A trusted communication method, computer device, and storage medium based on QKD
By constructing a QKD network layer and a key management layer in a trusted communication system, and using quantum channels to negotiate and generate quantum keys and manage them throughout their entire lifecycle, the security deficiencies of traditional public-key cryptography algorithms in quantum computing environments are solved, and long-term secure communication against quantum computing attacks is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- WEIWEI SHANGHAI NETWORK TECH CO LTD
- Filing Date
- 2026-01-22
- Publication Date
- 2026-06-02
AI Technical Summary
When faced with the threat of quantum computing, existing trusted communication systems are not secure enough with traditional public-key cryptography algorithms, and cannot provide long-term reliable communication guarantees.
A network layer and key management layer based on QKD are constructed. Quantum keys are generated through quantum channel negotiation, and key management services are deployed on service nodes to realize full lifecycle management of quantum keys and dynamic encryption strategies, thereby ensuring communication security.
It provides a long-term security mechanism against quantum computing attacks, enhances the information-theoretic security and flexibility of trusted communication systems, and ensures the long-term confidentiality and reliability of communications.
Smart Images
Figure CN122137539A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of trusted communication technology, and in particular to a trusted communication method, computer device and storage medium based on QKD. Background Technology
[0002] Trusted communication technology aims to authenticate the calling user's identity using cryptographic tokens, achieving a CA-level identity verification effect, thereby enhancing the credibility of the call process. In existing technologies, trusted communication is typically deployed using a microservice architecture, with its functions divided into multiple independent business subsystems such as trusted service support, cryptographic token transmission, identity credential query, operation management, and trusted authorization. These business subsystems are distributed across different nodes according to performance requirements and require frequent cross-node communication during the business process.
[0003] For example, a user's identity credential application needs to be uploaded through the operations management business subsystem, and then forwarded through the service support business subsystem to the trusted authorization business subsystem located at the CA to complete the certificate issuance. To ensure the confidentiality and integrity of these critical interactions, existing technologies rely on secure channel construction methods based on public-key cryptography. Specifically, the sender generates a symmetric session key and encrypts it using the receiver's SM2 public key to form a digital envelope for transmission; the receiver then uses its corresponding SM2 private key to decrypt the envelope, obtain the session key, and thus establish an encrypted communication channel based on the session key.
[0004] The inventors of this application have discovered that the aforementioned cryptographic algorithms based on the complexity of mathematical problems, including the SM2 elliptic curve algorithm and the RSA algorithm, are facing a severe challenge to their security foundation due to the rapid development of quantum computing technology. The theoretically powerful computing capabilities of quantum computers may render these traditional public-key cryptographic algorithms vulnerable in the future, unable to provide long-term and reliable guarantees for communication security. Summary of the Invention
[0005] This invention provides a trusted communication method, computer device, and storage medium based on QKD. The technical problem it aims to solve is: how to provide a long-term security mechanism that can resist quantum computing attacks for communication between nodes of a distributed trusted communication microservice.
[0006] In a first aspect, embodiments of the present invention provide a trusted communication method based on QKD, comprising: A QKD network layer is constructed among multiple service nodes of a trusted communication system, wherein each QKD device in the QKD network layer is connected through a quantum channel for negotiating and generating quantum keys; A key management service is deployed on each of the service nodes to build a QKD key management layer, wherein the key management service is configured to obtain and manage the quantum keys from the corresponding QKD device; A service layer is deployed on top of the QKD key management layer, and the service layer includes multiple business subsystems; When the first business subsystem needs to communicate with the second business subsystem, the first business subsystem requests a quantum key from the corresponding local key management service. In response to the request, the key management service distributes the quantum key to the first business subsystem; The first service subsystem uses the quantum key to encrypt the communication data and sends the encrypted data to the second service subsystem; The second business subsystem obtains the same quantum key through the corresponding local key management service and decrypts the received encrypted data.
[0007] Optionally, constructing a QKD network layer among multiple service nodes of the trusted communication system includes: Configure at least one QKD device for each of the service nodes; An independent quantum channel is established between the QKD devices corresponding to every two service nodes that need to communicate directly in a quantum-secure manner to form a QKD link; A QKD network is a mesh topology consisting of all established QKD links.
[0008] Optionally, the key management service is used for full lifecycle management of quantum keys, including: The quantum keys received from the QKD device are stored in a secure memory. In response to a key request from a service subsystem, an unused quantum key is retrieved from the secure memory and distributed to the service subsystem. When the number of stored quantum keys is lower than a preset first threshold, or when the stored quantum keys reach a preset expiration date, the corresponding QKD device is triggered to generate new quantum keys for supplementary storage. After the quantum key has been used up by the corresponding business subsystem, or after the quantum key has exceeded its preset validity period, the quantum key will be deleted from the secure storage.
