Ciphertext quantum key management and relay method and system

Abstract

This invention discloses a method and system for ciphertext quantum key management and relay. The method includes sending routing control information to relay nodes to relay quantum key ciphertext received from connected QKD devices to destination nodes according to the routing control information; sending first encryption information corresponding to each relay node on the relay path to the destination node, so that the destination node converts the XOR value of the quantum key ciphertext based on each of the first encryption information to obtain a first key ciphertext; the quantum key ciphertext is obtained by the QKD device encrypting its generated quantum key using a local key encryption key, the first encryption information carrying a first key encryption key that is the same as the key encryption key corresponding to each relay node, and the first key ciphertext being the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node; this invention can reduce the risk of quantum key leakage.

Description

Technical Field

[0001] This invention relates to the field of quantum secure communication technology, specifically to a method and system for managing and relaying encrypted quantum keys. Background Technology

[0002] In the field of quantum secure communication, key relay technology is currently the primary method used to achieve wide-area networking capabilities for quantum secure communication networks. This involves redistributing quantum keys using key relay to create a shared key over a wide area. Common key relay methods include key chain relay schemes and key XOR storage relay schemes. Key chain relay utilizes segmented encryption (such as one-time pad) to securely transfer keys between relay points. The basic principle is as follows: Figure 1 As shown; compared to key chain relay schemes, in key XOR storage relay schemes, the relay node only sends the XOR result of the shared key with the adjacent uplink and downlink nodes to the receiving end. The basic principle of key XOR storage relay is as follows: Figure 2 As shown, since the relay node does not directly process the session key between the sender and receiver, the risk of session key leakage at the relay node can be effectively reduced.

[0003] However, in related key relay technologies, the quantum key management device (Key Manager, KM) needs to manipulate the quantum key, such as the relay node performing an XOR operation on the plaintext of the uplink and downlink quantum keys. This means the relay node can access the plaintext of the quantum key, posing a security risk of leakage. Figure 3 As shown, the key encryption key (KEK) used for quantum key transmission between the KM and the quantum key distribution (QKD) module and the cryptographic application module (APP) is stored on the KM and used for quantum key encryption and decryption. That is, the KM can obtain the plaintext of the quantum key. The drawbacks of this method are: first, it poses a security risk to the quantum key; second, it poses a trust risk to the client regarding the quantum key. Summary of the Invention

[0004] The present invention aims to propose a scheme for encrypted quantum key management and relay, so that the quantum key remains fully encrypted during the key relay process of the KM device, thereby reducing the security risks of the quantum key.

[0005] The present invention solves the above-mentioned technical problems through the following technical means:

[0006] In a first aspect, the present invention proposes a method for encrypted quantum key management and relay, the method being applied to a QKD network controller, comprising:

[0007] Routing control information is sent to relay nodes so that the relay nodes relay the quantum key ciphertext received from the connected QKD device to the destination node in accordance with the method specified by the routing control information;

[0008] Send the first encrypted information corresponding to each relay node on the relay path to the destination node, so that the destination node can convert the XOR value of the quantum key ciphertext based on each of the first encrypted information to obtain the first key ciphertext;

[0009] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0010] Furthermore, the first encrypted information is the XOR value between the cryptographic streams corresponding to the first key encryption key.

[0011] Furthermore, the method also includes:

[0012] Send a second encrypted message to the destination node so that the destination node converts its first key ciphertext into a second key ciphertext based on the second encrypted message;

[0013] The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

[0014] Furthermore, the second encrypted information is the XOR value of the cryptographic stream corresponding to the second key encryption key and the cryptographic stream corresponding to the third key encryption key.

[0015] Furthermore, the method also includes:

[0016] Send a third encryption message to the initial node so that the initial node converts the quantum key ciphertext received from the connected QKD device into a third key ciphertext based on the third encryption message;

[0017] The third encryption information carries a fourth key encryption key and a fifth key encryption key. The fourth key encryption key is the same as the local key encryption key of the QKD device connected to the initial node. The fifth key encryption key is the same as the local key encryption key of the cryptographic application module connected to the initial node. The third key ciphertext is the ciphertext obtained by encrypting the shared key carried by the quantum key ciphertext received by the initial node with the fifth key encryption key.

[0018] Furthermore, the third encryption information is the XOR value of the cryptographic stream corresponding to the fourth key encryption key and the cryptographic stream corresponding to the fifth key encryption key.

[0019] Furthermore, before sending routing control information to the relay node, the method further includes:

[0020] A key encryption key that is the same as the local key encryption key of each QKD device and a key encryption key that is the same as the local key encryption key of the cryptographic application module are obtained through configuration or negotiation.

[0021] Furthermore, the method also includes:

[0022] Both the key encryption key that is the same as the local key encryption key of each QKD device and the key encryption key that is the same as the local key encryption key of the cryptographic application module are encrypted and stored.

[0023] Furthermore, the routing control information is used to instruct the relay node to perform hop-by-hop key relay, or to instruct the relay node to perform key XOR storage relay.

[0024] Furthermore, before sending routing control information to the relay node, the method further includes:

[0025] Receive topology information uploaded by each terminal node and generate a relay routing table based on the topology information, wherein the topology information includes the identifier of each terminal node and the quantum link status between each terminal node and one or more other terminal nodes;

[0026] The routing control information is generated based on the relay routing table.

[0027] Secondly, the present invention also proposes a method for ciphertext quantum key management and relaying, the method being applied to relay nodes, comprising:

[0028] Receive quantum key ciphertext sent by each connected QKD device, wherein the quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key;

[0029] Based on the routing control information issued by the QKD network controller, the XOR value of the quantum key ciphertext is relayed in accordance with the method specified in the routing control information.

[0030] Furthermore, the quantum key ciphertext sent by the QKD device is E(Kq, QK), where Kq is the local key encryption key of the QKD device, QK is the quantum key generated by the QKD device, and E(Kq, QK) represents the quantum key ciphertext obtained by encrypting QK with Kq.

[0031] Furthermore, the quantum key ciphertext E(Kq, QK) can be converted into f(Kq) is the cryptographic stream generated by the key encryption key Kq. This is an XOR operation.

[0032] Furthermore, the routing control information is used to instruct the relay node to perform hop-by-hop key relay, or to instruct the relay node to perform key XOR storage relay.

[0033] Furthermore, when the routing control information is used to instruct the relay node to perform hop-by-hop key relay, the routing control information issued by the QKD network controller relays the XOR value of the quantum key ciphertext according to the method specified in the routing control information, including:

[0034] The XOR value of the quantum key ciphertext received from the connected QKD device is directly transmitted or XORed again with the quantum key ciphertext received from the previous hop relay node and then transmitted to the next hop relay node or destination node specified by the routing control information.

[0035] Furthermore, when the routing control information is used to instruct the relay node to perform key XOR storage relay, the routing control information issued by the QKD network controller relays the XOR value of the quantum key ciphertext according to the method specified in the routing control information, including:

[0036] The XOR value between the quantum key ciphertexts received from the connected QKD device is directly transmitted to the destination node specified by the routing control information.

[0037] Thirdly, the present invention also proposes a method for ciphertext quantum key management and relay, the method being applied to a destination node, comprising:

[0038] Receive the first encrypted information corresponding to each relay node on the relay path issued by the QKD network controller;

[0039] The first key ciphertext is obtained by XORing the key ciphertext relayed to the destination node with each of the first encryption information and converting it with the quantum key ciphertext received from the connected QKD device.

[0040] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0041] Furthermore, when employing a hop-by-hop key relay method, before converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext, the method further includes:

[0042] The key ciphertext XOR result sent by the previous hop relay node is obtained by XORing the quantum key ciphertext received by the previous hop relay node from the connected QKD device with the quantum key ciphertext XORed from the previous hop relay node.

[0043] Furthermore, when using key XOR storage relay, before converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext, the method further includes:

[0044] Receive the first relay ciphertext directly sent by each relay node, wherein the first relay ciphertext is the XOR value between the quantum key ciphertexts received by each relay node from the QKD device it is connected to;

[0045] XOR each of the first relay ciphertexts to obtain the XOR result of the key ciphertext.

[0046] Further, the step of converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext includes:

[0047] The XOR result of the key ciphertext and the quantum key ciphertext received from the connected QKD device are converted into the XOR value of each cryptographic stream and the key to be shared. Each cryptographic stream is a cryptographic stream generated by the key encryption key stored locally on the corresponding QKD device.

