from the applications corresponding to each application task, candidate applications with quantum key application permissions, and candidate application tasks corresponding to each candidate application. The second determination submodule is used to determine the application tasks that need to be key relayed from among the candidate application tasks. The sorting submodule is used to sort the application tasks that need key relay according to their priority, thus obtaining a task queue.

[0021] In one or more embodiments, the application task includes a source node and a destination node; the second determining submodule is specifically used for: Determine whether the source node and destination node in each candidate application task are directly connected; Among the candidate application tasks, those whose source and destination nodes are not directly connected are designated as target application tasks.

[0022] In one or more embodiments, the second processing module is specifically used for: Obtain the key generation rate and the key pool size in the quantum network; Obtain the topology graph of the quantum network, and use the topology graph to generate the current undirected graph.

[0023] In one or more embodiments, the second processing module is specifically used for: S1. Determine the highest priority target application task from the task queue, and initialize k=1; S2. Determine the current candidate path using the current undirected graph of the quantum network; S3. Can the current candidate path perform key relay? If yes, proceed to S4; if no, proceed to S5. S4. Use the current candidate path as a quantum key relay path; S5. Does k exceed the threshold? If yes, proceed to S6; otherwise, proceed to S7. S6. Block the target application task; S7. Update the current undirected graph to obtain the updated undirected graph; S8. Based on the updated undirected graph, determine the updated candidate path, take the updated undirected graph as the current undirected graph, and take the updated candidate path as the current candidate path, execute S2, and k=k+1.

[0024] In one or more embodiments, the second processing module is further configured to: Initialize the candidate path set; Determine the source node and destination node from the target application task; The shortest path between the source node and the destination node is calculated using a breadth-first search algorithm and the current undirected graph, and the shortest path is stored in the candidate path set.

[0025] In one or more embodiments, the second processing module is further configured to: S31. Traverse each link in the current candidate path and determine the link task corresponding to each link; S32. For any target link in each link, sort the link tasks assigned to the target link according to the duration of the task to obtain the link task queue. S33. Calculate the key amount of the key pool of the target link at the initial time according to the link task queue; S34. Is the key quantity less than the key quantity threshold? If yes, delete the link from the current undirected graph; if no, proceed to S35. S35. Are there any unprocessed links in each link? If yes, execute S32; otherwise, end the process.

[0026] In one or more embodiments, the second processing module is further configured to: The links in the current candidate paths whose key amount is less than the key amount threshold are removed from the current undirected graph to obtain the updated undirected graph.

[0027] In one or more embodiments, the second processing module is further configured to: S81. Initialize the empty set; S82. Calculate the k-th candidate path using the updated undirected graph; S83. For any target node in the k-th candidate path, obtain the root path of the target node by traversal; S84. Delete the target edge and all nodes before the target node from the updated undirected graph; the target edge is the edge corresponding to the link formed by the target node and the next node. S85. Check whether the prefix of the path in the candidate path set is the same as the root path. If yes, proceed to S86; if no, proceed to S6. S86. Delete all edges located after the target node in the updated undirected graph to obtain a temporary undirected graph; S87. Using the target node as the source node and the destination node of the kth candidate path as the destination node, calculate the shortest path between the source node and the destination node using the breadth-first search algorithm and the temporary undirected graph. S88. Is the shortest path empty? If yes, execute S6; if no, execute S89. S89. Merge the shortest path with the root path to obtain a temporary path; S810. Is the temporary path in the candidate path set? If yes, execute S811; if no, execute S812. S811. Use the temporary path as the updated candidate path; S812. Store the temporary path in the empty set; S813. Is the empty set empty? If yes, execute S6; if no, execute S814. S814. Transfer the shortest path in the empty set to the candidate path set as the updated candidate path, and execute S3.

[0028] In one or more embodiments, it further includes: A storage module is used to store the target application task into a blocking queue if failure is determined.

[0029] Thirdly, embodiments of this application provide an electronic device including a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0030] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0031] Fifthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the method as described in the first aspect.