[0009] Optionally, the secure storage is a hardware security module (HSM); the quantum key is stored in the hardware security module (HSM) in encrypted form, and can only be read from the hardware security module (HSM) for distribution after the key management service has been authenticated.
[0010] Optionally, the business subsystems in the service layer include a trusted service support business subsystem, a cryptographic token transmission business subsystem, an identity credential query business subsystem, an operation management business subsystem, and a trusted authorization business subsystem.
[0011] Optionally, it also includes a dynamic encryption policy execution step, including: The system monitors the number of available quantum keys in the key management service at each service node in real time and determines the security level required for the current communication to be initiated. If the number of available quantum keys meets the preset requirements of the current communication and the security level is high, then the process jumps to the step where the first business subsystem requests a quantum key from the local corresponding key management service to use the quantum key for encrypted communication.
[0012] Optionally, the dynamic encryption policy execution step further includes: If the number of available quantum keys does not meet the preset requirements of the current communication or the security level is not high, then switch to using a preset traditional cryptographic algorithm for secure communication.
[0013] Optionally, the conventional cryptographic algorithm includes at least one of the SM2 algorithm, RSA algorithm, and SM4 algorithm.
[0014] Secondly, embodiments of the present invention also provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.
[0015] Thirdly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.
[0016] This invention provides a trusted communication method, computer device, and storage medium based on quantum key distribution (QKD). The method includes: constructing a QKD network layer among multiple service nodes of a trusted communication system, wherein each QKD device in the QKD network layer is connected via a quantum channel for negotiating and generating quantum keys; deploying a key management service at each service node to construct a QKD key management layer, wherein the key management service is configured to obtain and manage the quantum keys from the corresponding QKD devices; deploying a service layer above the QKD key management layer, the service layer including multiple business subsystems; when a first business subsystem needs to communicate with a second business subsystem, the first business subsystem requests a quantum key from its local corresponding key management service; the key management service responds to the request and distributes the quantum key to the first business subsystem; the first business subsystem uses the quantum key to encrypt communication data and sends the encrypted data to the second business subsystem; the second business subsystem obtains the same quantum key through its local corresponding key management service and decrypts the received encrypted data. The technical solution defined in this invention effectively enhances the long-term security of a trusted communication system through the following methods: First, a QKD network layer based on quantum channels is constructed among multiple service nodes. This QKD network layer utilizes quantum physics principles to negotiate and generate quantum keys. Its security does not depend on the computational complexity of mathematical problems, thus fundamentally resisting quantum computing attacks. Furthermore, by deploying an independent key management service for each service node, a dedicated QKD key management layer is constructed, enabling centralized acquisition and management of quantum keys, allowing upper-layer business subsystems to obtain key resources on demand. Further, when business subsystems in the service layer communicate, they request and use quantum keys from the local key management service to encrypt and decrypt communication data, thereby establishing a secure communication channel based on quantum keys between the various business subsystems. This invention deeply integrates quantum key distribution technology with the microservice architecture of trusted communication, replacing traditional session key distribution mechanisms based on algorithms such as SM2 with keys guaranteed by physical principles. This ensures information-theoretic security in the communication process between service nodes, resolving potential security vulnerabilities of traditional public-key cryptography algorithms in future quantum computing environments, and providing future-oriented, long-term effective security protection for trusted communication systems. Attached Figure Description
[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 A flowchart illustrating a trusted communication method based on QKD provided in an embodiment of the present invention; Figure 2 A system architecture diagram of a trusted communication method based on QKD applied to a trusted communication service process, provided in an embodiment of the present invention; Figure 3 A flowchart illustrating the execution steps of the dynamic encryption strategy in the QKD-based trusted communication method provided in this embodiment of the invention; Figure 4 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation
[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0020] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0021] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0022] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0023] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."
[0024] Please see Figure 1 This invention provides a trusted communication method based on QKD, which includes the following steps: S1, A QKD network layer is constructed among multiple service nodes of the trusted communication system, wherein each QKD device in the QKD network layer is connected through a quantum channel for negotiating and generating quantum keys.
[0025] In practical implementation, at the physical level, QKD devices are deployed in the computer rooms of each service node of the trusted communication system. These QKD devices are interconnected through dedicated fiber optic quantum channels. The QKD devices operate quantum key distribution protocols such as BB84, negotiating and generating a random, shared sequence of bits—the quantum key—by transmitting and measuring quantum states (such as the polarization state of photons). This series of interconnected QKD devices and their operating protocols together constitute the QKD network layer.