[0048] The first key ciphertext is obtained by XORing the XOR values ​​of each cipher stream with the key to be shared and then XORing each of the first encrypted information.

[0049] Furthermore, the method also includes:

[0050] Receive the second encrypted information sent by the QKD network controller;

[0051] Based on the second encryption information, the first key ciphertext is converted into the second key ciphertext;

[0052] The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

[0053] Furthermore, the second encrypted information is the XOR value of the cryptographic stream corresponding to the second key encryption key and the cryptographic stream corresponding to the third key encryption key.

[0054] Furthermore, after obtaining the second key ciphertext, the method further includes:

[0055] The second key ciphertext is sent to the cryptographic application module connected to the destination node, so that the cryptographic application module can use its locally stored key encryption key to decrypt the second key ciphertext to obtain the key to be shared.

[0056] Fourthly, the present invention also proposes a QKD network controller, comprising:

[0057] The routing information delivery module is used to send routing control information to the relay node so that the relay node can relay the quantum key ciphertext received from the connected QKD device to the destination node in accordance with the routing control information.

[0058] The first encrypted information sending module is used to send the first encrypted information corresponding to each relay node on the relay path to the destination node, so that the destination node can convert the XOR value of the quantum key ciphertext based on each of the first encrypted information to obtain the first key ciphertext.

[0059] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0060] Fifthly, the present invention also proposes a relay node, comprising:

[0061] A quantum key ciphertext receiving module is used to receive quantum key ciphertext sent by each connected QKD device, wherein the quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key;

[0062] The relay module is used to relay the XOR value of the quantum key ciphertext according to the routing control information issued by the QKD network controller.

[0063] Sixthly, the present invention also proposes a target node, comprising:

[0064] The first encrypted information receiving module is used to receive the first encrypted information corresponding to each relay node on the relay path issued by the QKD network controller;

[0065] The first ciphertext conversion module is used to convert the XOR result of the key ciphertext relayed to the destination node and the quantum key ciphertext received from the connected QKD device based on each of the first encryption information to obtain the first key ciphertext.

[0066] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0067] Furthermore, the present invention also proposes a encrypted quantum key management and relay device, the device including a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method described in the first aspect above, or to implement the method described in the second aspect above, or to implement the method described in the third aspect above.

[0068] Furthermore, the present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is used to implement the method described in the first aspect above, or to implement the method described in the second aspect above, or to implement the method described in the third aspect above.

[0069] Furthermore, the present invention also proposes a ciphertext quantum key management and relay system, the system comprising a QKD network controller and terminal nodes and relay nodes connected to the QKD network controller;

[0070] The QKD network controller is used to perform the method described in the first aspect above;

[0071] The relay node is used to perform the method described in the second aspect above;

[0072] The terminal node is used to execute the method described in the third aspect above.

[0073] The advantages of this invention are:

[0074] In this invention, after the QKD device generates a quantum key, it encrypts the generated quantum key using a local encryption key to obtain the quantum key ciphertext, which is then provided to the relay node KM. KM then directly performs a key relay process based on the quantum key ciphertext according to the routing control information issued by QKDNC. QKDNC sends first encrypted information carrying the same key as the local encryption key of each relay node's QKD device to the destination node, allowing the destination node to reconstruct the required quantum key ciphertext. Since KM does not possess the quantum key encryption key in this scheme, it can be guaranteed that only the quantum key ciphertext exists in KM during the key relay process, and no plaintext quantum key will appear. While QKDNC can obtain the encryption key, it cannot obtain the quantum key ciphertext, and therefore cannot obtain the plaintext quantum key either. This separation of the encryption key and the quantum key ciphertext reduces the risk of quantum key leakage.

[0075] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0076] Figure 1 This is a schematic diagram of the key chain relay principle mentioned in the background section of this invention;

[0077] Figure 2 This is a schematic diagram of the key XOR storage relay principle mentioned in the background section of this invention;

[0078] Figure 3 This is a schematic diagram illustrating the principle of using an encryption key to encrypt a quantum key relay, as mentioned in the background section of this invention.

[0079] Figure 4 This is a schematic diagram of a quantum secure communication system architecture in one embodiment of the present invention;

[0080] Figure 5 This is a flowchart illustrating the first encrypted quantum key management and relay method proposed in an embodiment of the present invention;

[0081] Figure 6 This is a schematic diagram illustrating the principle of QKD uploading quantum keys to KM in one embodiment of the present invention;

[0082] Figure 7This is a schematic diagram illustrating the principle of key chain relay by KM in one embodiment of the present invention;

[0083] Figure 8 This is a schematic diagram illustrating the principle of KM performing key XOR storage relay in one embodiment of the present invention;

[0084] Figure 9 This is a schematic diagram illustrating the principle of KM outputting quantum key to APP in one embodiment of the present invention;

[0085] Figure 10 This is a flowchart illustrating the second encrypted quantum key management and relay method proposed in an embodiment of the present invention;

[0086] Figure 11 This is a flowchart illustrating the third encrypted quantum key management and relay method proposed in an embodiment of the present invention;

[0087] Figure 12 This is a flowchart illustrating the fourth encrypted quantum key management and relay method proposed in an embodiment of the present invention;

[0088] Figure 13 This is a schematic diagram of the structure of a QKD network controller according to an embodiment of the present invention;

[0089] Figure 14 This is a schematic diagram of the structure of a relay node according to an embodiment of the present invention;

[0090] Figure 15 This is a schematic diagram of the structure of a target node according to an embodiment of the present invention;

[0091] Figure 16 This is a schematic diagram of the structure of an initial node proposed in an embodiment of the present invention. Detailed Implementation

[0092] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0093] In existing quantum key relay technologies, the encryption key used for quantum key transmission is stored on the KM (Knowledge Machine) for encryption and decryption, which allows the KM to obtain the plaintext of the quantum key, posing a security risk of leakage. In this application embodiment, the encryption key is stored on the QKD (Quantum Key Digitization) device, the QKD network controller (QKDNC), and the cryptographic application module (APP), respectively. The KM does not possess the encryption key, and the quantum key remains encrypted throughout the key relay process, reducing the security risk of the quantum key. A possible quantum secure communication system architecture proposed in this application embodiment is as follows: Figure 4 As shown, the system includes a QKDNC and multiple terminal nodes connected to the QKDNC. QKD devices between any two adjacent terminal nodes are connected via a quantum optical link and a QKD negotiation link, and generate quantum keys by executing a specific QKD protocol. For a relay path determined by the QKDNC, the terminal node pair that outputs shared key data between upper-layer cryptographic application modules is designated as the initial node and the destination node, respectively, and each terminal node traversed by the initial node to reach the destination node is designated as a relay node.

[0094] The following detailed description of the workflow of each device in the quantum secure communication system, in conjunction with the accompanying drawings, will enable a full understanding of how the present invention uses technical means to solve technical problems and achieve technical effects, and will allow for its implementation.

[0095] Example 1

[0096] like Figure 5 As shown in the figure, this application proposes a method for encrypted quantum key management and relay, which is applied to a QKD network controller and specifically includes the following steps:

[0097] S11. Send routing control information to the relay node so that the relay node relays the quantum key ciphertext received from the connected QKD device to the destination node in accordance with the routing control information.

[0098] Specifically, in combination Figure 6 As shown, taking relay node KM2 as an example, relay node KM2 receives quantum key ciphertexts E(Kq2, QK1) and E(Kq3, QK2) from its connected QKD2 and QKD3, and XORs the ciphertexts E(Kq2, QK1) and E(Kq3, QK2) to form... The quantum key ciphertext E(Kq2, QK1) is obtained by encrypting the quantum key QK1 generated from QKD2 and QKD1 using the key encryption key Kq2 stored locally by QKD2. Similarly, the quantum key ciphertext E(Kq3, QK2) is obtained by encrypting the quantum key QK2 generated from QKD3 and QKD4 using the key encryption key Kq3 stored locally by QKD3. Likewise, the relay node KM3 receives the quantum key ciphertexts E(Kq4, QK2) and E(Kq5, QK3) from its connected QKD4 and QKD5, and forms...

[0099] The QKD network controller, or QKDNC, sends routing control information to relay nodes KM2 and KM3, so that relay nodes KM2 and KM3 use the XOR value of the quantum key ciphertext for the relay process according to the key relay method specified in the routing control information.

