Quantum key distribution system and method for on-demand adaptation of output quantum keys
By using the key expansion and rate adaptation module in the quantum key distribution system, the key output can be monitored and dynamically adjusted in real time, which solves the problem of unstable key generation in the space-to-ground QKD network, realizes flexible key output to adapt to different needs, and improves the efficiency of network applications.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CAS QUANTUM NETWORK CO LTD
- Filing Date
- 2024-12-23
- Publication Date
- 2026-06-23
AI Technical Summary
Existing quantum key distribution systems exhibit unstable key generation and output in space-to-ground QKD networks, failing to meet the demands of varying rates or changes in the amount of key output per cycle. This impacts network application efficiency, and the current methods are limited and cannot adapt to diverse network environments.
Design a quantum key distribution system, including a quantum key distribution network and a terminal. Through a key expansion and rate adaptation module, the system can monitor key output in real time, dynamically adjust the rate, support push and request modes, and flexibly adapt to different key requirements.
It achieves end-to-end key requirements in various scenarios while maintaining a balanced key security level, ensuring the stability of network production and consumption, adapting to different rates and key quantity changes, and improving network application efficiency.
Smart Images
Figure CN122268573A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of quantum communication, and more specifically to a quantum key distribution system and method for on-demand adaptation of quantum key output, which allows for the automatic adaptation of quantum key provision to demand in quantum secure communication networks (especially satellite-to-ground quantum secure communication networks). Background Technology
[0002] Quantum key distribution (QKD) uses quantum systems to prepare, transmit, receive, and purify information to obtain a secure symmetric key that cannot be stolen in physical terms. This process ensures that the keys obtained by the two communicating parties are completely identical, and no third party can obtain any information about the key.
[0003] Quantum key distribution (QKD) can transmit quantum optical signals using fiber optic channels and free-space (atmospheric) channels. The transceiver system of fiber optic QKD maintains a stable connection for extended periods, resulting in continuous and stable key output characteristics. Therefore, in fiber optic QKD systems, point-to-point QKD is generally continuous, while end-to-end key relay is triggered by the key pool storage capacity of user nodes. Once the key pool falls below a certain threshold, one end of the QKD relays the key hop-by-hop to the other end according to a pre-configured key route, replenishing the key pool. Currently, a mature method for free-space QKD utilizes satellite-to-ground docking for both QKD and key relay. However, because quantum satellites typically operate in low Earth orbit (below 1000 km), communication is only possible when they are within the line of sight of the ground station. Furthermore, the satellite-to-ground distance constantly changes during communication, leading to unstable channel attenuation. Factors such as weather, environmental obstructions, and visibility time also need to be considered, resulting in intermittent and unstable key output characteristics in satellite-to-ground QKD. Currently, my country has launched the "Micius" quantum science experimental satellite and the "Jinan-1" quantum micro-nano satellite, and has successfully carried out satellite-to-ground quantum key distribution and quantum key relay missions.
[0004] Currently, when satellite-to-ground quantum key distribution is used to achieve quantum key distribution between satellites and ground stations, and symmetric quantum key distribution is used between ground stations via key relay tasks, these keys can be provided to cryptographic applications at different ground station locations for secure communication via offline export / import or online interface integration. The offline method involves exporting a specified amount of keys from the ground station equipment at once and then importing them into the cryptographic application. The online method involves the cryptographic application connecting to the ground station equipment and obtaining a certain amount of keys at a specified rate and quantity through an online interface; if the key quantity is insufficient, the application returns a failure message.