[0026] In some preferred embodiments, constructing a QKD network layer among multiple service nodes of the trusted communication system includes: configuring at least one QKD device for each service node; establishing an independent quantum channel between the QKD devices corresponding to every two service nodes that need to directly communicate in quantum security to form a QKD link; and constructing a mesh topology QKD network from all the established QKD links, wherein at least one service node has a QKD device whose corresponding QKD device has direct QKD links with the QKD devices corresponding to two or more other service nodes.
[0027] In practice, when constructing the QKD network layer, at least one QKD device is physically deployed for each trusted communication service node, so that each service node has the terminal capability to generate quantum keys.
[0028] To enable potentially direct quantum-secure communication between any two service nodes, a separate optical fiber link is laid between their respective QKD devices as a quantum channel. This link is specifically designed to carry quantum signals (such as single photons) to establish a QKD link between these two specific QKD device pairs.
[0029] By establishing direct point-to-point QKD links between multiple pairs of service nodes, the resulting QKD network exhibits a mesh topology. In this QKD network, there is at least one core service node, such as the node housing the Trusted Service Support business subsystem. The QKD devices configured in its data center are directly connected via multiple independent optical fibers to the QKD devices in the data centers of other service nodes, such as the Operations Management business subsystem node and the Trusted Authorization business subsystem node. This means that from the QKD devices of this core node, there are two or more direct quantum key distribution paths leading to other nodes in different directions.
[0030] In this embodiment, a mesh topology is used to construct the QKD network, significantly enhancing the reliability and resilience of the entire quantum key distribution infrastructure. When a specific QKD link in the QKD network is interrupted due to fiber optic failure or equipment malfunction, key generation and supply are usually not completely interrupted because the core node is directly connected to multiple other nodes. For example, if the direct link between the core node and node A fails, services requiring communication with node A can still indirectly obtain keys through multi-hop paths such as core node-node B-node A (provided there is a link between node B and node A), thus ensuring the continuity of key supply services. Furthermore, this multi-path structure also improves the overall key generation capacity of the network, allowing multiple links to work in parallel, meeting the key requirements of high-concurrency communication scenarios. Furthermore, the mesh topology provides flexibility for system expansion; when adding service nodes, direct QKD connections can be established with one or more existing nodes, making it easy to integrate into the existing network and adapting to the distributed deployment and future expansion needs of trusted communication systems.
[0031] S2, Deploy a key management service on each of the service nodes to build a QKD key management layer, wherein the key management service is configured to obtain and manage the quantum keys from the corresponding QKD device.
[0032] In practice, an independent key management service software is deployed and runs on the operating system of each service node. This key management service establishes a communication connection with the QKD device deployed on the same node through a pre-configured network interface or API. Its core function is to obtain newly generated quantum keys from the QKD device in real time or periodically. These key management services together constitute the QKD key management layer above the QKD network layer.
[0033] In some preferred embodiments, the key management service is used for full lifecycle management of quantum keys, including: storing quantum keys received from QKD devices in a secure memory; retrieving unused quantum keys from the secure memory and distributing them to the service subsystems in response to key requests from the service subsystems; triggering the corresponding QKD device to generate new quantum keys for supplementary storage when the number of stored quantum keys is lower than a preset first threshold or when the stored quantum keys reach a preset validity period; and deleting the quantum keys from the secure memory after they have been used by the corresponding service subsystems or after they have exceeded a preset validity period.
[0034] In practice, the key management service writes the quantum key successfully negotiated from the local QKD device into a secure storage area with access control. This secure storage area can be an encrypted database or a specific secure file. Each time the key is stored, information such as its generation time and index number is recorded.
[0035] Furthermore, in response to a key request from a business subsystem, the key management service queries its secure storage area for unused quantum keys based on the request. By querying a key usage status table, it finds an index for an unassigned key and then extracts the corresponding key bit string based on that index. Finally, the key is distributed to the requesting business subsystem through a secure channel, and the key is marked as assigned in the status table.
[0036] Furthermore, the key management service continuously monitors the number of available, unused quantum keys remaining in the secure storage area. When this number falls below a preset first threshold (which can be dynamically set based on system communication frequency, key generation rate, and security policy, for example, 100 keys to ensure the key pool always has available reserves), or when the earliest batch of keys in storage is detected to have reached its preset expiration date (e.g., 24 hours), the key management service will proactively send a command to the local QKD device to trigger a new round of quantum key negotiation, and will store the newly generated batch of keys in the secure storage area, while simultaneously updating the key generation timestamps.
[0037] Furthermore, the key management service periodically scans or performs event-triggered checks on the keys in the secure storage area. For keys that have been used and confirmed by the business subsystems, or for expired keys whose generation time has far exceeded the preset validity period and which have not been used, the key management service performs a secure deletion operation. This operation not only logically deletes the key record, but may also include overwriting the physical memory unit where the key is stored, ensuring that the key content cannot be recovered.