[0100] S12. Send the first encryption information corresponding to each relay node on the relay path to the destination node, so that the destination node can convert the XOR value of the quantum key ciphertext based on each of the first encryption information to obtain the first key ciphertext.

[0101] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0102] Specifically, the QKD network controller, i.e., QKDNC, sends the first encrypted information corresponding to each relay node on the relay path to the destination node. For example, the first encrypted information corresponding to relay node KM2 carries the same first key encryption keys Kq2 and Kq3 as the local key encryption keys of QKD2 and QKD3, and the first encrypted information corresponding to relay node KM3 carries the same first key encryption keys Kq4 and Kq5 as the local key encryption keys of QKD4 and QKD5. This allows the destination node to XOR the quantum key ciphertext relayed to the destination node using the first encrypted information corresponding to the relay node. and The first key ciphertext is obtained by XORing E(Kq6, QK3) received from QKD6 and encrypting the shared key QK1 using the local key encryption key Kq6 connected to the destination node KM4.

[0103] Furthermore, the routing control information is used to instruct the relay node to perform hop-by-hop key relay (i.e., key chain relay), or to instruct the relay node to perform key XOR storage relay.

[0104] Specifically, such as Figure 7 As shown, during hop-by-hop key relay, relay node KM2 XORs the quantum key ciphertext value. The message is sent to the next-hop relay node KM3 specified in the routing control information. Relay node KM3 will then receive the message from KM2. and After XORing, the data is sent to the destination node KM4; for example... Figure 8 As shown, during key XOR storage relay, relay node KM2 XORs the quantum key ciphertext value. The quantum key is sent directly to the destination node KM4, while the relay node KM3 XORs the quantum key ciphertext. Send directly to the destination node KM4.

[0105] As can be seen, in this embodiment, since KM does not possess the encryption key of the quantum key, it can be guaranteed that only the quantum key ciphertext exists in KM during the key relay process, and the quantum key plaintext will not appear. Although QKDNC can obtain the encryption key, it cannot obtain the quantum key ciphertext, so it cannot obtain the quantum key plaintext either, thereby reducing the risk of quantum key leakage.

[0106] As a further preferred technical solution, the first encrypted information is the XOR value between the cryptographic streams of the first key encryption key corresponding to the relay node.

[0107] Specifically, the first encrypted message sent by QKDNC to the destination node KM4 includes: and The destination node KM4 XORs the received first encrypted information with the quantum key ciphertext relayed to the destination node. and And the XOR operation performed on E(Kq6, QK3) received from QKD6 is as follows:

[0108]

[0109] Since the quantum key ciphertext E(Kq2, QK1) is obtained using a stream encryption algorithm, it can be converted into... Convert E(Kq3, QK2) to Convert E(Kq4, QK2) to Convert E(Kq5, QK3) to Convert E(Kq6, QK3) to Therefore, the following XOR operation is used:

[0110]

[0111] The first key ciphertext can be obtained at the destination node KM4.

[0112] It should be noted that, in this embodiment, when the QKD device uses the locally stored key encryption key to encrypt the quantum key it generates, it uses a stream encryption algorithm. That is, the quantum key ciphertext received by the relay node is obtained by encrypting it using the stream encryption algorithm. Therefore, the first encryption information sent by the QKDNC is the XOR value between the cryptographic streams corresponding to the first key encryption key, so that the destination node can use the first encryption information to decrypt the received quantum key ciphertext.

[0113] It should be understood that QKD devices can also use other encryption algorithms to encrypt the quantum key they generate to obtain quantum key ciphertext. In this case, the form of the first encrypted information sent by QKDNC should also be modified accordingly so that the destination node can use the first encrypted information to decrypt the quantum key ciphertext.

[0114] As a further preferred technical solution, the method further includes the following steps:

[0115] S13. Send a second encrypted message to the destination node so that the destination node converts its first key ciphertext into a second key ciphertext based on the second encrypted message;

[0116] The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

[0117] Specifically, the second encrypted message sent by QKDNC to the destination node carries a second encryption key Kq6 and a third encryption key Ka2. After receiving the second encrypted message, the destination node can use it to encrypt the first key ciphertext. It is converted into ciphertext of the second key obtained by encrypting the shared key using the third key encryption key.

[0118] As a further preferred technical solution, the second encryption information is the XOR value of the cryptographic stream corresponding to the second key encryption key and the cryptographic stream corresponding to the third key encryption key.

[0119] Specifically, in combination Figure 9As shown, taking the destination node KM4 as an example, the second encrypted information sent by QKDNC to the destination node KM4 is the XOR value between the cryptographic stream f(Kq6) of key Kq6 and the cryptographic stream f(Ka2) of key Ka2. The destination node KM4 will receive the second encrypted information and the first key ciphertext. Perform XOR operation Obtain the second key ciphertext

[0120] As a further preferred technical solution, the method further includes the following steps:

[0121] S14. Send a third encryption message to the initial node so that the initial node converts the quantum key ciphertext received from the connected QKD device into a third key ciphertext based on the third encryption message;

[0122] The third encryption information carries a fourth key encryption key and a fifth key encryption key. The fourth key encryption key is the same as the local key encryption key of the QKD device connected to the initial node. The fifth key encryption key is the same as the local key encryption key of the cryptographic application module connected to the initial node. The third key ciphertext is the ciphertext obtained by encrypting the shared key carried by the quantum key ciphertext received by the initial node with the fifth key encryption key.

[0123] Specifically, in combination Figure 9 As shown, taking the initial node KM1 as an example, QKDNC sends the third encryption information carrying the fourth key encryption key Kq1 and the fifth key encryption key Ka1 to the initial node. The initial node KM1 uses the third encryption information to convert the quantum key ciphertext received from QKD1 and E(Kq1, QK1) into the third key ciphertext that encrypts the shared key QK1 using the fifth key encryption key Ka1.

[0124] As a further preferred technical solution, the third encryption information is the XOR value of the cryptographic stream corresponding to the fourth key encryption key and the cryptographic stream corresponding to the fifth key encryption key.

[0125] Specifically, in combination Figure 9 As shown, taking the initial node KM1 as an example, the third encrypted information sent by QKDNC to the initial node KM1 is the XOR value between the cryptographic stream f(Kq1) of key Kq1 and the cryptographic stream f(Ka1) of key Ka1. The initial node KM1 performs an XOR operation on the received third encrypted information and the quantum key ciphertext E(Kq1, QK1). Obtain the third key ciphertext

[0126] As a further preferred technical solution, before step S11: sending routing control information to the relay node, the method further includes the following steps:

[0127] A key encryption key that is the same as the local key encryption key of each QKD device and a key encryption key that is the same as the local key encryption key of the cryptographic application module are obtained through configuration or negotiation.

[0128] Specifically, the first type of key Ka, such as Ka1 and Ka2, is used by the APP to encrypt the quantum key when obtaining it from the terminal node KM. These keys are stored on both the APP and the quantum key distribution network controller (QKDNC). Ka1 and Ka2 can be preset or generated through negotiation between the two parties. The second type of key Kq, such as Kq1, Kq2, Kq3, Kq4, Kq5, and Kq6, is used by the QKD device to encrypt the quantum key when uploading it to the KM. These keys are stored on both the QKD device and the QKDNC. Kq can be preset or generated through negotiation between the two parties.

[0129] It should be understood that in this embodiment, QKDNC can also obtain the first type of key or the second type of key online. This embodiment does not specifically limit the specific form in which QKDNC obtains the corresponding key encryption key.

[0130] As a further preferred technical solution, the method further includes the following steps:

[0131] Both the key encryption key that is the same as the local key encryption key of each QKD device and the key encryption key that is the same as the local key encryption key of the cryptographic application module are encrypted and stored.

[0132] It should be noted that in this embodiment, QKDNC encrypts and stores the first and second types of keys, which are pre-configured or generated by negotiation between the two parties, locally. This can improve the security of the keys and increase the key acquisition speed, thereby reducing the latency in responding to user requests for keys.

[0133] It should be noted that if the first or second type of key is invoked online, those skilled in the art can also encrypt the transmission of the first or second type of key to improve the transmission security of the key encryption key.

[0134] As a further preferred technical solution, before step S11: sending routing control information to the relay node, the method further includes the following steps:

[0135] Receive topology information uploaded by each terminal node and generate a relay routing table based on the topology information, wherein the topology information includes the identifier of each terminal node and the quantum link status between each terminal node and one or more other terminal nodes;

[0136] The routing control information is generated based on the relay routing table.