[0005] Currently, some QKD networks, especially satellite-to-ground QKD networks, are limited by construction or interconnection conditions. For example, in satellite-to-ground QKD networks, the generation of quantum keys and its efficiency are affected by weather, cloud cover, and orbital conditions, limiting interconnection opportunities. Furthermore, the key generation efficiency is significantly lower than that of fiber optic quantum communication due to weather, cloud cover, and orbital conditions. The amount of inter-station keys generated after satellite-to-ground interconnection and relay tasks is limited. While meeting security requirements for direct output, this is insufficient to guarantee a stable key output for joint networking with other QKD networks, and sometimes even fails to meet the key output requirements for inter-station cryptographic applications, severely impacting current networking and application scenarios. Current methods generally require accumulating a certain amount of keys before further application, significantly affecting network application efficiency. In addition, existing QKD key output to network distribution devices (including key management and network distribution capabilities) currently primarily involves actively pushing a specified amount of keys each time, a relatively simple method that cannot adapt to different speeds or changes in the amount of keys output per instance. Summary of the Invention
[0006] To address the aforementioned problems in existing technologies, this invention proposes a quantum key distribution system and method for on-demand adaptive output of quantum keys. This system allows for on-demand expansion of the original quantum key, thereby meeting end-to-end key requirements in various scenarios while maintaining a balanced key security level. Simultaneously, by monitoring key output in real time and comprehensively considering the imbalance between key output and key rate requirements, the system dynamically adjusts the key output rate to ensure the stability of key network production and consumption. Furthermore, this invention supports both proactive push methods for single-quantity key delivery to network distribution devices and request modes where network distribution devices request keys in specified single-quantity increments, enabling more flexible key output to network distribution devices.
[0007] Specifically, a first aspect of the present invention relates to a quantum key distribution system for on-demand adaptive output of quantum keys, comprising a quantum key distribution network and multiple quantum key distribution terminals;
[0008] The quantum key distribution network is configured to generate quantum key data based on a quantum key distribution protocol;
[0009] The quantum key distribution terminal includes a network distribution device, a key expansion and rate adaptation module, and a key seed library;
[0010] The network distribution device is configured to send key requests to the key expansion and rate adaptation module to obtain quantum keys, and to output quantum keys externally, wherein the key requests include key level, key request quantity and / or key request rate;
[0011] The key expansion and rate adaptation module is configured to acquire quantum key data from the quantum key distribution network and store it in a key seed library; and, based on the quantum key data, generate a quantum key adapted to the key requirements and output it to the network distribution device.
[0012] Furthermore, the quantum key distribution network includes a satellite-to-ground quantum key distribution network, a terrestrial fiber optic quantum key distribution network, or a combination of both.
[0013] Furthermore, the key level is used to instruct the key expansion and rate adaptation module to directly use the quantum key data as a quantum key, or to use the quantum key data as a seed to generate a quantum key through expansion operations;
[0014] The key requirement is used to indicate the number of quantum keys that the key expansion and rate adaptation module outputs to the network distribution device.
[0015] The key demand rate is used to indicate the average rate at which the key expansion and rate adaptation module outputs quantum keys to the network distribution device.
[0016] Furthermore, the key expansion and rate adaptation module is configured to determine the expansion factor used for expansion operations based on the key demand.
[0017] Furthermore, the key expansion and rate adaptation module is configured to detect whether the key requirements can be met based on the quantity of quantum key data in the key seed library, the key demand, and the key level.
[0018] Furthermore, the key requirement also includes an output mode parameter, which instructs the key expansion and rate adaptation module to output the quantum key to the network distribution device in push mode or request mode.
[0019] In the push mode, the key expansion and rate adaptation module outputs a preset number of quantum keys to the network distribution device at one time.
[0020] In the request mode, the key expansion and rate adaptation module outputs the quantum key to the network distribution device based on the key requirement.
[0021] Furthermore, the quantum key distribution terminal also includes an offline quantum key output interface and an online quantum key output interface.
[0022] A second aspect of the present invention relates to a quantum key distribution method for on-demand adaptive output of quantum keys, comprising a key data acquisition step, a key request step, and a key adaptation output step.
[0023] In the key data acquisition step, the key expansion and rate adaptation module acquires quantum key data from the quantum key distribution network and stores it in the key seed library;
[0024] In the key request step, the network distribution device sends a key request to the key expansion and rate adaptation module;
[0025] In the key adaptation output step, the key expansion and rate adaptation module outputs a quantum key according to the key requirements, using quantum key data adapted to the key requirements.
[0026] The key requirements include key level, key requirement quantity and / or key requirement rate.