[0038] This embodiment achieves refined and automated control of key resources by implementing full lifecycle management of quantum keys, including storage, distribution, updating, and destruction. The storage mechanism ensures key confidentiality in a static state, provides a buffer pool for on-demand distribution, and avoids the latency and coupling caused by the requirement for real-time synchronization between business subsystems and QKD devices. The threshold-based trigger update mechanism proactively replenishes the key inventory, ensuring a sufficient supply of fresh keys at all times to meet sudden or continuous communication needs and improve service reliability. The mechanism for periodically destroying used or expired keys is a key element in achieving perfect forward security. It ensures that the key used for each communication is independent and is destroyed after use. Even if a single key is leaked at some point in the future due to some extreme reason, it cannot be used to decrypt historical communication data, thus ensuring long-term confidentiality of communication.
[0039] In some preferred embodiments, the secure storage is a hardware security module (HSM); the quantum key is stored in the hardware security module (HSM) in encrypted form, and can only be read from the hardware security module (HSM) for distribution after the key management service has been authenticated.
[0040] In practice, the key management service deployed on the service node connects to a dedicated hardware security module (HSM). This HSM is a physically independent hardware device with a tamper-proof design and a built-in cryptographic coprocessor and secure storage chip.
[0041] When the key management service needs to store the raw quantum key obtained from the QKD device, it does not store it directly in plaintext. The key management service first calls the encryption interface provided by the HSM, which uses an internally protected root key to encrypt the quantum key, generating a ciphertext key block. This ciphertext key block is then stored in a secure storage chip within the HSM, or externally by the key management service; however, the plaintext key only appears within the HSM.
[0042] When a business subsystem requests a key, the key management service first needs to read the encrypted key block from the HSM. Before performing any operation, the HSM requires the key management service to authenticate itself, for example, through a digital certificate or a pre-shared key. Only after successful authentication is the HSM allowed to proceed with the subsequent operation. The key management service sends the encrypted key block to the HSM, which decrypts it using its internal root key, recovers the plaintext quantum key in a secure area within the chip, and then outputs it to the key management service through a secure channel for distribution to the business subsystem. Throughout the entire process, the plaintext quantum key remains within the physical protection boundary of the HSM.
[0043] In this embodiment, a Hardware Security Module (HSM) is used as the final storage carrier for the quantum key, and the key is stored in encrypted form within it, greatly improving the security of the key in its static storage state. The tamper-proof physical properties of the HSM effectively resist physical attacks against the storage medium, and its internal encryption operations ensure that even if the storage medium is illegally read, the attacker will only obtain the encrypted ciphertext and cannot directly obtain the plaintext quantum key. The mechanism that requires authentication to access the HSM key adds another layer of access control, preventing unauthorized software entities (including potentially compromised key management service modules) from illegally obtaining the key. This design extends the security of the quantum key from simply relying on algorithms and protocols to the physical hardware protection level, forming a defense-in-depth system.
[0044] S3. Deploy a service layer on top of the QKD key management layer, the service layer including multiple business subsystems.
[0045] In practice, a service layer is deployed above the key management layer. The service layer consists of multiple independent business subsystem microservices, such as the trusted service support business subsystem and the operation management business subsystem. These business subsystems run on their respective service nodes and interact with the key management service deployed on the same node through local inter-process communication or network call interfaces.
[0046] In some preferred embodiments, the service layer includes a trusted service support service subsystem, a cryptographic token transmission service subsystem, an identity credential query service subsystem, an operations management service subsystem, and a trusted authorization service subsystem. The method is applied to a trusted communication service process, which includes: receiving user-submitted identity credential application data through the operations management service subsystem; forwarding the application data to the trusted authorization service subsystem through the trusted service support service subsystem; and having the trusted authorization service subsystem issue a certificate based on the application data. During the forwarding of the application data, the method of the present invention is executed to enable secure communication between the operations management service subsystem, the trusted service support service subsystem, and the trusted authorization service subsystem.
[0047] In specific implementation, see Figure 2 This embodiment applies the QKD-based secure communication method to a typical business process of trusted communication and clarifies the business subsystems involved.
[0048] In this embodiment, the service layer deploys five clearly defined business subsystem microservices: a trusted service support business subsystem, a cryptographic token transmission business subsystem, an identity credential query business subsystem, an operations management business subsystem, and a trusted authorization business subsystem. These subsystems run on service nodes that may be located in different physical or logical locations.
[0049] This method is applied to the business process of users applying for trusted identity credentials. Specifically, users submit application data containing their personal identification information to the operations management business subsystem through a client. As the first business subsystem, the operations management business subsystem needs to securely forward this sensitive application data to the trusted authorization business subsystem (the second business subsystem) responsible for review and issuance.