[0137] It should be noted that the process of QKDNC calculating the relay routing table is existing technology, and the detailed implementation process will not be elaborated here.

[0138] In summary, in this embodiment, the quantum key encryption key used by the APP and QKD is not stored on the KM, but on the QKDNC. Since the KM does not possess the quantum key encryption key, it can be guaranteed that only the quantum key ciphertext exists in the KM during key relay, and the quantum key plaintext will not appear. Although the QKDNC can obtain the key encryption key, it cannot obtain the quantum key ciphertext, so it cannot obtain the quantum key plaintext either. Therefore, this embodiment separates the key encryption key and the quantum key ciphertext and restricts the interaction between the KM and QKDNC to prevent the quantum key plaintext from being restored on the KM and QKDNC, thereby ensuring the security of the quantum key processing.

[0139] Example 2

[0140] like Figure 10 As shown, the second embodiment of this application proposes a ciphertext quantum key management and relay method, which is applied to a relay node and specifically includes the following steps:

[0141] S21. Receive quantum key ciphertext sent by each connected QKD device, wherein the quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key;

[0142] Specifically, the quantum key ciphertext sent by the QKD device is E(Kq, QK), where Kq is the local key encryption key of the QKD device, QK is the quantum key generated by the QKD device, and E(Kq, QK) represents the quantum key ciphertext obtained by encrypting QK using Kq. Figure 6 As shown, QKD1 connected to terminal node KM1 and QKD2 connected to terminal node KM2 are connected via a quantum optical link and a QKD negotiation link to generate a quantum key QK1. The quantum key QK1 is used as the key to be shared in this key relay. QKD3 connected to terminal node KM2 and QKD4 connected to terminal node KM3 are connected via a quantum optical link and a QKD negotiation link to generate a quantum key QK2. QKD5 connected to terminal node KM3 and QKD6 connected to terminal node KM4 are connected via a quantum optical link and a QKD negotiation link to generate a quantum key QK3. The encryption keys stored locally by QKD1, QKD2, QKD3, QKD4, QKD5, and QKD6 are Kq1, Kq2, Kq3, Kq4, Kq5, and Kq6, respectively.

[0143] Therefore, terminal node KM1 receives the quantum key ciphertext sent by QKD1 as E(Kq1, QK1), terminal node KM2 receives the quantum key ciphertext output by QKD2 as E(Kq2, QK1), terminal node KM2 receives the quantum key ciphertext output by QKD3 as E(Kq3, QK2), terminal node KM3 receives the quantum key ciphertext output by QKD4 as E(Kq4, QK2), terminal node KM3 receives the quantum key ciphertext output by QKD5 as E(Kq5, QK3), and terminal node KM4 receives the quantum key ciphertext output by QKD6 as E(Kq6, QK3).

[0144] S22. Based on the routing control information issued by the QKD network controller, the XOR value of the quantum key ciphertext is relayed in accordance with the method specified in the routing control information.

[0145] As a further preferred technical solution, the routing control information is used to instruct the relay node to perform hop-by-hop key relay, or to instruct the relay node to perform key XOR storage relay.

[0146] Specifically, when the routing control information is used to instruct the relay node to perform hop-by-hop key relay, step S22: based on the routing control information issued by the QKD network controller, relaying the XOR value of the quantum key ciphertext according to the method specified by the routing control information, specifically includes:

[0147] The XOR value of the quantum key ciphertext received from the connected QKD device is directly transmitted or XORed again with the quantum key ciphertext received from the previous hop relay node and then transmitted to the next hop relay node or destination node specified by the routing control information.

[0148] like Figure 7 As shown, during hop-by-hop key relay, relay node KM2 XORs the quantum key ciphertext value. The message is sent to the next-hop relay node KM3 specified in the routing control information. Relay node KM3 will then receive the message from KM2. and After XORing, the data is sent to the destination node KM4.

[0149] Specifically, when the routing control information is used to instruct the relay node to perform key XOR storage relay, step S22: based on the routing control information issued by the QKD network controller, relaying the XOR value of the quantum key ciphertext according to the method specified by the routing control information, specifically includes:

[0150] The XOR value between the quantum key ciphertexts received from the connected QKD device is directly transmitted to the destination node specified by the routing control information.

[0151] like Figure 8 As shown, during key XOR storage relay, relay node KM2 XORs the quantum key ciphertext value. The quantum key is sent directly to the destination node KM4, while the relay node KM3 XORs the quantum key ciphertext. Send directly to the destination node KM4.

[0152] As a further preferred technical solution, the quantum key ciphertext E(Kq, QK) sent by the QKD device is obtained through a stream encryption algorithm, where Kq is the local encryption key of the QKD device, QK is the quantum key generated by the QKD device, and E(Kq, QK) represents the quantum key ciphertext obtained by encrypting QK with Kq. Therefore, the quantum key ciphertext E(Kq, QK) can be converted into... f(Kq) is the cryptographic stream generated by the key encryption key Kq. This is an XOR operation.

[0153] It should be noted that the KM process for handling quantum keys includes three steps: receiving quantum keys from the QKD, performing quantum key relay, and providing quantum keys to the APP. All of these steps ensure that the quantum keys are in an encrypted state, without needing to decrypt them into plaintext for further processing. This guarantees the security of the entire quantum key management process by the KM.

[0154] Example 3

[0155] like Figure 11 As shown, the third embodiment of this application proposes a method for encrypted quantum key management and relay, which is applied to the destination node and specifically includes the following steps:

[0156] S31. Receive the first encrypted information corresponding to each relay node on the relay path sent by the QKD network controller;

[0157] S32. Based on each of the first encryption information, the XOR result of the key ciphertext relayed to the destination node and the quantum key ciphertext received from the connected QKD device are converted to obtain the first key ciphertext.

[0158] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0159] Specifically, in conjunction with the appendix Figure 8As shown, the first encrypted messages received by the destination node KM4 from the QKDNC carry keys Kq2, Kq3, Kq4, and Kq5, which are the same as the local encryption keys of the QKD devices at each relay node. The destination node KM4 XORs the keys carried in the received first encrypted messages with the quantum key ciphertext relayed to the destination node. and By performing an XOR operation on E(Kq6, QK3) received from QKD6, the first key ciphertext obtained by encrypting the shared key QK1 using the local key encryption key Kq6 of QKD6 connected to the destination node KM4 can be obtained.

[0160] As a further preferred technical solution, the step of converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext specifically includes:

[0161] The XOR result of the key ciphertext and the quantum key ciphertext received from the connected QKD device are converted into the XOR value of each cryptographic stream and the key to be shared. Each cryptographic stream is a cryptographic stream generated by the key encryption key stored locally on the corresponding QKD device.

[0162] The first key ciphertext is obtained by XORing the XOR values ​​of each cipher stream with the key to be shared and then XORing each of the first encrypted information.

[0163] It should be noted that since the quantum key ciphertext E(Kq2, QK1) is obtained using a stream encryption algorithm, the destination node KM4 can convert E(Kq2, QK1) into... Convert E(Kq3, QK2) to Convert E(Kq4, QK2) to Convert E(Kq5, QK3) to Convert E(Kq6, QK3) to Therefore, the following XOR operation is used:

[0164]

[0165] The first key ciphertext can be obtained at the destination node KM4.

[0166] As a further preferred technical solution, when using a hop-by-hop key relay method, before converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext, the method further includes the following steps:

[0167] The key ciphertext XOR result sent by the previous hop relay node is obtained by XORing the quantum key ciphertext received by the previous hop relay node from the connected QKD device with the quantum key ciphertext XORed from the previous hop relay node.

[0168] Specifically, such as Figure 7 As shown, the XOR result of the key ciphertext sent by the previous hop relay node KM3 to the destination node KM4 is:

[0169] As a further preferred technical solution, when using key XOR storage relay, before converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext, the method further includes the following steps:

[0170] Receive the first relay ciphertext directly sent by each relay node, wherein the first relay ciphertext is the XOR value between the quantum key ciphertexts received by each relay node from the QKD device it is connected to;

[0171] XOR each of the first relay ciphertexts to obtain the XOR result of the key ciphertext.