[0027] The quantum key distribution method of the present invention can be implemented using the quantum key distribution system described above. Attached Figure Description
[0028] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.
[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0030] Figure 1 A preferred example of the quantum key distribution system of the present invention for on-demand adaptive output of quantum keys is illustrated schematically;
[0031] Figure 2 A preferred example of online quantum key output in the quantum key distribution method for on-demand adaptive output of quantum keys according to the present invention is illustrated;
[0032] Figure 3 A preferred example of the push mode in the quantum key distribution system and method for on-demand adaptive output of quantum keys of the present invention is illustrated schematically;
[0033] Figure 4 A preferred example of the request mode in the quantum key distribution system and method for on-demand adaptation of quantum key output according to the present invention is illustrated. Detailed Implementation
[0034] In the following description, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. The following embodiments are provided by way of example in order to fully convey the spirit of the invention to those skilled in the art. Therefore, the invention is not limited to the embodiments disclosed herein.
[0035] Figure 1 A preferred example of the quantum key distribution system of the present invention for on-demand adaptation of quantum key output is illustrated.
[0036] like Figure 1 As shown, the quantum key distribution system of the present invention may include a quantum key distribution (QKD) network and multiple quantum key distribution terminals.
[0037] Quantum key distribution networks can generate quantum key data based on quantum key distribution protocols (such as the BB84 protocol).
[0038] In this invention, the quantum key distribution network can be a satellite-to-ground quantum key distribution network, a terrestrial fiber optic quantum key distribution network, or a combination of both.
[0039] A quantum key distribution terminal is connected to a quantum key distribution network and can obtain quantum key data from the network. It can then use the obtained quantum key data to generate and output quantum keys in a way that is adapted to the key requirements of applications such as cryptography.
[0040] like Figure 1 As shown, a quantum key distribution terminal may include a network distribution device, a key expansion and rate adaptation module (QKB), and a key seed library.
[0041] As the upper-layer key management layer, the network distribution device can send key requests to the key expansion and rate adaptation module to obtain quantum keys, and perform network distribution of quantum keys and provide symmetric quantum keys for cryptographic applications.
[0042] The key expansion and rate adaptation module can synchronously acquire quantum key data from the quantum key distribution network and store it in the key seed library.
[0043] When the key expansion and rate adaptation module receives a key request from the network distribution device, it can generate a quantum key that matches the key request by using the quantum key data in the key seed library, and then output it to the network distribution device.
[0044] In this invention, key requirements may include key level, key requirement quantity, and key requirement rate.
[0045] The quantum key data in the key seed library can be used flexibly. By default, all quantum key data can be used as seeds for subsequent expansion operations to generate quantum keys, thereby reducing the demand for quantum key data (i.e., QKD network). Alternatively, it can be used directly as a quantum key without expansion operations in specific high-security scenarios.
[0046] Therefore, when submitting a key request, the key level indicates the security level of the quantum key required by the network distribution device. Based on this security level, the key expansion and rate adaptation module determines whether to directly use the quantum key data as the quantum key or to use the quantum key data as a seed to generate the quantum key when generating the quantum key using the quantum key data in the key seed library.
[0047] For example, when the key level indicates that the network distribution device requires a high-security quantum key, the key expansion and rate adaptation module does not perform expansion operations when generating a quantum key using the quantum key data, and directly uses the quantum key data as the quantum key.
[0048] When the key level does not indicate that the network distribution device requires a high-security quantum key, the key expansion and rate adaptation module, when generating a quantum key using the quantum key data, defaults to using the quantum key data as a seed and generates the quantum key through expansion operations. To ensure the continuous effectiveness of key supply, a seed is discarded after being expanded to a specified multiple (determined as needed and not exceeding a preset limit), and then the next seed is used for expansion. Those skilled in the art will understand that during the expansion process, it is necessary to maintain data consistency at both ends (i.e., the two quantum key distribution terminals) and synchronously provide the key upwards.
[0049] As a preferred example, QKB can utilize the PRNG algorithm of the national cryptographic standard SM3 to implement extended computation of quantum key data.