[0032] The embodiments of this application have the following advantages: In this embodiment, the SDN controller acquires multiple application tasks, determines the task queue of application tasks requiring key relay from among them, then acquires the network information of the quantum network, and determines the quantum key relay path for the target application task based on the network information. If successful, it sends key relay instructions to each node in the quantum key relay path, enabling the source nodes in each node to generate a shared key and send it to the destination node through intermediate nodes. Additionally, it sends the key identifier of the shared key to the application corresponding to the target application task, allowing the application to perform encrypted communication based on the key identifier. In this way, the SDN controller can obtain a global view and real-time data, achieving intelligent key relay through a dynamic quantum key relay algorithm. This algorithm can intelligently calculate the optimal relay path based on the key pool inventory, generation rate, and current task load of each link in the network, and rigorously verify the key supply capacity of the path throughout the entire task cycle, thereby greatly improving the success rate and reliability of key allocation. Furthermore, the algorithm's built-in priority scheduling mechanism ensures that the key requirements of critical services are met first, while intelligent alternative path search and task blocking queue management effectively avoid overall network performance degradation due to insufficient local resources, ultimately maximizing network resource utilization and improving overall throughput. This solves the core pain points of low key distribution efficiency and resource waste in traditional solutions. Attached Figure Description

[0033] Figure 1 This is a schematic diagram of the architecture of the SDN dynamic quantum key relay system of this application; Figure 2 This is a flowchart illustrating the steps of an embodiment of a quantum key relay method according to this application; Figure 3 This is a structural block diagram of an embodiment of a quantum key relay device according to this application. Detailed Implementation

[0034] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0035] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0036] The embodiments of this application will be described in detail below with reference to the accompanying drawings and specific examples and application scenarios.

[0037] One of the core concepts of this application's embodiments lies in the fact that the SDN controller possesses a global view and real-time data, and implements intelligent key relay through a dynamic quantum key relay algorithm. This algorithm can intelligently calculate the optimal relay path based on the key pool inventory, generation rate, and current task load of each link in the network, and rigorously verify the key supply capacity of the path throughout the entire task cycle, thereby greatly improving the success rate and reliability of key allocation. Furthermore, the algorithm's built-in priority scheduling mechanism ensures that the key requirements of critical services are met first, while intelligent alternative path search and task blocking queue management effectively avoid overall network performance degradation due to insufficient local resources, ultimately maximizing network resource utilization and improving overall throughput.

[0038] Reference Figure 1 This paper illustrates the architecture of the SDN dynamic quantum key relay system of this application, which can be applied to the SDN controller in the system. The system can include three layers: Quantum layer: Composed of multiple QKD nodes. These nodes generate a shared quantum key through a quantum channel and negotiate and correct errors through a classical channel.

[0039] Control Layer: The core is the SDN controller. It has a global view, understanding the topology of the entire QKD network, the key generation rate of each link, the key pool inventory, link status, etc.

[0040] Application layer: This layer runs applications that require quantum keys, such as an encrypted video conferencing system. It sends a key request to the controller, specifying the required key amount, source and destination nodes, key service quality, etc.

[0041] The nodes in the quantum network topology model are QKD key generation and provision nodes, which can contain multiple QKD transmitting devices, receiving devices, and KM devices. The edges are QKD links, used to connect the QKD transmitting device inside one node to the QKD receiving device inside another node. The two run the quantum key distribution protocol to obtain quantum keys and upload them to the KM device for storage. The KM device is connected to the SDN controller and constantly reports the remaining key amount in the key pool and the key production rate in the QKD network.

[0042] Each pair of QKD links e It has two important parameters: key generation rate (unit: bits / second). The number of keys in the key pool (unit: bits) The SDN controller collects real-time information from all QKD nodes via the southbound interface. End-to-end application tasks. T It can be represented by a quintuple ( ,in, s Represents the source node, d D represents the destination node, and D represents the required key rate (in bits / second). t Represents duration (unit: seconds). P This represents priority (the larger the value, the higher the priority, used to determine the allocation order). Based on the collected global information, the SDN controller runs the dynamic quantum key relay algorithm to allocate appropriate relay lines to each task.