[0172] Specifically, such as Figure 8 As shown, the destination node KM4 receives the XOR value of the quantum key ciphertext sent by the relay node KM2. XOR value of the quantum key ciphertext sent by relay node KM3 And perform an XOR operation to obtain the XOR result of the key ciphertext:

[0173]

[0174] As a further preferred technical solution, the method further includes the following steps:

[0175] Receive the second encrypted information sent by the QKD network controller;

[0176] Based on the second encryption information, the first key ciphertext is converted into the second key ciphertext;

[0177] The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

[0178] As a further preferred technical solution, the second encryption information is the XOR value of the cryptographic stream corresponding to the second key encryption key and the cryptographic stream corresponding to the third key encryption key.

[0179] Specifically, the destination node has obtained the first key ciphertext about the key to be shared, QK1, during the key relay process. like Figure 9 As shown, when the destination node KM4 receives the second encryption information from QKDNC, which carries the second encryption key Kq6 and the third encryption key Ka2, it can use the second encryption information to convert the first key ciphertext into the second key ciphertext.

[0180] As a further preferred technical solution, after obtaining the second key ciphertext, the method further includes the following steps:

[0181] The second key ciphertext is sent to the cryptographic application module connected to the destination node, so that the cryptographic application module can use its locally stored key encryption key to decrypt the second key ciphertext to obtain the key to be shared.

[0182] It should be noted that, as Figure 9 As shown, the destination node will cipher the second key. The message is sent to APP2, which can then use its locally stored key to encrypt key Ka2 and ciphertext using the second key. Decryption yields the key to be shared, QK1.

[0183] Therefore, in this embodiment, the target node still receives the quantum key ciphertext instead of the quantum key plaintext. The quantum key plaintext will only appear after the APP obtains and decrypts the quantum key ciphertext, thereby reducing the risk of quantum key leakage.

[0184] Example 4

[0185] like Figure 12 As shown in the embodiments of this application, a method for ciphertext quantum key management and relay is also proposed. The method is applied to the initial node and specifically includes the following steps:

[0186] S41. Receive the third encrypted information sent by the QKD network controller;

[0187] S42. Based on the third encryption information, convert the quantum key ciphertext received from the connected QKD device into a third key ciphertext;

[0188] The third encryption information carries a fourth key encryption key and a fifth key encryption key. The fourth key encryption key is the same as the local key encryption key of the QKD device connected to the initial node. The fifth key encryption key is the same as the local key encryption key of the cryptographic application module connected to the initial node. The third key ciphertext is the ciphertext obtained by encrypting the shared key carried by the quantum key ciphertext received by the initial node with the fifth key encryption key.

[0189] Specifically, such as Figure 9 As shown, the initial node KM1 receives the third encryption information sent by QKDNC to the initial node, which carries the fourth key encryption key Kq1 and the fifth key encryption key Ka1. The initial node KM1 uses the third encryption information to convert the quantum key ciphertext E(Kq1, QK1) received from QKD1 into the third key ciphertext that encrypts the shared key QK1 using the fifth key encryption key Ka1.

[0190] As a further preferred technical solution, the third encryption information is the XOR value of the cryptographic stream corresponding to the fourth key encryption key and the cryptographic stream corresponding to the fifth key encryption key.

[0191] As described above, the initial node KM1 receives the third encrypted information sent by QKDNC as the XOR value between the cryptographic stream f(Kq1) of key Kq1 and the cryptographic stream f(Ka1) of key Ka1.

[0192] As a further preferred technical solution, step S42: converting the quantum key ciphertext received from the connected QKD device into third key ciphertext based on the third encryption information, specifically includes the following steps:

[0193] S421. Convert the quantum key ciphertext received from the connected QKD device into a fourth key ciphertext, wherein the fourth key ciphertext is the XOR value of the cryptographic stream corresponding to the local key encryption key of the QKD device and the key to be shared.

[0194] Specifically, the initial node KM1 converts the received quantum key ciphertext E(Kq1, QK1) into a fourth key ciphertext.

[0195] S422. Perform an XOR operation between the second encrypted information and the fourth key ciphertext to obtain the third key ciphertext.

[0196] Specifically, the initial node KM1 will receive the third encrypted information. With the fourth key ciphertext Perform XOR operation Obtain the third key ciphertext

[0197] As a further preferred technical solution, after obtaining the third key ciphertext, the method further includes the following steps:

[0198] The third key ciphertext is sent to the cryptographic application module connected to the initial node, so that the cryptographic application module can use its locally stored key encryption key to decrypt the third key ciphertext to obtain the key to be shared.

[0199] It should be noted that, as Figure 9 As shown, the initial node KM1 will cipher the third key. Once sent to APP1, APP1 can use its locally stored key to encrypt key Ka1 and ciphertext using the third key. Decryption yields the key to be shared, QK1.

[0200] Therefore, in this embodiment, the initial node still receives the quantum key ciphertext instead of the quantum key plaintext. The quantum key plaintext will only appear after the APP obtains and decrypts the quantum key ciphertext, thereby reducing the risk of quantum key leakage.

[0201] The following details the complete fully encrypted quantum key relay process proposed in this invention application using key chain relay and key XOR storage relay methods:

[0202] First, combine Figure 6 , Figure 7 and Figure 9 The key chain relay process proposed in the embodiments of this application is described as follows:

[0203] (1) The QKD device uses the locally stored key encryption key Kq to encrypt the generated quantum key QK, generating the quantum key ciphertext E(Kq, QK), and outputs the quantum key ciphertext to the corresponding terminal node KM.

[0204] The quantum key ciphertext output by QKD1 to terminal node KM1 is E(Kq1, QK1), the quantum key ciphertext output by QKD2 to terminal node KM2 is E(Kq2, QK1), the quantum key ciphertext output by QKD3 to terminal node KM2 is E(Kq3, QK2), the quantum key ciphertext output by QKD4 to terminal node KM3 is E(Kq4, QK2), the quantum key ciphertext output by QKD5 to terminal node KM3 is E(Kq5, QK3), and the quantum key ciphertext output by QKD6 to terminal node KM4 is E(Kq6, QK3).

[0205] (2) After the terminal node KM obtains the quantum key ciphertext, the relay node directly performs the key relay process based on the quantum key ciphertext according to the routing control information issued by QKDNC. The destination node needs to combine the first encryption information issued by QKDNC and convert all received quantum key ciphertexts into the first key ciphertext obtained by encrypting the shared key using the local key encryption key of the QKD device connected to the destination node through XOR operation.

[0206] Specifically, the QKDNC stores the same keys as the QKD device's local key encryption key, namely Kq1, Kq2, Kq3, Kq4, Kq5, and Kq6, as well as the same keys as the upper-layer cryptographic application module's local key encryption key, namely Ka1 and Ka2.

[0207] For example, relay node KM2, as needed, performs an XOR operation on the ciphertexts E(Kq2, QK1) and E(Kq3, QK2) to form... It is then sent to relay node KM3, which XORs the quantum key ciphertext. and The XOR operation yields the key ciphertext, which is then sent to the destination node KM4. Simultaneously, QKDNC sends the first encrypted information containing keys Kq2, Kq3, Kq4, and Kq5. The data is sent to the destination node KM4, which then XORs the quantum key ciphertext with the data. The quantum key ciphertext E(Kq6, QK3) and the first encryption information are used to obtain the first key ciphertext, which encrypts the shared key QK1 using the key encryption key Kq6.

[0208] (3) The initial node and the destination node directly output the quantum key ciphertext to the upper-layer cryptographic application module APP. At the same time, QKDNC provides encryption information, which carries the same key as the APP's local key encryption key and the same key as the QKD device connected to the terminal node's local key encryption key, which is used by the APP to decrypt and obtain the key to be shared.

[0209] Specifically, since the quantum key ciphertext received by the initial node KM1 is E(Kq1, QK1), when the initial node KM1 needs to output the quantum key ciphertext E(Kq1, QK1) to the upper-layer cryptographic application module APP1, QKDNC provides encryption information. This encryption information carries the keys Kq1 and Ka1, which are used to convert the quantum key ciphertext E(Kq1, QK1) into ciphertext that uses the key Ka1 to encrypt the key to be shared, QK1, and send it to APP1. APP1 uses its local key to encrypt the key Ka1 and decrypt it to obtain the key to be shared, QK1.