[0050] In this process, when the Operations Management Business Subsystem needs to send application data to the Trusted Service Support Business Subsystem, it acts as the first business subsystem, executing the steps of requesting a quantum key from the local key management service, obtaining the key, and encrypting the data. The Trusted Service Support Business Subsystem, as the receiver (now the second business subsystem), executes the steps of obtaining the same quantum key and decrypting, thus securely receiving the application data. Similarly, when the Trusted Service Support Business Subsystem needs to forward the application data to the Trusted Authorization Business Subsystem, it again acts as the new sender (the first business subsystem), repeating the above QKD-based encryption process to complete secure communication with the Trusted Authorization Business Subsystem, which is the receiver (the second business subsystem). Finally, after decrypting the plaintext application data, the Trusted Authorization Business Subsystem reviews and issues a certificate.
[0051] This embodiment clarifies the specific scenario of applying the QKD secure communication mechanism to the core business process of trusted communication, closely integrating abstract security methods with actual business logic. Taking the typical process of user identity credential application—involving multi-system collaboration and the transfer of sensitive data—as an example, it demonstrates how this invention empowers existing trusted communication systems. When transmitting user application data between the three key business subsystems of operation management, service support, and trusted authorization, QKD quantum key encryption ensures that the user's highly sensitive identity information is protected at an information-theoretic security level throughout the entire transmission link, effectively preventing the theft or cracking of this data during transmission in the era of quantum computing.
[0052] S4. When the first business subsystem needs to communicate with the second business subsystem, the first business subsystem requests a quantum key from the corresponding local key management service.
[0053] In practice, when the first business subsystem in the service layer (e.g., the operation management business subsystem) needs to communicate securely with the second business subsystem (e.g., the trusted authorization business subsystem), the first business subsystem will call the application interface provided by the local key management service to send a key request.
[0054] S5, in response to the request, the key management service distributes the quantum key to the first business subsystem.
[0055] In practice, upon receiving the request, the local key management service retrieves a quantum key that is not currently marked as being used from its maintained key pool or buffer. Then, it securely returns the quantum key to the first business subsystem via the response interface.
[0056] S6, the first service subsystem uses the quantum key to encrypt the communication data and sends the encrypted data to the second service subsystem.
[0057] In practice, after obtaining the quantum key, the first service subsystem uses it as a symmetric key to encrypt the communication data to be transmitted (such as user identity credential applications) using a symmetric encryption algorithm such as SM4, generating ciphertext. Subsequently, the first service subsystem sends the ciphertext data packet to the second service subsystem through a conventional classical data network (such as an IP network).
[0058] S7, the second business subsystem obtains the same quantum key through the corresponding local key management service and decrypts the received encrypted data.
[0059] In practice, upon receiving the ciphertext data packet, the second service subsystem also initiates a key request to its local key management service. Because the QKD devices have pre-negotiated and synchronized the key sequence, and the key management service manages and distributes keys in the same order, the second service subsystem obtains the exact same quantum key used by the first service subsystem. Finally, the second service subsystem uses this quantum key to decrypt the received ciphertext and recover the original communication data.
[0060] This invention decouples business communication from the underlying key supply by constructing an independent QKD network layer to generate quantum keys, which are then provided to business subsystems on demand by a dedicated key management layer. Business subsystems do not need to be aware of the details of the key's origin; they can obtain the quantum key simply through a standard interface. This upgrades traditional public-key cryptography-based secure communication, which relies on mathematical problems, to information-theory-secure communication guaranteed by quantum physics principles. Since the security of quantum key distribution is based on fundamental principles of quantum mechanics, any eavesdropping on the quantum channel will introduce detectable disturbances, allowing both communicating parties to detect and mitigate threats. Therefore, this method fundamentally solves the long-term security crisis that traditional cryptographic algorithms may face in the quantum computing era, providing a future-oriented and robust underlying security foundation for interactions between various business subsystems in trusted communication services. Furthermore, this layered architecture allows existing trusted communication systems to integrate quantum security capabilities with minimal modifications, improving the feasibility and cost-effectiveness of system upgrades.
[0061] In some preferred embodiments, see Figure 3The method further includes a dynamic encryption strategy execution step, comprising: real-time monitoring of the number of available quantum keys in the key management service at each service node, and determining the security level required for the current communication to be initiated; if the number of available quantum keys meets the preset requirements of the current communication and the security level is high, then the process jumps to the step of the first business subsystem requesting a quantum key from the local corresponding key management service to use the quantum key for encrypted communication; if the number of available quantum keys does not meet the preset requirements of the current communication or the security level is not high, then the process switches to using a preset traditional cryptographic algorithm for secure communication.
[0062] In practice, this embodiment adds a dynamic encryption strategy execution function to enable intelligent switching between different security mechanisms.
