A communication method and apparatus

Abstract

This application provides a communication method applied to the tail node of a target path, wherein all nodes on the target path are quantum nodes. The method includes: the tail node receiving a first message sent by the head node of the target path, the payload of which includes first key information obtained from a service key and a first shared quantum key, the service key being used to securely protect service data between the head node and the tail node. The tail node also receives a second message sent by an intermediate node of the target path, the payload of which includes second key information obtained from a second shared quantum key and a third shared quantum key. The tail node obtains the service key based on the first key information in the first message and the second key information in the second message. This scheme, while ensuring the security of the service key, enables the distribution of the service key from the head node to the tail node.

Description

Technical Field

[0001] This application relates to the field of communications, and in particular to a communication method and apparatus. Background Technology

[0002] Quantum communication utilizes quantum microscopic effects to transmit information openly or confidentially. Quantum key distribution (QKD) leverages quantum microscopic effects to securely establish identical quantum keys unconditionally between legitimate communicating parties. Based on quantum communication principles such as the indivisibility of single quantum particles, the superposition of quantum states, and the no-cloning of quantum states, QKD possesses high security characteristics, including being unpredictable, resistant to eavesdropping, and impossible to copy.

[0003] Quantum secure communication networks are based on QKD networks and can be applied to encrypted services. Specifically, quantum keys can be combined with service keys; for example, during service key distribution, quantum keys can be used to encrypt the service keys to ensure their reliability. However, quantum keys must be generated between two adjacent quantum devices, while application keys may be generated across multiple devices.

[0004] Therefore, how to use quantum key distribution to ensure the reliability of business keys is a problem that remains to be solved. Summary of the Invention

[0005] This application provides a communication method that can utilize quantum key distribution to ensure the reliability of business keys, thereby improving the security of business key distribution.

[0006] Firstly, this application provides a communication method applied to a tail node of a target path, wherein all nodes included in the target path are quantum nodes. The method includes: the tail node receiving a first message sent by a head node of the target path, the payload of which includes first key information, obtained based on a service key and a first shared quantum key, wherein the first shared quantum key is a shared quantum key between the head node and its next-hop node on the target path, and the service key is used to securely protect service data between the head node and the tail node. The tail node also receives a second message sent by an intermediate node of the target path, the payload of which includes second key information, obtained based on a second shared quantum key and a third shared quantum key, wherein the second shared quantum key is a shared quantum key between the intermediate node and its previous-hop node on the target path, and the third shared quantum key is a shared quantum key between the intermediate node and its next-hop node on the target path. After receiving the first and second messages, the tail node obtains a service key based on the first key information in the first message and the second key information in the second message. In this scheme, the head node uses a first shared quantum key to securely protect the business key, and the tail node obtains the business key based on the first key information and the second key information. This ensures the security of the business key while enabling its distribution from the head node to the tail node. In other words, this scheme effectively guarantees the security of business key distribution.

[0007] In this application, "quantum device" is also referred to as "quantum node," and the two terms can be used interchangeably.

[0008] In one possible implementation, the first message is an Internet Protocol Version 6 (SRv6) segment routing message. The destination address of the first message received by the tail node is the tail node's SRv6 segment identifier (SID). The type of the tail node's SRv6 SID indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID. The first SRv6 SID is the last SID in the segment identifier list of the first message. Since the first message is generated by the head node of the destination path, the first SRv6 SID is the SRv6 SID corresponding to the head node of the destination path. Specifically, the first SRv6 SID is the SRv6 SID assigned by the head node for the quantum connection between the head node and the next-hop node on the destination path. After receiving the first message, the tail node extracts the first SRv6 SID from the segment list of the first message and extracts the first key information from the payload of the first message. It further saves the correspondence between the first SRv6 SID and the first key information so that the service key can be recovered based on the correspondence between the first SRv6 SID and the first key information in the future.

[0009] In one possible implementation, the payload of the first message includes a first Internet Control Message Protocol (ICMP) message. This first ICMP message includes a type field that instructs the tail node to determine the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message, excluding the first SID. The other SIDs in the segment list of the first message, excluding the first SID, include the SRv6 SIDs corresponding to each quantum connection included on the destination path. That is, after receiving the first message, the tail node saves the correspondence between the first SRv6 SID and the first key information based on the type of the destination address of the first message, and performs a service key recovery operation based on the type field of the first ICMP message in the first message. Thus, the tail node can obtain the service key.

[0010] In one possible implementation, the type field of the first ICMP message is further used to indicate that the first message is a service key negotiation message. In one example, after the tail node receives the first message, it determines that the first message is a key negotiation message based on the type field of the first ICMP message. Optionally, the service key negotiation message also indicates that the tail node does not need to reply to the first message.