[0210] Since the destination node KM4 converts the XOR value of the received quantum key ciphertext into ciphertext of the shared key QK1 encrypted with the key encryption key Kq6, when the destination node KM4 needs to provide key data to the upper-layer cryptographic application module APP2, QKDNC provides encryption information. This encryption information carries the key Kq6 and Ka2, which is used to convert the ciphertext of the shared key QK1 encrypted with the key Kq6 into ciphertext of the shared key QK1 encrypted with the key Ka2 and send it to APP2. APP2 decrypts the ciphertext using the local key encryption key Ka2 to obtain the shared key QK1.

[0211] Secondly, combine Figure 6 , Figure 8 and Figure 9 The key XOR storage relay process proposed in the embodiments of this application is described as follows:

[0212] (1) The QKD device uses the locally stored key encryption key Kq to encrypt the generated quantum key QK, generating the quantum key ciphertext E(Kq, QK), and outputs the quantum key ciphertext to the corresponding terminal node KM.

[0213] (2) After the terminal node KM obtains the quantum key ciphertext, the relay node directly performs the key relay process based on the quantum key ciphertext according to the routing control information issued by QKDNC.

[0214] For example, relay node KM2, as needed, performs an XOR operation on the ciphertexts E(Kq2, QK1) and E(Kq3, QK2) to form... It is then sent directly to the destination node KM4. The relay node KM3 XORs the ciphertexts E(Kq4, QK2) and E(Kq5, QK3) to form... It is then sent directly to the destination node KM4, which receives the first encrypted message sent by QKDNC, carrying keys Kq2, Kq3, Kq4, and Kq5. The destination node KM4 combines the XOR value of the quantum key ciphertext. The quantum key ciphertext E(Kq6, QK3) and the first encryption information are used to obtain the first key ciphertext, which encrypts the shared key QK1 using the key encryption key Kq6.

[0215] (3) The initial node and the destination node directly output the quantum key ciphertext to the upper-layer cryptographic application module APP. At the same time, QKDNC provides encryption information, which carries the same key as the APP's local key encryption key and the same key as the QKD device connected to the terminal node's local key encryption key, which is used by the APP to decrypt and obtain the key to be shared.

[0216] As can be seen, in this scheme, since KM does not possess the encryption key of the quantum key, it can be guaranteed that only the quantum key ciphertext exists in KM during the key relay process, and the quantum key plaintext will not appear. Although QKDNC can obtain the encryption key, it cannot obtain the quantum key ciphertext, so it cannot obtain the quantum key plaintext either. The quantum key plaintext will only appear when the QKD device generates the quantum key, or after the APP obtains and decrypts the quantum key ciphertext, thereby reducing the risk of quantum key leakage.

[0217] Example 5

[0218] like Figure 13 As shown in the embodiments of this application, a QKD network controller is also proposed, comprising:

[0219] The routing information distribution module 11 is used to distribute routing control information to the relay node so that the relay node relays the quantum key ciphertext received from the connected QKD device to the destination node in accordance with the routing control information.

[0220] The first encryption information sending module 12 is used to send the first encryption information corresponding to each relay node on the relay path to the destination node, so that the destination node can convert the XOR value of the quantum key ciphertext based on each of the first encryption information to obtain the first key ciphertext.

[0221] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0222] As a further preferred technical solution, the routing control information is used to instruct the relay node to perform hop-by-hop key relay, or to instruct the relay node to perform key XOR storage relay.

[0223] As a further preferred technical solution, the first encrypted information is the XOR value between the cryptographic streams of the first key encryption key corresponding to the relay node.

[0224] As a further preferred technical solution, the QKD network controller also includes:

[0225] The second encrypted information delivery module is used to send second encrypted information to the destination node so that the destination node converts its first key ciphertext into second key ciphertext based on the second encrypted information.

[0226] The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

[0227] As a further preferred technical solution, the second encryption information is the XOR value of the cryptographic stream corresponding to the second key encryption key and the cryptographic stream corresponding to the third key encryption key.

[0228] As a further preferred technical solution, the QKD network controller also includes:

[0229] The third encryption information delivery module is used to send third encryption information to the initial node so that the initial node converts the quantum key ciphertext received from the connected QKD device into third key ciphertext based on the third encryption information.

[0230] The third encryption information carries a fourth key encryption key and a fifth key encryption key. The fourth key encryption key is the same as the local key encryption key of the QKD device connected to the initial node. The fifth key encryption key is the same as the local key encryption key of the cryptographic application module connected to the initial node. The third key ciphertext is the ciphertext obtained by encrypting the shared key carried by the quantum key ciphertext received by the initial node with the fifth key encryption key.

[0231] As a further preferred technical solution, the third encryption information is the XOR value of the cryptographic stream corresponding to the fourth key encryption key and the cryptographic stream corresponding to the fifth key encryption key.

[0232] As a further preferred technical solution, the QKD network controller also includes:

[0233] The key configuration or negotiation module is used to obtain, through configuration or negotiation, a key encryption key that is the same as the local key encryption key of each QKD device, and a key encryption key that is the same as the local key encryption key of the cryptographic application module.

[0234] As a further preferred technical solution, the QKD network controller also includes:

[0235] The key encryption storage module is used to encrypt and store the key encryption key that is the same as the local key encryption key of each QKD device and the key encryption key that is the same as the local key encryption key of the cryptographic application module.

[0236] As a further preferred technical solution, the QKD network controller also includes:

[0237] The information receiving module is used to receive topology information uploaded by each terminal node and generate a relay routing table based on the topology information. The topology information includes the identifier of each terminal node and the quantum link status between each terminal node and one or more other terminal nodes.

[0238] The routing control information generation module is used to generate the routing control information based on the relay routing table.

[0239] This embodiment controls relay nodes to perform key relaying based on quantum key ciphertext by setting a routing information distribution module in the QKD network controller. A first encryption information distribution module distributes the quantum key ciphertext-related keys to the destination node, enabling the destination node to convert the quantum key ciphertext received from the connected QKD device into a first key ciphertext encrypted with the local encryption key of the connected QKD device, based on the relayed quantum key ciphertext and the first encryption information. A second encryption information distribution module distributes second encryption information to the destination node, enabling the destination node to convert the first key ciphertext into a second key ciphertext encrypted with the same local encryption key as the cryptographic application module connected to the destination node, and output it to the cryptographic application module connected to the destination node. A third encryption information distribution module distributes third encryption information to the initial node, enabling the initial node to convert the quantum key ciphertext received from the connected QKD device into a third key ciphertext encrypted with the same local encryption key as the cryptographic application module connected to the initial node, and output it to the cryptographic application module connected to the initial node.

[0240] It can be seen that since KM does not possess the encryption key of the quantum key, it can ensure that only the quantum key ciphertext exists in KM during the key relay process, and the quantum key plaintext will not appear. Although QKDNC can obtain the encryption key, it cannot obtain the quantum key ciphertext, so it cannot obtain the quantum key plaintext either. The quantum key plaintext will only appear when the QKD device generates the quantum key, or after the APP obtains and decrypts the quantum key ciphertext, thus reducing the risk of quantum key leakage.

[0241] It should be noted that other embodiments or specific implementation methods of the QKD network controller described in this invention can refer to the above-described method embodiment one, and will not be repeated here.

[0242] Example 6

[0243] like Figure 14 As shown in the embodiment of this application, a relay node is proposed, including:

[0244] The quantum key ciphertext receiving module 21 is used to receive quantum key ciphertext sent by each connected QKD device, wherein the quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using the local key encryption key;

[0245] The relay module 22 is used to relay the XOR value of the quantum key ciphertext according to the routing control information issued by the QKD network controller.

[0246] As a further preferred technical solution, the routing control information is used to instruct the relay node to perform hop-by-hop key relay, or to instruct the relay node to perform key XOR storage relay.

[0247] As a further preferred technical solution, when the routing control information is used to instruct the relay node to perform hop-by-hop key relay, the relay module 22 is specifically used to directly transmit the XOR value of the quantum key ciphertext received from the connected QKD device, or to transmit it after XORing it again with the XOR value of the quantum key ciphertext received from the previous hop relay node, to the next hop relay node or destination node specified by the routing control information.

[0248] As a further preferred technical solution, when the routing control information is used to instruct the relay node to perform key XOR storage relay, the relay module 22 is specifically used to directly transmit the XOR value between the quantum key ciphertexts received from the connected QKD device to the destination node specified by the routing control information.