[0043] Furthermore, finding a suitable key relay requires satisfying the following constraints: (1) The task cannot be split, that is, all links on the entire path must simultaneously meet the key supply conditions; (2) During the duration of the task, the remaining amount of the key pool for each link e on the path cannot be negative; (3) The key pool is set before the task begins. During the mission, quantum keys will be consumed and generated simultaneously.

[0044] Through the above methods, the embodiments of this application adopt a three-layer architecture including a quantum layer, a control layer, and an application layer. This architecture breaks through the limitations of traditional QKD networks in terms of distance and management, and can flexibly adapt to networks of different sizes and topologies. It supports multiple QKD protocols and application scenarios, thereby greatly improving the coverage, key distribution efficiency, and overall resource utilization of the quantum network. Through the global view and centralized control capabilities of the SDN controller, it can not only dynamically adjust the key relay path according to the real-time network status (such as key pool inventory and link rate) and diverse application task requirements (such as priority and key quantity), but also realize the optimized scheduling and automated management of network resources.

[0045] Reference Figure 2 The diagram illustrates a flowchart of an embodiment of a quantum key relay method according to this application, which may specifically include the following steps: Step 201: Obtain multiple application tasks and determine the task queue of application tasks that need to perform key relay from the multiple application tasks.

[0046] Specifically, the SDN controller can obtain multiple application tasks from the application layer to determine the application's encryption requirements. Since each application task is represented by a quintuple, it can be determined whether the application task has the authority to request quantum keys from s to d for any given application task.

[0047] Once all application tasks are determined, the applications (referred to as "candidate applications") and application tasks (referred to as "candidate application tasks") with quantum key application authorization can be identified. Each candidate application corresponds one-to-one with a candidate application task.

[0048] After identifying candidate application tasks, for any candidate application task, it can be further determined whether the connection from s to d is direct. If it is direct, then the candidate application task does not need key relay; if it is not direct, then the candidate application task needs key relay.

[0049] Once all candidate application tasks are determined, the application tasks requiring key relay can be identified. Then, these application tasks are sorted in descending order of priority P to obtain the task queue. .

[0050] Step 202: Obtain the network information of the quantum network and determine the quantum key relay path of the target application task based on the network information; the target application task is the application task with the highest priority in the task queue.

[0051] Specifically, after the task queue is determined, network information of the quantum network can be obtained.

[0052] Network information may include the key generation rate and key pool size of each QKD link in the quantum network, as well as the undirected graph of the quantum network (denoted as "current undirected graph").

[0053] The SDN controller can acquire the topology graph of the quantum network and use this topology graph to analyze the current undirected graph. Where V is the set of nodes, E is the set of edges, and the weights of all edges are... ,starting point ,end .

[0054] Once the network information is determined, the following process can be performed: S1. Determine the highest priority application task (denoted as "target application task") from the task queue, and initialize k=1; S2. Use the current undirected graph of the quantum network to determine candidate paths (denoted as "current candidate paths"); S3. Can the current candidate path perform key relay? If yes, proceed to S4; if no, proceed to S5. S4. Use the current candidate path as the quantum key relay path, and then execute step 203; If S5 and k exceed the threshold, proceed to S6; otherwise, proceed to S7. In other words, the number of times the quantum key relay path is determined can be preset, thus avoiding the situation of determining the path infinitely. S6. Block the target application task to facilitate subsequent processing of the target application task; S7. Update the current undirected graph to obtain the updated undirected graph; S8. Based on the updated undirected graph, determine the updated candidate path, use the updated undirected graph as the current undirected graph, and use the updated candidate path as the current candidate path, execute S2, and k=k+1.

[0055] Specifically, when determining the current candidate path, a set for storing candidate paths (denoted as the "candidate path set") can be initialized. Then, based on the five-tuple of the target application task, the source node s and the destination node d are determined. The breadth-first search algorithm (BFS) is then used to calculate the shortest path from the source node to the destination node. (Referred to as "current candidate path"), and this shortest path is stored in the candidate path set. .

[0056] After obtaining the candidate path set, the SDN controller can verify... Whether key relay is possible is as follows: S31. Traverse the current candidate paths Each link in e For any given link, determine the link that is assigned to it. n Each task (denoted as a "linked task") .