[0011] In one possible implementation, the segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on that SRv6 SID forwards the message based on the quantum connection corresponding to that SRv6 SID. In this way, the first message can be forwarded to the tail node of the target path through the quantum connections included in the target path, thereby realizing the distribution of service keys through the target path.

[0012] In one possible implementation, the second message is an SRv6 message. The destination address of the second message received by the tail node is the SRv6 SID of the tail node. The type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID. The second SRv6 SID is the last SID in the segment identifier list of the second message. The destination address of the first message received by the tail node is the same as the destination address of the second message received by the tail node. After receiving the second message, the tail node stores the correspondence between the second SRv6 SID and the second key information based on the type of the destination address of the second message, so as to facilitate the subsequent recovery of the service key based on the correspondence between the second SRv6 SID and the second key information.

[0013] In one possible implementation, the payload of the second message includes a second ICMP message, the second ICMP message includes second key information, and the second ICMP message also includes a type field, the type field of the second ICMP message indicating that the second message is a business key negotiation message.

[0014] Secondly, embodiments of this application provide a communication method applied to the head node of a target path. All nodes along the target path are quantum nodes. The head node sends a first message to the tail node of the target path. The payload of the first message includes first key information, which is obtained based on a service key and a first shared quantum key. The first shared quantum key is a shared quantum key between the head node and its next-hop node on the target path. This first key information is used to enable the tail node to obtain the service key. In this scheme, the head node uses the first shared quantum key to securely protect the service key, and the tail node obtains the service key based on the first key information. This ensures the security of the service key while enabling the distribution of the service key from the head node to the tail node. In other words, this scheme effectively ensures the security of service key distribution.

[0015] In one possible implementation, the first message is an Internet Protocol version 6 (IP6) segment routing (SRv6) message, the destination address of the first message received by the tail node is the SRv6 segment identifier (SID) of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID, and the first SRv6 SID is the last SID in the segment identifier list of the first message.

[0016] In one possible implementation, the payload of the first message includes a first Internet Control Message Protocol (ICMP) message, the first ICMP message including a type field, the type field of the first ICMP message indicating that the tail node determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message excluding the first SID.

[0017] In one possible implementation, the type field of the first ICMP message is also used to indicate that the first message is a business key negotiation message.

[0018] In one possible implementation, the segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on the SRv6 SID forwards the message based on the quantum connection corresponding to the SRv6 SID.

[0019] Thirdly, this application provides a communication method applied to intermediate nodes of a target path, wherein all nodes on the target path are quantum nodes. The intermediate node sends a second message to the tail node of the target path. The payload of the second message includes second key information, which is obtained based on a second shared quantum key and a third shared quantum key. The second shared quantum key is a shared quantum key between the intermediate node and its previous-hop node on the target path, and the third shared quantum key is a shared quantum key between the intermediate node and its next-hop node on the target path. This second key information is used to enable the tail node to obtain a service key. Specifically, the second key information and the first key information are used together by the tail node to obtain the service key. The first key information is sent from the head node of the target path to the tail node and is obtained based on the service key and the first shared quantum key, which is a shared quantum key between the head node and its next-hop node on the target path. In this scheme, the head node uses a first shared quantum key to securely protect the business key, and the tail node obtains the business key based on the first key information and the second key information. This ensures the security of the business key while enabling its distribution from the head node to the tail node. In other words, this scheme effectively guarantees the security of business key distribution.

[0020] In one possible implementation, the second message is an SRv6 message, the destination address of the second message received by the tail node is the SRv6 SID of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID, and the second SRv6 SID is the last SID in the segment identifier list of the second message.

[0021] In one possible implementation, the payload of the second message includes a second ICMP message, the second ICMP message including a type field, the type field of the second ICMP message indicating that the second message is a service key negotiation message.

[0022] Fourthly, this application provides a communication device applied to a tail node of a target path, wherein all nodes on the target path are quantum nodes. The device includes: a receiving unit, configured to receive a first message sent by a head node of the target path, the payload of the first message including first key information, the first key information being obtained based on a service key and a first shared quantum key, the first shared quantum key being a shared quantum key between the head node and its next-hop node on the target path, the service key being used to securely protect service data between the head node and the tail node; and receiving a second message sent by an intermediate node of the target path, the payload of the second message including second key information, the second key information being obtained based on a second shared quantum key and a third shared quantum key, the second shared quantum key being a shared quantum key between the intermediate node and its previous-hop node on the target path, the third shared quantum key being a shared quantum key between the intermediate node and its next-hop node on the target path; and a processing unit, configured to obtain the service key based on the first key information and the second key information.