[0249] As a further preferred technical solution, the quantum key ciphertext E(Kq, QK) sent by the QKD device is obtained through a stream encryption algorithm, where Kq is the local encryption key of the QKD device, QK is the quantum key generated by the QKD device, and E(Kq, QK) represents the quantum key ciphertext obtained by encrypting QK with Kq. Therefore, the quantum key ciphertext E(Kq, QK) can be converted into... f(Kq) is the cryptographic stream generated by the key encryption key Kq. This is an XOR operation.

[0250] It should be noted that in this embodiment, KM does not possess the encryption key of the quantum key. During the key relay process, it can be guaranteed that KM only contains the quantum key ciphertext and will not contain the quantum key plaintext, thereby reducing the risk of quantum key leakage.

[0251] It should be noted that other embodiments or specific implementation methods of the relay node described in this invention can refer to the above-described method embodiment two, and will not be repeated here.

[0252] Example 7

[0253] like Figure 15 As shown in the embodiment of this application, a target node is proposed, including:

[0254] The first encrypted information receiving module 31 is used to receive the first encrypted information corresponding to each relay node on the relay path issued by the QKD network controller;

[0255] The first ciphertext conversion module 32 is used to convert the XOR result of the key ciphertext relayed to the destination node and the quantum key ciphertext received from the connected QKD device based on each of the first encryption information to obtain the first key ciphertext.

[0256] The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

[0257] As a further preferred technical solution, the first ciphertext conversion module 32 specifically includes:

[0258] The key ciphertext XOR conversion unit is used to convert the key ciphertext XOR result and the quantum key ciphertext received from the connected QKD device into the XOR value of each cryptographic stream and the key to be shared, wherein each cryptographic stream is a cryptographic stream generated by the key encryption key stored locally on the corresponding QKD device;

[0259] The first XOR operation unit is used to XOR the XOR value of each cryptographic stream and the key to be shared with each of the first encrypted information to obtain the first key ciphertext.

[0260] As a further preferred technical solution, the target node also includes:

[0261] The key ciphertext XOR result receiving module is used to receive the key ciphertext XOR result sent by the previous hop relay node. The key ciphertext XOR result is obtained by XORing the XOR value of the quantum key ciphertext received by the previous hop relay node from the connected QKD device with the XOR value of the quantum key ciphertext received from the previous hop relay node of the previous hop relay node.

[0262] As a further preferred technical solution, the target node also includes:

[0263] The relay ciphertext receiving module is used to receive the first relay ciphertext directly sent by each relay node. The first relay ciphertext is the XOR value between the quantum key ciphertexts received by each relay node from the QKD device it is connected to.

[0264] The key ciphertext XOR result calculation module is used to perform XOR processing on each of the first relay ciphertexts to obtain the key ciphertext XOR result.

[0265] As a further preferred technical solution, the target node also includes:

[0266] The second encrypted information receiving module is used to receive the second encrypted information sent by the QKD network controller.

[0267] The second key ciphertext conversion module is used to convert the first key ciphertext into the second key ciphertext based on the second encryption information;

[0268] The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

[0269] As a further preferred technical solution, the target node also includes:

[0270] The second key ciphertext sending module is used to send the second key ciphertext to the cryptographic application module connected to the destination node, so that the cryptographic application module can use its locally stored key encryption key to decrypt the second key ciphertext to obtain the key to be shared.

[0271] Therefore, in this embodiment, the target node still receives the quantum key ciphertext instead of the quantum key plaintext. The quantum key plaintext will only appear after the APP obtains and decrypts the quantum key ciphertext, thereby reducing the risk of quantum key leakage.

[0272] It should be noted that other embodiments or specific implementation methods of the target node described in this invention can refer to the above-described method embodiment three, and will not be repeated here.

[0273] Example 8

[0274] like Figure 16 As shown in the embodiments of this application, an initial node is also proposed, including:

[0275] The third encrypted information receiving module 41 is used to receive the third encrypted information sent by the QKD network controller;

[0276] The key-ciphertext conversion module 42 is used to convert the quantum key ciphertext received from the connected QKD device into a third key ciphertext based on the third encryption information.

[0277] The third encryption information carries a fourth key encryption key and a fifth key encryption key. The fourth key encryption key is the same as the local key encryption key of the QKD device connected to the initial node. The fifth key encryption key is the same as the local key encryption key of the cryptographic application module connected to the initial node. The third key ciphertext is the ciphertext obtained by encrypting the shared key carried by the quantum key ciphertext received by the initial node with the fifth key encryption key.

[0278] As a further preferred technical solution, the third encryption information is the XOR value of the cryptographic stream corresponding to the fourth key encryption key and the cryptographic stream corresponding to the fifth key encryption key.

[0279] As a further preferred technical solution, the key-ciphertext conversion module 42 specifically includes:

[0280] The fourth key-ciphertext conversion unit is used to convert the quantum key ciphertext received from the connected QKD device into a fourth key ciphertext, wherein the fourth key ciphertext is the XOR value of the cryptographic stream corresponding to the local key encryption key of the QKD device and the key to be shared.

[0281] The second XOR operation unit is used to perform an XOR operation between the second encrypted information and the fourth key ciphertext to obtain the third key ciphertext.

[0282] As a further preferred technical solution, the initial node also includes:

[0283] The third key ciphertext sending module is used to send the third key ciphertext to the cryptographic application module connected to the initial node, so that the cryptographic application module can use its locally stored key encryption key to decrypt the third key ciphertext to obtain the key to be shared.

[0284] Therefore, in this embodiment, the initial node still receives the quantum key ciphertext instead of the quantum key plaintext. The quantum key plaintext will only appear after the APP obtains and decrypts the quantum key ciphertext, thereby reducing the risk of quantum key leakage.

[0285] It should be noted that other embodiments or specific implementation methods of the initial node described in this invention can refer to the above-described method embodiment four, and will not be repeated here.

[0286] Furthermore, this application also proposes a encrypted quantum key management and relay device, the device including a memory and a processor; wherein, the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method described in Embodiment 1 above, or the method described in Embodiment 2 above, or the method described in Embodiment 3 above, or the method described in Embodiment 4 above.

[0287] Furthermore, this application also proposes a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is used to implement the method described in Embodiment 1 above, or to implement the method described in Embodiment 2 above, or to implement the method described in Embodiment 3 above, or to implement the method described in Embodiment 4 above.

[0288] Furthermore, embodiments of this application also propose a ciphertext quantum key management and relay system, the system including a QKD network controller and terminal nodes and relay nodes connected to the QKD network controller;

[0289] The QKD network controller is used to execute the method described in Embodiment 1 above;

[0290] The relay node is used to execute the method described in Embodiment 2 above;

[0291] The terminal node is used to execute the method described in Embodiment 3 above, or to execute the method described in Embodiment 4 above.

[0292] It should be noted that other embodiments or specific implementation methods of the encrypted quantum key management and relay device, storage medium and encrypted quantum key management and relay system described in this invention can refer to the above-mentioned method embodiments, and will not be repeated here.

[0293] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0294] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0295] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0296] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0297] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for ciphertext quantum key management and relay, characterized by, The method is applied to a QKD network controller and includes: Routing control information is sent to relay nodes so that the relay nodes relay the quantum key ciphertext received from the connected QKD device to the destination node in accordance with the method specified by the routing control information; Send the first encrypted information corresponding to each relay node on the relay path to the destination node, so that the destination node can convert the XOR value of the quantum key ciphertext based on each of the first encrypted information to obtain the first key ciphertext; The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

2. The ciphertext quantum key management and relay method of claim 1, wherein, The first encryption information is the XOR value between the cryptographic streams corresponding to the first key encryption key.

3. The ciphertext quantum key management and relay method of claim 1, wherein, The method further includes: Send a second encrypted message to the destination node so that the destination node converts its first key ciphertext into a second key ciphertext based on the second encrypted message; The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

4. The ciphertext quantum key management and relay method of claim 3, wherein, The second encrypted information is the XOR value of the cryptographic stream corresponding to the second key encryption key and the cryptographic stream corresponding to the third key encryption key.

5. The encrypted quantum key management and relay method as described in claim 1, characterized in that, The method further includes: Send a third encryption message to the initial node so that the initial node converts the quantum key ciphertext received from the connected QKD device into a third key ciphertext based on the third encryption message; The third encryption information carries a fourth key encryption key and a fifth key encryption key. The fourth key encryption key is the same as the local key encryption key of the QKD device connected to the initial node. The fifth key encryption key is the same as the local key encryption key of the cryptographic application module connected to the initial node. The third key ciphertext is the ciphertext obtained by encrypting the shared key carried by the quantum key ciphertext received by the initial node with the fifth key encryption key.