[0057] S32. For any link in the chain (denoted as the "target link"), sort the link tasks assigned to the target link according to their duration to obtain the link task queue. .

[0058] S33. Calculate the target link at the initial time based on the link task queue. Key pool key quantity .

[0059] S34. Is the key quantity less than the key quantity threshold? If yes, delete the link from the current undirected graph; if not, proceed to S35. For example, If the condition is met, it means that the link can perform key relay, and thus S35 is executed; otherwise, it means that the link cannot perform key relay, and thus the link is deleted from the current undirected graph.

[0060] S35. Are there any unprocessed links in each link? If yes, execute S32; otherwise, end the process.

[0061] when Each link in e After all traversals are completed, if k The value did not exceed the threshold (e.g., Then, the current undirected graph can be updated by deleting links whose key values ​​are less than a key value threshold, thus obtaining the updated undirected graph. .

[0062] After obtaining the updated undirected graph, a new candidate path (denoted as the "updated candidate path") can be determined using the updated undirected graph, which can specifically include: S81. Initialize an empty set; S82. Calculate the i-th using the updated undirected graph. k Shortest path As a candidate path; assuming, The node sequence is ,So, edge set yes r A QKD link that does not meet the key relay requirements of this application task.

[0063] S83, Regarding the first k Any target node in the candidate paths The root path of the target node is obtained by traversing the path. ; S84, From the updated undirected graph Delete target edge And, all nodes preceding the target node. The target edge is the edge corresponding to the link formed by the target node and the next node. S85, Detection of candidate path set A Prefix and root path in the path Are they the same? If yes, execute S86; if not, execute S6. S86. Delete all edges following the target node in the updated undirected graph to obtain a temporary undirected graph. ; S87, with target node As the source node, with the first k The destination node of the candidate path is the destination node. The shortest path between the source node and the destination node is calculated using a breadth-first search algorithm and a temporary undirected graph. ; S88. Is the shortest path empty? If yes, execute S6; otherwise, execute S89. S89, Find the shortest path With root path Merge to obtain a temporary path ; S810. Is the temporary path in the candidate path set A? If yes, execute S811; if no, execute S812. S811. Use the temporary path as the updated candidate path; S812. Store the temporary path in the empty set B; S813. Is the empty set empty? If yes, execute S6; if no, execute S814. S814. Transfer the shortest path in the empty set to the candidate path set as the updated candidate path, and execute S3.

[0064] It should be noted that once the updated candidate path is verified and confirmed as a quantum key relay path, step 203 can be executed; otherwise, continue to determine the next quantum key relay path until a successful determination is made, or block the target application task. For example, suppose... k =3. After determining the first candidate path, it is verified. If the verification is successful, the first candidate path is adopted as the quantum key relay path. If the verification fails, the second candidate path is determined, and so on, until the final quantum key relay path is determined. Alternatively, if all three candidate paths determined in sequence fail the verification, the target application task is blocked.

[0065] Step 203: If successful, send a key relay instruction to each node in the quantum key relay path so that the source node in each node generates a shared key and sends it to the destination node through the intermediate node. Also, send the key identifier of the shared key to the application corresponding to the target application task so that the application can perform encrypted communication based on the key identifier.

[0066] Specifically, once the final quantum key relay path is determined, the SDN controller can send key relay instructions to each node in the quantum key relay path.

[0067] After receiving the key relay instruction, the source node in each node can generate a shared key and send it to the intermediate node. The intermediate node can then transmit the shared key to the destination node via the link key, where the destination node stores the shared key. Simultaneously, the source node can send the key identifier of the shared key to the application corresponding to the target application task. The application can then use the key identifier to retrieve the shared key from either the source or destination node and use it for encrypted communication.

[0068] For example, suppose a quantum key relay path includes four nodes A, B, C, and D. The SDN controller sends specific key relay instructions to the four nodes respectively. After receiving the instructions, the KM inside each node prepares the required key for relay calculation.

[0069] The QKD process is performed in parallel between A and B, B and C, and C and D, generating three independent sets of link keys: , , Node B has and Node C has and After receiving the key relay instruction, node A generates the final shared key. and with XOR calculation yields and will Send it to node B, and node B performs an XOR operation to get... and will Send to node C for XOR operation to obtain and will The message is sent to node D. Node D receives the SDN de-relay key instruction and obtains the final shared key with node A. .