[0050] In this invention, the key demand quantity indicates the number of quantum keys the network distribution device expects to acquire, that is, the number of quantum keys output by the key expansion and rate adaptation module to the network distribution device. The key demand rate indicates the average rate at which the key expansion and rate adaptation module outputs quantum keys to the network distribution device.
[0051] For offline quantum key output interfaces, upper-layer network distribution devices can directly request the corresponding number of quantum keys from QKB in one go. If there is a specific high-level requirement, QKB can determine whether the amount of currently available quantum key data (i.e., the original quantum key) is sufficient to meet the key requirement. If it is sufficient, the quantum key can be exported to the secure medium; otherwise, it will report that the key quantity is insufficient. If there is no high-level requirement, the required expansion factor can be calculated based on the key requirement, and the generated key can be exported to the secure medium.
[0052] For online quantum key output interfaces Figure 2 A preferred example of online quantum key output is shown.
[0053] like Figure 2As shown, after receiving and parsing the key requests from the upper layer, the QKB can perform necessary key expansion and rate adaptation based on the key requirements (e.g., key quantity and key rate). If the upper layer requests a specific high-level requirement, the quantum key data (i.e., the original quantum key) can be used directly instead of the quantum key obtained through expansion operations, and the quantity of existing quantum key data can be checked to see if it meets the key quantity requirement. Otherwise, under normal circumstances, the QKB can expand the key by a certain factor based on the key quantity and key rate requirement and obtain a corresponding seed key for key expansion. After expansion, the seed key is output to the quantum key distribution device. A seed key will continue to expand until it reaches the corresponding key expansion factor, at which point it is discarded, and a new seed key is obtained for expansion. Considering actual operation, the QKB will calculate the average output rate during the quantum key output process. If the rate exceeds the key requirement rate, rate control will be used to prevent excessive key consumption; if the rate is lower than the requirement rate, the speed will be appropriately increased to meet the key requirement.
[0054] As a preferred example, the key supply rate can be achieved by adjusting the response speed of a single quantum key supply.
[0055] Upper-layer network distribution devices generally have two types of key requirements: one is to propose a key quantity requirement within a certain period of time, and the other is to propose a key output rate requirement within a certain period of time.
[0056] For example, if a network distribution device requests a key rate of 128 bps for one day, the key requirement for that day would be 128 * 60 * 60 * 24 = 10800 kb (where 1 kb = 1024 b). If each seed is 8 kb, the total expansion would need to be 1350 times. Since the expansion limit for a single seed is 1000 times, at least two seeds are needed, with an expansion factor of 700. During the actual output process, the average output rate is monitored periodically to adjust the output rate accordingly. If the agreed-upon required rate is exceeded, the output rate is reduced; otherwise, the output rate needs to be increased.
[0057] To better provide the service of outputting quantum keys, QKB can also provide two key output modes: push mode and request mode. In push mode, the key expansion and rate adaptation module outputs a preset number of quantum keys to the network distribution device at once; in request mode, the key expansion and rate adaptation module outputs quantum keys to the network distribution device based on key demand.
[0058] Therefore, the output mode parameter can also be configured in the key requirements to instruct the key expansion and rate adaptation module to output the quantum key to the network distribution device in push mode or request mode.
[0059] Figure 3The illustration schematically shows a preferred example of the push mode of the present invention, wherein when the network distribution device has insufficient quantum keys, it sends a KeyOn message to notify QKB to start key output. In response to the KeyOn notification, QKB continuously outputs quantum keys (KeySend) to the network distribution device until the number of quantum keys in the network distribution device is replenished. Then, the network distribution device sends a KeyOff message to QKB to stop outputting keys, as follows:
[0060] (1) When the number of quantum keys in the network distribution device of node A is lower than the threshold, prepare to trigger the push.