[0063] Specifically, on each service node, the dynamic policy module periodically (e.g., every second) queries the status interface of the local key management service to obtain the number of currently available (i.e., unallocated and not expired) quantum keys. Simultaneously, when a communication request is about to be initiated, the policy module determines the required security level for this communication based on the initiator, receiver, data type (e.g., whether it is a certificate issuance instruction), or preset policy rules. For example, it may classify the communication into a high security level and a normal security level. The security level can be classified according to the communication data type, sender / receiver identity, business scenario, or preset policy rules. For example, critical businesses such as certificate issuance instructions and identity credential transmission are set to a high security level; this invention does not specifically limit this.
[0064] Furthermore, the strategy module compares the monitored number of available quantum keys with a preset demand, which can be calculated based on the data volume of this communication or by using an empirical value. If the comparison determines that the number of available quantum keys is sufficient (i.e., greater than or equal to the demand), and the security level of this communication is determined to be high, the strategy module instructs the system to continue executing steps S4-S7, that is, to jump to the step of the first business subsystem requesting quantum keys from the local key management service, thereby using the quantum keys to complete this encrypted communication.
[0065] Furthermore, if it is determined that the number of available quantum keys is insufficient (i.e., less than the required amount), or that the security level of this communication is not high (e.g., ordinary level), the policy module will perform a switching operation. The system will switch to using a preset suite of conventional cryptographic algorithms to establish secure communication. In one embodiment, in conventional mode, the sending service subsystem generates a random SM4 session key, and then encrypts this session key using the receiving service subsystem's SM2 public key to form a digital envelope. Both communicating parties ultimately use this SM4 session key to encrypt and decrypt service data.
[0066] This embodiment introduces a dynamic encryption strategy execution mechanism, enabling the system to make intelligent decisions based on real-time resource conditions and specific security requirements, thus achieving an optimal balance between unconditional security and practical efficiency. When quantum key resources are abundant and communication security requirements are extremely high, the system prioritizes the information-theoretically secure QKD mode, providing the highest level of protection for critical transactions. When quantum keys are temporarily insufficient due to equipment failure, link loss, or instantaneous high load, or for some ordinary management communications where real-time requirements outweigh absolute security, the system can automatically and seamlessly downgrade to traditional cryptographic algorithms based on computational complexity, thereby ensuring the continuity and availability of communication services and avoiding potential business interruptions caused by forcefully pushing quantum encryption. This flexible design greatly enhances the overall resilience and deployment flexibility of the system, allowing operators to gradually and smoothly transition to quantum security based on the actual infrastructure construction and key generation capabilities.
[0067] In some preferred embodiments, the conventional cryptographic algorithm includes at least one of the SM2 algorithm, the RSA algorithm, and the SM4 algorithm.
[0068] In practice, when the system switches to using traditional cryptographic algorithms according to the policy, the asymmetric encryption algorithm used is either the SM2 algorithm or the RSA algorithm. Specifically, the sending business subsystem obtains the receiving business subsystem's digital certificate from its local certificate store and extracts the SM2 public key or RSA public key from the certificate.
[0069] Meanwhile, the symmetric encryption algorithm used is SM4. The sending service subsystem calls a random number generator locally to generate a random number of a specified length as the session key for the SM4 algorithm.
[0070] During communication, the sender uses the obtained SM2 public key (or RSA public key) to encrypt and protect the generated SM4 session key, and the communication data is encrypted using this SM4 session key. The receiver uses its own SM2 private key (or RSA private key) corresponding to the public key to decrypt and obtain the SM4 session key, and then decrypts the data. The specific operation flow of the SM2, RSA, and SM4 algorithms follows relevant national cryptographic algorithm standards or internationally accepted specifications, and is not specifically limited in this invention.
[0071] This invention achieves the following beneficial effects by deeply integrating QKD technology with a trusted communication microservice architecture: it provides information-theoretically secure key exchange using quantum key distribution, fundamentally resisting quantum computing attacks; it realizes full lifecycle management of quantum keys through a key management layer, improving the security and efficiency of key usage; and it supports dynamic encryption strategies, allowing seamless switching to traditional cryptographic algorithms when quantum key resources are insufficient or communication security requirements are not high, ensuring system availability and flexibility.
[0072] Please see Figure 2 , Figure 2 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a terminal or a server, wherein the server can be a standalone server or a server cluster composed of multiple servers.
[0073] The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.
[0074] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, it causes the processor 502 to execute a QKD-based trusted communication method.
[0075] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.
[0076] The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a QKD-based trusted communication method.
[0077] The network interface 505 is used for network communication with other devices. Those skilled in the art will understand that the above structure is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. A specific computer device 500 may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.