[0070] A can assign a unique ID to the shared key and notify the application. The application can then retrieve the shared key from the nearest key pool of A or D based on the ID, and use the shared key for encrypted communication.

[0071] Furthermore, if the quantum key relay path cannot be determined, that is, if the determination of the quantum key relay path fails, the target application task can be stored in a blocking queue and wait for the next round of scheduling.

[0072] In this embodiment, the SDN controller acquires multiple application tasks, determines the task queue of application tasks requiring key relay from among them, then acquires the network information of the quantum network, and determines the quantum key relay path for the target application task based on the network information. If successful, it sends key relay instructions to each node in the quantum key relay path, enabling the source nodes in each node to generate a shared key and send it to the destination node through intermediate nodes. Additionally, it sends the key identifier of the shared key to the application corresponding to the target application task, allowing the application to perform encrypted communication based on the key identifier. In this way, the SDN controller can obtain a global view and real-time data, achieving intelligent key relay through a dynamic quantum key relay algorithm. This algorithm can intelligently calculate the optimal relay path based on the key pool inventory, generation rate, and current task load of each link in the network, and rigorously verify the key supply capacity of the path throughout the entire task cycle, thereby greatly improving the success rate and reliability of key allocation. Furthermore, the algorithm's built-in priority scheduling mechanism ensures that the key requirements of critical services are met first, while intelligent alternative path search and task blocking queue management effectively avoid overall network performance degradation due to insufficient local resources, ultimately maximizing network resource utilization and improving overall throughput. This solves the core pain points of low key distribution efficiency and resource waste in traditional solutions.

[0073] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0074] Reference Figure 3 The diagram illustrates a structural block diagram of an embodiment of a quantum key relay device according to this application, which may specifically include the following modules: The first processing module 301 is used to acquire multiple application tasks and determine the task queue of application tasks that need to perform key relay from the multiple application tasks. The second processing module 302 is used to acquire network information of the quantum network and determine the quantum key relay path of the target application task based on the network information; the target application task is the application task with the highest priority in the task queue. The sending module 303 is configured to, if successful, send a key relay instruction to each node in the quantum key relay path, so that the source node in each node generates a shared key and sends it to the destination node through an intermediate node, and send the key identifier of the shared key to the application corresponding to the target application task, so that the application performs encrypted communication based on the key identifier.

[0075] In this embodiment of the application, the first processing module includes: The first determining submodule is used to determine, from the applications corresponding to each application task, candidate applications with quantum key application permissions, and candidate application tasks corresponding to each candidate application. The second determination submodule is used to determine the application tasks that need to be key relayed from among the candidate application tasks. The sorting submodule is used to sort the application tasks that need key relay according to their priority, thus obtaining a task queue.

[0076] In this embodiment of the application, the application task includes a source node and a destination node; the second determining submodule is specifically used for: Determine whether the source node and destination node in each candidate application task are directly connected; Among the candidate application tasks, those whose source and destination nodes are not directly connected are designated as target application tasks.

[0077] In this embodiment of the application, the second processing module is specifically used for: Obtain the key generation rate and the key pool size in the quantum network; Obtain the topology graph of the quantum network, and use the topology graph to generate the current undirected graph.

[0078] In this embodiment of the application, the second processing module is specifically used for: S1. Determine the highest priority target application task from the task queue, and initialize k=1; S2. Determine the current candidate path using the current undirected graph of the quantum network; S3. Can the current candidate path perform key relay? If yes, proceed to S4; if no, proceed to S5. S4. Use the current candidate path as a quantum key relay path; S5. Does k exceed the threshold? If yes, proceed to S6; otherwise, proceed to S7. S6. Block the target application task; S7. Update the current undirected graph to obtain the updated undirected graph; S8. Based on the updated undirected graph, determine the updated candidate path, take the updated undirected graph as the current undirected graph, and take the updated candidate path as the current candidate path, execute S2, and k=k+1.