[0061] (2) The network distribution device of node A sends a KeyOn message to the network distribution device of node B;
[0062] (3) The network distribution device of node B forwards the KeyOn message to the local QKB;
[0063] (4) Node B responds to the KeyOn message in the QKB and sends a KeyOn response message to the local network distribution device;
[0064] (5) The network distribution device of node B sends a KeyOn response message to the network distribution device of node A;
[0065] (6) The network distribution device of node A sends a KeyOn message to the local QKB;
[0066] (7) Node A responds to the KeyOn message from the local network distribution device in response to the QKB;
[0067] (8) After QKB key negotiation, both ends actively push the same quantum key to the network distribution device and send a KeySend message;
[0068] (9) The network distribution device stores the received quantum key into its own key pool and sends the KeySend response message to the local QKB;
[0069] (10) When the number of quantum keys in the network distribution device of node A reaches the maximum threshold, stop quantum key production;
[0070] (11) The network distribution device of node A sends a KeyOff message to the network distribution device of node B;
[0071] (12) The network distribution device of node B sends a KeyOff message to the local QKB;
[0072] (13) Node B responds with a KeyOff message to the local network distribution device;
[0073] (14) The network distribution device of node B sends a KeyOff response message to the network distribution device of node A;
[0074] (15) The network distribution device of node A sends a KeyOff message to the local QKB;
[0075] (16) Node A sends a QKB response KeyOff message to the local network distribution device.
[0076] Figure 4 A preferred example of the request mode of the present invention is illustrated, wherein when the number of quantum keys held by the network distribution device is insufficient, the network distribution device actively and continuously sends key requesting requests to the QKB until the number of quantum keys held by the network distribution device reaches the maximum threshold, at which point it stops requesting keys, as follows:
[0077] (a) The network distribution device of node A actively initiates a key request.
[0078] (1) The number of quantum keys in the network distribution device of node A is lower than the threshold, and a KeyPrepare key query message is sent.
[0079] (2) If the QKB of node A contains a quantum key, it will respond with a KeyReady message;
[0080] (3) Node A's quantum key pool sends a key application message KeyApply;
[0081] (4) Node A responds to the KeyRelay message with the QKB and returns the quantum key;
[0082] (5) The QKB of node A simultaneously notifies the QKB of node B to push the same quantum key;
[0083] (6) The QKB of node B actively pushes the KeyRelay message to the network distribution device of node B.
[0084] (ii) The network distribution device of node B actively initiates a key request.
[0085] (1) The number of quantum keys in the network distribution device of node B is lower than the threshold, and a KeyPrepare key query message is sent.
[0086] (2) If the QKB of node B contains a quantum key, it will respond with a KeyReady message;
[0087] (3) The network distribution device of node B sends a key application message KeyApply;
[0088] (4) Node B responds to the KeyRelay message with the QKB and returns the quantum key;
[0089] (5) The QKB of node B simultaneously notifies the QKB of node A to push the same key;
[0090] (6) The QKB of node A actively pushes the KeyRelay message to the network distribution device of node A.
[0091] Based on the above, the quantum key distribution system of this invention addresses the problem that insufficient network key production in some scenarios prevents the normal establishment of end-to-end key links in many situations. It proposes on-demand expansion of the original quantum key, further meeting the end-to-end key requirements in various scenarios while balancing key security levels, even in the secure communication requirements of interconnecting satellite-to-ground quantum secure communication networks and fiber-optic quantum secure communication networks. Regarding the problem of the inability to control the key supply rate in existing technologies, this invention dynamically adjusts the key output rate by real-time monitoring of key output and considering the imbalance between key output and key rate requirements to ensure the stability of key network production and consumption. Furthermore, addressing the issue that existing network distribution devices generally only have a single output mode of actively pushing a specified amount of key each time, which cannot adapt to different rates or changes in the amount of key output per time, this invention supports two output modes: one for actively pushing a fixed amount of key to the network distribution device, and another for the network distribution device to request a specified amount of key per request. This allows for more flexible key output to the network distribution device.
[0092] Based on the aforementioned quantum key distribution system, this paper also proposes a quantum key distribution method for on-demand adaptation and output of quantum keys, which mainly includes a key data acquisition step, a key request step, and a key adaptation and output step.