[0023] In one possible implementation, the first message is an Internet Protocol version 6 (IP6) segment routing (SRv6) message, the destination address of the first message received by the tail node is the SRv6 segment identifier (SID) of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID, and the first SRv6 SID is the last SID in the segment identifier list of the first message.

[0024] In one possible implementation, the payload of the first message includes a first Internet Control Message Protocol (ICMP) message, the first ICMP message including a type field, the type field of the first ICMP message indicating that the tail node determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message excluding the first SID.

[0025] In one possible implementation, the type field of the first ICMP message is also used to indicate that the first message is a business key negotiation message.

[0026] In one possible implementation, the segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on the SRv6 SID forwards the message based on the quantum connection corresponding to the SRv6 SID.

[0027] In one possible implementation, the second message is an SRv6 message, the destination address of the second message received by the tail node is the SRv6 SID of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID, and the second SRv6 SID is the last SID in the segment identifier list of the second message.

[0028] In one possible implementation, the payload of the second message includes a second ICMP message, the second ICMP message including a type field, the type field of the second ICMP message indicating that the second message is a service key negotiation message.

[0029] Fifthly, this application provides a communication device applied to the head node of a target path, wherein all nodes included in the target path are quantum nodes. The device includes: a sending unit, configured to send a first message to the tail node of the target path via the target path. The payload of the first message includes first key information, which is obtained based on a business key and a first shared quantum key. The first shared quantum key is a shared quantum key between the head node and the next-hop node of the head node on the target path.

[0030] In one possible implementation, the first message is an Internet Protocol version 6 (IP6) segment routing (SRv6) message, the destination address of the first message received by the tail node is the SRv6 segment identifier (SID) of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID, and the first SRv6 SID is the last SID in the segment identifier list of the first message.

[0031] In one possible implementation, the payload of the first message includes a first Internet Control Message Protocol (ICMP) message, the first ICMP message including a type field, the type field of the first ICMP message indicating that the tail node determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message excluding the first SID.

[0032] In one possible implementation, the type field of the first ICMP message is also used to indicate that the first message is a business key negotiation message.

[0033] In one possible implementation, the segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on the SRv6 SID forwards the message based on the quantum connection corresponding to the SRv6 SID.

[0034] In a sixth aspect, this application provides a communication device applied to an intermediate node of a target path, wherein all nodes included in the target path are quantum nodes. The device includes: a transmitting unit for transmitting a second message to the tail node of the target path, wherein the payload of the second message includes second key information, the second key information being obtained based on a second shared quantum key and a third shared quantum key, wherein the second shared quantum key is a shared quantum key between the intermediate node and the previous hop node of the intermediate node on the target path, and the third shared quantum key is a shared quantum key between the intermediate node and the next hop node of the intermediate node on the target path.

[0035] In one possible implementation, the second message is an SRv6 message, the destination address of the second message received by the tail node is the SRv6 SID of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID, and the second SRv6 SID is the last SID in the segment identifier list of the second message.

[0036] In one possible implementation, the payload of the second message includes a second ICMP message, the second ICMP message including a type field, the type field of the second ICMP message indicating that the second message is a service key negotiation message.

[0037] In a seventh aspect, this application provides an apparatus. The apparatus includes a processor and a memory. The memory is used to store instructions or computer programs. The processor is used to execute the instructions or computer program in the memory to perform the methods described in the first aspect and any one of the first aspects above. Alternatively, the processor is used to execute the instructions or computer program in the memory to perform the methods described in the second aspect and any one of the second aspects above; or, the processor is used to execute the instructions or computer program in the memory to perform the methods described in the third aspect and any one of the third aspects above.

[0038] Eighthly, this application provides a computer-readable storage medium including instructions or a computer program that, when run on a computer, causes the computer to perform the methods described in the first aspect and any one of the first aspects above, or causes the computer to perform the methods described in the second aspect and any one of the second aspects above, or causes the computer to perform the methods described in the third aspect and any one of the third aspects above.

[0039] Ninthly, this application provides a computer program product comprising instructions or a computer program, which, when run on a computer, causes the computer to perform the method described in any one of the first aspects above, or causes the computer to perform the method described in the second aspect above and any one of the second aspects above, or causes the computer to perform the method described in the third aspect above and any one of the third aspects above.