[0079] In this embodiment of the application, the second processing module is further configured to: Initialize the candidate path set; Determine the source node and destination node from the target application task; The shortest path between the source node and the destination node is calculated using a breadth-first search algorithm and the current undirected graph, and the shortest path is stored in the candidate path set.

[0080] In this embodiment of the application, the second processing module is further configured to: S31. Traverse each link in the current candidate path and determine the link task corresponding to each link; S32. For any target link in each link, sort the link tasks assigned to the target link according to the duration of the task to obtain the link task queue. S33. Calculate the key amount of the key pool of the target link at the initial time according to the link task queue; S34. Is the key quantity less than the key quantity threshold? If yes, delete the link from the current undirected graph; if no, proceed to S35. S35. Are there any unprocessed links in each link? If yes, execute S32; otherwise, end the process.

[0081] In this embodiment of the application, the second processing module is further configured to: The links in the current candidate paths whose key amount is less than the key amount threshold are removed from the current undirected graph to obtain the updated undirected graph.

[0082] In this embodiment of the application, the second processing module is further configured to: S81. Initialize the empty set; S82. Calculate the k-th candidate path using the updated undirected graph; S83. For any target node in the k-th candidate path, obtain the root path of the target node by traversal; S84. Delete the target edge and all nodes before the target node from the updated undirected graph; the target edge is the edge corresponding to the link formed by the target node and the next node. S85. Check whether the prefix of the path in the candidate path set is the same as the root path. If yes, proceed to S86; if no, proceed to S6. S86. Delete all edges located after the target node in the updated undirected graph to obtain a temporary undirected graph; S87. Using the target node as the source node and the destination node of the kth candidate path as the destination node, calculate the shortest path between the source node and the destination node using the breadth-first search algorithm and the temporary undirected graph. S88. Is the shortest path empty? If yes, execute S6; if no, execute S89. S89. Merge the shortest path with the root path to obtain a temporary path; S810. Is the temporary path in the candidate path set? If yes, execute S811; if no, execute S812. S811. Use the temporary path as the updated candidate path; S812. Store the temporary path in the empty set; S813. Is the empty set empty? If yes, execute S6; if no, execute S814. S814. Transfer the shortest path in the empty set to the candidate path set as the updated candidate path, and execute S3.

[0083] In this embodiment of the application, it also includes: A storage module is used to store the target application task into a blocking queue if failure is determined.

[0084] The virtual device in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, a mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc. A non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television (TV), ATM, or self-service machine, etc. This application embodiment does not impose specific limitations.

[0085] This application also provides an electronic device, including: It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described quantum key relay method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0086] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described quantum key relay method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0087] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0088] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0089] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0090] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0092] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0093] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0094] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0095] The embodiments provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A quantum key relay method, characterized in that, include: Obtain multiple application tasks, and determine the task queue of application tasks that need key relay from the multiple application tasks; Obtain the network information of the quantum network, and determine the quantum key relay path of the target application task based on the network information; the target application task is the application task with the highest priority in the task queue. If successful, a key relay instruction is sent to each node in the quantum key relay path, so that the source node in each node generates a shared key and sends it to the destination node through the intermediate node. In addition, the key identifier of the shared key is sent to the application corresponding to the target application task, so that the application performs encrypted communication based on the key identifier.

2. The quantum key relay method according to claim 1, characterized in that, The task queue for determining the application tasks that require key relay from multiple application tasks includes: From the applications corresponding to each application task, determine the candidate applications with quantum key application permissions, and the candidate application tasks corresponding to each candidate application. Identify the application tasks that require key relay from among the candidate application tasks; The application tasks that require key relay are sorted according to their priority to obtain a task queue.

3. The quantum key relay method according to claim 2, characterized in that, Application tasks include source nodes and destination nodes; The step of determining the application tasks that require key relay from among the candidate application tasks includes: Determine whether the source node and destination node in each candidate application task are directly connected; Among the candidate application tasks, those whose source and destination nodes are not directly connected are designated as target application tasks.

4. The quantum key relay method according to claim 1, characterized in that, The acquisition of network information of the quantum network includes: Obtain the key generation rate and the key pool size in the quantum network; Obtain the topology graph of the quantum network, and use the topology graph to generate the current undirected graph.