[0078] The processor 502 is used to run a computer program 5032 stored in the memory to perform the following steps: A QKD network layer is constructed among multiple service nodes of a trusted communication system, wherein each QKD device in the QKD network layer is connected through a quantum channel for negotiating and generating quantum keys; A key management service is deployed on each of the service nodes to build a QKD key management layer, wherein the key management service is configured to obtain and manage the quantum keys from the corresponding QKD device; A service layer is deployed on top of the QKD key management layer, and the service layer includes multiple business subsystems; When the first business subsystem needs to communicate with the second business subsystem, the first business subsystem requests a quantum key from the corresponding local key management service. In response to the request, the key management service distributes the quantum key to the first business subsystem; The first service subsystem uses the quantum key to encrypt the communication data and sends the encrypted data to the second service subsystem; The second business subsystem obtains the same quantum key through the corresponding local key management service and decrypts the received encrypted data.
[0079] Optionally, constructing a QKD network layer among multiple service nodes of the trusted communication system includes: Configure at least one QKD device for each of the service nodes; An independent quantum channel is established between the QKD devices corresponding to every two service nodes that need to communicate directly in a quantum-secure manner to form a QKD link; A QKD network is a mesh topology consisting of all established QKD links.
[0080] Optionally, the key management service is used for full lifecycle management of quantum keys, including: The quantum keys received from the QKD device are stored in a secure memory. In response to a key request from a service subsystem, an unused quantum key is retrieved from the secure memory and distributed to the service subsystem. When the number of stored quantum keys is lower than a preset first threshold, or when the stored quantum keys reach a preset expiration date, the corresponding QKD device is triggered to generate new quantum keys for supplementary storage. After the quantum key has been used up by the corresponding business subsystem, or after the quantum key has exceeded its preset validity period, the quantum key will be deleted from the secure storage.
[0081] Optionally, the secure storage is a hardware security module (HSM); the quantum key is stored in the hardware security module (HSM) in encrypted form, and can only be read from the hardware security module (HSM) for distribution after the key management service has been authenticated.
[0082] Optionally, the business subsystems in the service layer include a trusted service support business subsystem, a cryptographic token transmission business subsystem, an identity credential query business subsystem, an operation management business subsystem, and a trusted authorization business subsystem.
[0083] Optionally, it also includes a dynamic encryption policy execution step, including: The system monitors the number of available quantum keys in the key management service at each service node in real time and determines the security level required for the current communication to be initiated. If the number of available quantum keys meets the preset requirements of the current communication and the security level is high, then the process jumps to the step where the first business subsystem requests a quantum key from the local corresponding key management service to use the quantum key for encrypted communication.
[0084] Optionally, the dynamic encryption policy execution step further includes: If the number of available quantum keys does not meet the preset requirements of the current communication or the security level is not high, then switch to using a preset traditional cryptographic algorithm for secure communication.
[0085] Optionally, the conventional cryptographic algorithm includes at least one of the SM2 algorithm, RSA algorithm, and SM4 algorithm.
[0086] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.
[0087] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.
[0088] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program. When executed by a processor, the computer program causes the processor to perform the following steps: A QKD network layer is constructed among multiple service nodes of a trusted communication system, wherein each QKD device in the QKD network layer is connected through a quantum channel for negotiating and generating quantum keys; A key management service is deployed on each of the service nodes to build a QKD key management layer, wherein the key management service is configured to obtain and manage the quantum keys from the corresponding QKD device; A service layer is deployed on top of the QKD key management layer, and the service layer includes multiple business subsystems; When the first business subsystem needs to communicate with the second business subsystem, the first business subsystem requests a quantum key from the corresponding local key management service. In response to the request, the key management service distributes the quantum key to the first business subsystem; The first service subsystem uses the quantum key to encrypt the communication data and sends the encrypted data to the second service subsystem; The second business subsystem obtains the same quantum key through the corresponding local key management service and decrypts the received encrypted data.
[0089] Optionally, constructing a QKD network layer among multiple service nodes of the trusted communication system includes: Configure at least one QKD device for each of the service nodes; An independent quantum channel is established between the QKD devices corresponding to every two service nodes that need to communicate directly in a quantum-secure manner to form a QKD link; A QKD network is a mesh topology consisting of all established QKD links.
[0090] Optionally, the key management service is used for full lifecycle management of quantum keys, including: The quantum keys received from the QKD device are stored in a secure memory. In response to a key request from a service subsystem, an unused quantum key is retrieved from the secure memory and distributed to the service subsystem. When the number of stored quantum keys is lower than a preset first threshold, or when the stored quantum keys reach a preset expiration date, the corresponding QKD device is triggered to generate new quantum keys for supplementary storage. After the quantum key has been used up by the corresponding business subsystem, or after the quantum key has exceeded its preset validity period, the quantum key will be deleted from the secure storage.