[0093] In the key data acquisition step, the key expansion and rate adaptation module obtains quantum key data from the quantum key distribution network and stores it in the key seed library.
[0094] In the key request step, the network distribution device sends a key request to the key extension and rate adaptation module.
[0095] In the key adaptation output step, the key expansion and rate adaptation module outputs the quantum key according to the key requirements, using the quantum key data to adapt to the key requirements.
[0096] As can be seen from the above description of the quantum key distribution system, by configuring key requirements with at least one of the following parameters: key level, key requirement quantity, and key requirement rate, it is possible to adapt the output of quantum keys on demand, thereby meeting the end-to-end key requirements in various scenarios.
[0097] Although the present invention has been described above with reference to the accompanying drawings and specific embodiments, those skilled in the art will readily recognize that the above embodiments are merely exemplary and used to illustrate the principles of the present invention. They do not limit the scope of the present invention. Those skilled in the art can make various combinations, modifications and equivalent substitutions to the above embodiments without departing from the spirit and scope of the present invention.
Claims
1. A quantum key distribution system for on-demand adaptive output of quantum keys, comprising a quantum key distribution network and multiple quantum key distribution terminals; The quantum key distribution network is configured to generate quantum key data based on a quantum key distribution protocol; The quantum key distribution terminal includes a network distribution device, a key expansion and rate adaptation module, and a key seed library; The network distribution device is configured to send key requests to the key expansion and rate adaptation module to obtain quantum keys, and to output quantum keys externally. The key requirements include key level, key requirement quantity and / or key requirement rate; The key expansion and rate adaptation module is configured to acquire quantum key data from the quantum key distribution network and store it in a key seed library; and, based on the quantum key data, generate a quantum key adapted to the key requirements and output it to the network distribution device.
2. The quantum key distribution system as described in claim 1, wherein, The quantum key distribution network includes a satellite-to-ground quantum key distribution network, a terrestrial fiber optic quantum key distribution network, or a combination of both.
3. The quantum key distribution system as described in claim 1, wherein: The key level is used to indicate that the key expansion and rate adaptation module can directly use the quantum key data as a quantum key, or use the quantum key data as a seed to generate a quantum key through expansion operation; The key requirement is used to indicate the number of quantum keys that the key expansion and rate adaptation module outputs to the network distribution device. The key demand rate is used to indicate the average rate at which the key expansion and rate adaptation module outputs quantum keys to the network distribution device.
4. The quantum key distribution system as described in claim 3, wherein, The key expansion and rate adaptation module is configured to determine the expansion factor used for expansion operations based on the key demand.
5. The quantum key distribution system as described in claim 3, wherein, The key expansion and rate adaptation module is configured to detect whether the key requirements can be met based on the quantity of quantum key data in the key seed library, the key demand, and the key level.
6. The quantum key distribution system as described in claim 3, wherein, The key requirement also includes an output mode parameter, which instructs the key expansion and rate adaptation module to output the quantum key to the network distribution device in push mode or request mode.
7. The quantum key distribution system as described in claim 6, wherein, In the push mode, the key expansion and rate adaptation module outputs a preset number of quantum keys to the network distribution device at one time; In the request mode, the key expansion and rate adaptation module outputs the quantum key to the network distribution device based on the key requirement.
8. The quantum key distribution system as described in claim 1, wherein, The quantum key distribution terminal also includes an offline quantum key output interface and an online quantum key output interface.
9. A quantum key distribution method for on-demand adaptive output of quantum keys, comprising a key data acquisition step, a key request step, and a key adaptation output step; In the key data acquisition step, the key expansion and rate adaptation module acquires quantum key data from the quantum key distribution network and stores it in the key seed library; In the key request step, the network distribution device sends a key request to the key expansion and rate adaptation module; In the key adaptation output step, the key expansion and rate adaptation module outputs a quantum key according to the key requirements, using quantum key data adapted to the key requirements. in, The key requirements include key level, key requirement quantity and / or key requirement rate.
10. The quantum key distribution method of claim 9, implemented by means of the quantum key distribution system of any one of claims 1-8.