5. The quantum key relay method according to claim 1, characterized in that, The process of determining the quantum key relay path for the target application task based on the network information includes: S1. Determine the highest priority target application task from the task queue, and initialize k=1; S2. Determine the current candidate path using the current undirected graph of the quantum network; S3. Can the current candidate path perform key relay? If yes, proceed to S4; if no, proceed to S5. S4. Use the current candidate path as a quantum key relay path; S5. Does k exceed the threshold? If yes, proceed to S6; otherwise, proceed to S7. S6. Block the target application task; S7. Update the current undirected graph to obtain the updated undirected graph; S8. Based on the updated undirected graph, determine the updated candidate path, take the updated undirected graph as the current undirected graph, and take the updated candidate path as the current candidate path, execute S2, and k=k+1.

6. The quantum key relay method according to claim 5, characterized in that, The step of determining the current candidate path using the current undirected graph of the quantum network includes: Initialize the candidate path set; Determine the source node and destination node from the target application task; The shortest path between the source node and the destination node is calculated using a breadth-first search algorithm and the current undirected graph, and the shortest path is stored in the candidate path set.

7. The quantum key relay method according to claim 5, characterized in that, The verification of whether the current candidate path can perform key relay includes: S31. Traverse each link in the current candidate path and determine the link task corresponding to each link; S32. For any target link in each link, sort the link tasks assigned to the target link according to the duration of the task to obtain the link task queue. S33. Calculate the key amount of the key pool of the target link at the initial time according to the link task queue; S34. Is the key quantity less than the key quantity threshold? If yes, delete the link from the current undirected graph; if no, proceed to S35. S35. Are there any unprocessed links in each link? If yes, execute S32; otherwise, end the process.

8. The quantum key relay method according to claim 5, characterized in that, The step of updating the current undirected graph to obtain the updated undirected graph includes: The links in the current candidate paths whose key amount is less than the key amount threshold are removed from the current undirected graph to obtain the updated undirected graph.

9. The quantum key relay method according to claim 5, characterized in that, The step of determining the updated candidate path based on the updated undirected graph includes: S81. Initialize the empty set; S82. Calculate the k-th candidate path using the updated undirected graph; S83. For any target node in the k-th candidate path, obtain the root path of the target node by traversal; S84. Delete the target edge and all nodes before the target node from the updated undirected graph; the target edge is the edge corresponding to the link formed by the target node and the next node. S85. Check whether the prefix of the path in the candidate path set is the same as the root path. If yes, proceed to S86; if no, proceed to S6. S86. Delete all edges located after the target node in the updated undirected graph to obtain a temporary undirected graph; S87. Using the target node as the source node and the destination node of the kth candidate path as the destination node, calculate the shortest path between the source node and the destination node using the breadth-first search algorithm and the temporary undirected graph. S88. Is the shortest path empty? If yes, execute S6; if no, execute S89. S89. Merge the shortest path with the root path to obtain a temporary path; S810. Is the temporary path in the candidate path set? If yes, execute S811; if no, execute S812. S811. Use the temporary path as the updated candidate path; S812. Store the temporary path in the empty set; S813. Is the empty set empty? If yes, execute S6; if no, execute S814. S814. Transfer the shortest path in the empty set to the candidate path set as the updated candidate path, and execute S3.

10. The quantum key relay method according to claim 1, characterized in that, Also includes: If failure is determined, the target application task is stored in a blocking queue.

11. A quantum key relay device, characterized in that, include: The first processing module is used to acquire multiple application tasks and determine the task queue of application tasks that need to perform key relay from the multiple application tasks. The second processing module is used to acquire network information of the quantum network and determine the quantum key relay path of the target application task based on the network information; the target application task is the application task with the highest priority in the task queue. The sending module is configured to, if successful, send a key relay instruction to each node in the quantum key relay path, so that the source node in each node generates a shared key and sends it to the destination node through an intermediate node, and send the key identifier of the shared key to the application corresponding to the target application task, so that the application performs encrypted communication based on the key identifier.

12. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the quantum key relay method as described in claims 1-10.

13. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the quantum key relay method as described in claims 1-10.

Images