6. The encrypted quantum key management and relay method as described in claim 5, characterized in that, The third encryption information is the XOR value of the cryptographic stream corresponding to the fourth key encryption key and the cryptographic stream corresponding to the fifth key encryption key.

7. The encrypted quantum key management and relay method according to any one of claims 1-6, characterized in that, Before sending routing control information to the relay node, the method further includes: A key encryption key that is the same as the local key encryption key of each QKD device and a key encryption key that is the same as the local key encryption key of the cryptographic application module are obtained through configuration or negotiation.

8. The encrypted quantum key management and relay method as described in claim 7, characterized in that, The method further includes: Both the key encryption key that is the same as the local key encryption key of each QKD device and the key encryption key that is the same as the local key encryption key of the cryptographic application module are encrypted and stored.

9. The encrypted quantum key management and relay method according to any one of claims 1-6, characterized in that, The routing control information is used to instruct the relay node to perform hop-by-hop key relay, or to instruct the relay node to perform key XOR storage relay.

10. The encrypted quantum key management and relay method according to any one of claims 1-6, characterized in that, Before sending routing control information to the relay node, the method further includes: Receive topology information uploaded by each terminal node and generate a relay routing table based on the topology information, wherein the topology information includes the identifier of each terminal node and the quantum link status between each terminal node and one or more other terminal nodes; The routing control information is generated based on the relay routing table.

11. A method for ciphertext quantum key management and relay, characterized in that, The method is applied to relay nodes and includes: Receive quantum key ciphertext sent by each connected QKD device, wherein the quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key; Based on the routing control information issued by the QKD network controller, the XOR value of the quantum key ciphertext is relayed in accordance with the method specified in the routing control information.

12. The encrypted quantum key management and relay method as described in claim 11, characterized in that, The quantum key ciphertext sent by the QKD device is E(Kq,QK), where Kq is the local key encryption key of the QKD device, QK is the quantum key generated by the QKD device, and E(Kq,QK) represents the quantum key ciphertext obtained by encrypting QK with Kq.

13. The encrypted quantum key management and relay method as described in claim 12, characterized in that, The quantum key ciphertext E(Kq,QK) can be converted into f(Kq) is the cryptographic stream generated by the key encryption key Kq. This is an XOR operation.

14. The encrypted quantum key management and relay method as described in claim 11, characterized in that, The routing control information is used to instruct the relay node to perform hop-by-hop key relay, or to instruct the relay node to perform key XOR storage relay.

15. The encrypted quantum key management and relay method as described in claim 14, characterized in that, When the routing control information is used to instruct the relay node to perform hop-by-hop key relay, the routing control information issued by the QKD network controller relays the XOR value of the quantum key ciphertext according to the method specified in the routing control information, including: The XOR value of the quantum key ciphertext received from the connected QKD device is directly transmitted or XORed again with the quantum key ciphertext received from the previous hop relay node and then transmitted to the next hop relay node or destination node specified by the routing control information.

16. The encrypted quantum key management and relay method as described in claim 14, characterized in that, When the routing control information is used to instruct the relay node to perform key XOR storage relay, the routing control information issued by the QKD network controller relays the XOR value of the quantum key ciphertext according to the method specified in the routing control information, including: The XOR value between the quantum key ciphertexts received from the connected QKD device is directly transmitted to the destination node specified by the routing control information.

17. A method for ciphertext quantum key management and relay, characterized in that, The method is applied to the target node and includes: Receive the first encrypted information corresponding to each relay node on the relay path issued by the QKD network controller; The first key ciphertext is obtained by XORing the key ciphertext relayed to the destination node with each of the first encryption information and converting it with the quantum key ciphertext received from the connected QKD device. The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

18. The encrypted quantum key management and relay method as described in claim 17, characterized in that, When using a hop-by-hop key relay method, before converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext, the method further includes: The key ciphertext XOR result sent by the previous hop relay node is obtained by XORing the quantum key ciphertext received by the previous hop relay node from the connected QKD device with the quantum key ciphertext XORed from the previous hop relay node.

19. The encrypted quantum key management and relay method as described in claim 17, characterized in that, When using key XOR storage relay, before converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext, the method further includes: Receive the first relay ciphertext directly sent by each relay node, wherein the first relay ciphertext is the XOR value between the quantum key ciphertexts received by each relay node from the QKD device it is connected to; XOR each of the first relay ciphertexts to obtain the XOR result of the key ciphertext.

20. The encrypted quantum key management and relay method as described in claim 17, characterized in that, The process of converting the XOR result of the key ciphertext relayed to the destination node based on each of the first encryption information and the quantum key ciphertext received from the connected QKD device to obtain the first key ciphertext includes: The XOR result of the key ciphertext and the quantum key ciphertext received from the connected QKD device are converted into the XOR value of each cryptographic stream and the key to be shared. Each cryptographic stream is a cryptographic stream generated by the key encryption key stored locally on the corresponding QKD device. The first key ciphertext is obtained by XORing the XOR values ​​of each cipher stream with the key to be shared and then XORing each of the first encrypted information.

21. The encrypted quantum key management and relay method as described in claim 17, characterized in that, The method further includes: Receive the second encrypted information sent by the QKD network controller; Based on the second encryption information, the first key ciphertext is converted into the second key ciphertext; The second encrypted information carries a second key encryption key and a third key encryption key. The second key encryption key is the same as the local key encryption key of the QKD device connected to the destination node. The third key encryption key is the same as the local key encryption key of the cryptographic application module connected to the destination node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node. The second key ciphertext is the ciphertext obtained by encrypting the shared key with the third key encryption key.

22. The encrypted quantum key management and relay method as described in claim 21, characterized in that, The second encrypted information is the XOR value of the cryptographic stream corresponding to the second key encryption key and the cryptographic stream corresponding to the third key encryption key.

23. The encrypted quantum key management and relay method as described in claim 21, characterized in that, After obtaining the second key ciphertext, the method further includes: The second key ciphertext is sent to the cryptographic application module connected to the destination node, so that the cryptographic application module can use its locally stored key encryption key to decrypt the second key ciphertext to obtain the key to be shared.

24. A QKD network controller, characterized in that, include: The routing information delivery module is used to send routing control information to the relay node so that the relay node can relay the quantum key ciphertext received from the connected QKD device to the destination node in accordance with the routing control information. The first encrypted information sending module is used to send the first encrypted information corresponding to each relay node on the relay path to the destination node, so that the destination node can convert the XOR value of the quantum key ciphertext based on each of the first encrypted information to obtain the first key ciphertext. The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

25. A relay node, characterized in that, include: A quantum key ciphertext receiving module is used to receive quantum key ciphertext sent by each connected QKD device, wherein the quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key; The relay module is used to relay the XOR value of the quantum key ciphertext according to the routing control information issued by the QKD network controller.

26. A destination node, characterized in that, include: The first encrypted information receiving module is used to receive the first encrypted information corresponding to each relay node on the relay path issued by the QKD network controller; The first ciphertext conversion module is used to convert the XOR result of the key ciphertext relayed to the destination node and the quantum key ciphertext received from the connected QKD device based on each of the first encryption information to obtain the first key ciphertext. The quantum key ciphertext is obtained by encrypting the quantum key generated by the QKD device using its local key encryption key. The first encryption information carries a first key encryption key that is the same as the key encryption key corresponding to each relay node. The first key ciphertext is the ciphertext obtained by encrypting the shared key with the local key encryption key of the QKD device connected to the destination node.

27. A encrypted quantum key management and relay device, characterized in that, The device includes a memory and a processor; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, for implementing the method as described in any one of claims 1-10, or for implementing the method as described in any one of claims 11-16, or for implementing the method as described in any one of claims 17-23.

28. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it is used to implement the method as described in any one of claims 1-10, or to implement the method as described in any one of claims 11-16, or to implement the method as described in any one of claims 17-23.

29. A encrypted quantum key management and relay system, characterized in that, The system includes a QKD network controller and terminal nodes and relay nodes connected to the QKD network controller; The QKD network controller is used to perform the method as described in any one of claims 1-10; The relay node is used to perform the method as described in any one of claims 11-16; The terminal node is used to perform the method as described in any one of claims 17-23.

Images