[0091] Optionally, the secure storage is a hardware security module (HSM); the quantum key is stored in the hardware security module (HSM) in encrypted form, and can only be read from the hardware security module (HSM) for distribution after the key management service has been authenticated.
[0092] Optionally, the business subsystems in the service layer include a trusted service support business subsystem, a cryptographic token transmission business subsystem, an identity credential query business subsystem, an operation management business subsystem, and a trusted authorization business subsystem.
[0093] Optionally, it also includes a dynamic encryption policy execution step, including: The system monitors the number of available quantum keys in the key management service at each service node in real time and determines the security level required for the current communication to be initiated. If the number of available quantum keys meets the preset requirements of the current communication and the security level is high, then the process jumps to the step where the first business subsystem requests a quantum key from the local corresponding key management service to use the quantum key for encrypted communication.
[0094] Optionally, the dynamic encryption policy execution step further includes: If the number of available quantum keys does not meet the preset requirements of the current communication or the security level is not high, then switch to using a preset traditional cryptographic algorithm for secure communication.
[0095] Optionally, the conventional cryptographic algorithm includes at least one of the SM2 algorithm, RSA algorithm, and SM4 algorithm.
[0096] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.
[0097] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.
[0098] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.
[0099] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.
[0100] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.
[0101] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0102] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Since these modifications and variations fall within the scope of the claims and their equivalents, this invention also intends to include these modifications and variations.
[0103] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A trusted communication method based on QKD, characterized in that, include: A QKD network layer is constructed among multiple service nodes of a trusted communication system, wherein each QKD device in the QKD network layer is connected through a quantum channel for negotiating and generating quantum keys; A key management service is deployed on each of the service nodes to build a QKD key management layer, wherein the key management service is configured to obtain and manage the quantum keys from the corresponding QKD device; A service layer is deployed on top of the QKD key management layer, and the service layer includes multiple business subsystems; When the first business subsystem needs to communicate with the second business subsystem, the first business subsystem requests a quantum key from the corresponding local key management service. In response to the request, the key management service distributes the quantum key to the first business subsystem; The first service subsystem uses the quantum key to encrypt the communication data and sends the encrypted data to the second service subsystem; The second business subsystem obtains the same quantum key through the corresponding local key management service and decrypts the received encrypted data.
2. The trusted communication method based on QKD according to claim 1, characterized in that, The construction of a QKD network layer among multiple service nodes in a trusted communication system includes: Configure at least one QKD device for each of the service nodes; An independent quantum channel is established between the QKD devices corresponding to every two service nodes that need to communicate directly in a quantum-secure manner to form a QKD link; A QKD network is a mesh topology consisting of all established QKD links.
3. The trusted communication method based on QKD according to claim 1, characterized in that, The key management service is used for full lifecycle management of quantum keys, including: The quantum keys received from the QKD device are stored in a secure memory. In response to a key request from a service subsystem, an unused quantum key is retrieved from the secure memory and distributed to the service subsystem. When the number of stored quantum keys is lower than a preset first threshold, or when the stored quantum keys reach a preset expiration date, the corresponding QKD device is triggered to generate new quantum keys for supplementary storage. After the quantum key has been used up by the corresponding business subsystem, or after the quantum key has exceeded its preset validity period, the quantum key will be deleted from the secure storage.
4. The trusted communication method based on QKD according to claim 3, characterized in that, The secure storage is a hardware security module (HSM); the quantum key is stored in the hardware security module (HSM) in encrypted form, and can only be read from the hardware security module (HSM) for distribution after the key management service has been authenticated.
5. The trusted communication method based on QKD according to claim 1, characterized in that, The service layer includes a trusted service support service subsystem, a cryptographic token transmission service subsystem, an identity credential query service subsystem, an operation management service subsystem, and a trusted authorization service subsystem.
6. The trusted communication method based on QKD according to claim 1, characterized in that, It also includes the dynamic encryption policy execution steps, including: The system monitors the number of available quantum keys in the key management service at each service node in real time and determines the security level required for the current communication to be initiated. If the number of available quantum keys meets the preset requirements of the current communication and the security level is high, then the process jumps to the step where the first business subsystem requests a quantum key from the local corresponding key management service to use the quantum key for encrypted communication.
7. The trusted communication method based on QKD according to claim 6, characterized in that, The dynamic encryption policy execution steps also include: If the number of available quantum keys does not meet the preset requirements of the current communication or the security level is not high, then switch to using a preset traditional cryptographic algorithm for secure communication.
8. The trusted communication method based on QKD according to claim 7, characterized in that, The traditional cryptographic algorithms include at least one of the SM2 algorithm, RSA algorithm, and SM4 algorithm.
9. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-8.
10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the method as described in any one of claims 1-8.