[0040] In a tenth aspect, this application provides a communication system comprising at least two of the following: a tail node of a target path, a head node of a target path, or an intermediate node of a target path, wherein the tail node of the target path is used to execute the method described in the first aspect above and any one of the first aspects above, the head node of the target path is used to execute the method described in the second aspect above and any one of the second aspects above, and the intermediate node of the target path is used to execute the method described in the third aspect above and any one of the third aspects above. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1a This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0043] Figure 1b This is a schematic diagram illustrating another application scenario provided by an embodiment of this application;

[0044] Figure 2 A signaling interaction diagram of a communication method provided in an embodiment of this application;

[0045] Figure 3 This is a schematic diagram of the structure of a first ICMP message provided in an embodiment of this application;

[0046] Figure 4a A schematic diagram illustrating an application scenario provided in an embodiment of this application;

[0047] Figure 4b A schematic diagram illustrating another application scenario provided by an embodiment of this application;

[0048] Figure 4c A schematic diagram illustrating yet another application scenario provided by an embodiment of this application;

[0049] Figure 5 This is a schematic diagram of the structure of a communication device provided in an embodiment of this application;

[0050] Figure 6 This is a schematic diagram of the structure of a device provided in an embodiment of this application. Detailed Implementation

[0051] Before introducing the communication method provided in this application, we will first introduce an exemplary application scenario of this application.

[0052] See Figure 1a , Figure 1a This is a schematic diagram of an application scenario provided by an embodiment of this application.

[0053] Figure 1a The network 100 shown includes multiple network devices, including quantum devices and non-quantum devices. Quantum devices are those capable of quantum key generation, or those that include a QKD board. Non-quantum devices are those that do not have quantum key generation capabilities and do not have a QKD board.

[0054] like Figure 1a As shown, Figure 1a The network shown includes two types of connections: classical links and quantum links. Classical links are... Figure 1a The solid line represents a classic connection, also known as a traditional connection, which refers to a connection between two network devices that have a connection relationship. Quantum connections... Figure 1a The dotted lines represent quantum connectivity, which refers to the connection between quantum devices. Quantum connectivity and classical connectivity can overlap or be independent; this application does not impose specific limitations. For example, as... Figure 1a As shown, the classical and quantum connections between quantum device 3 and quantum device 4 overlap, while... Figure 1a Other quantum connections are independent of other classical connections.

[0055] In one example Figure 1a The network 100 shown also has a corresponding controller, such as Figure 1bAs shown, the controller is used to control or manage network devices in network 100. For example, the controller can collect the network topology of network 100 and send control or management signaling to the network devices in network 100 to control or manage the network devices in network 100.

[0056] The controller mentioned in the embodiments of this application is a functional module that implements control and / or management functions, or a physical entity that runs the relevant functional module. The physical entity may be, for example, a server with relevant software installed, which is used to implement the controller's functions. Alternatively, the physical entity may be a device running a network management system (NMS).

[0057] In some scenarios, Figure 1b The controller in the network is called the path calculation element (PCE), and the network device in the network 100 is called the path calculation client (PCC).

[0058] Currently, two quantum devices with quantum connectivity can establish the same quantum key. This shared quantum key between the two quantum devices is also known as the shared quantum key between them. For example, in... Figure 1a and Figure 1b In the scenario shown, quantum device 1 and quantum device 2 can establish the same quantum key. This shared quantum key between quantum device 1 and quantum device 2 is called the shared quantum key between quantum device 1 and quantum device 2. Similarly, quantum device 2 and quantum device 3 can establish the same quantum key. This shared quantum key between quantum device 2 and quantum device 3 is called the shared quantum key between quantum device 2 and quantum device 3. Furthermore, quantum device 3 and quantum device 4 can establish the same quantum key. This shared quantum key between quantum device 3 and quantum device 4 is called the shared quantum key between quantum device 3 and quantum device 4.

[0059] Because quantum keys offer extremely high security, combining them with business keys can effectively guarantee the security of the business keys. Business keys refer to the keys used to securely protect business data. Business keys include, but are not limited to, encryption keys and integrity calculation keys.

[0060] However, quantum keys must be generated between two adjacent quantum devices, or in other words, between two adjacent quantum devices that are quantum connected. For example, in Figure 1a and Figure 1bIn the scenario shown, quantum device 1 and quantum device 3 are connected by quantum device 2, meaning that quantum device 1 and quantum device 3 cannot generate the same quantum key. However, application keys can be cross-device. For example, in... Figure 1a and Figure 1b In the scenario shown, quantum device 1 and quantum device 4 are able to establish the same business key.

[0061] How to combine business keys that can be generated across devices with quantum keys that can only be generated between adjacent quantum devices is a problem that remains to be solved.

[0062] In view of this, this application provides a communication method that can use quantum keys to ensure the reliability of business keys, thereby improving the security of business key distribution.

[0063] See Figure 2 The figure is a signaling interaction diagram of a communication method provided in an embodiment of this application.

[0064] Figure 2 The method shown is executed jointly by the head node, intermediate nodes, and tail node of the target path to distribute the business key from the head node to the tail node through the target path. Wherein:

[0065] All nodes on the target path are quantum nodes. In one example, the target path is calculated by the head node of the target path based on the business key distribution request and the QKD topology of the target network. In another example, the target path is calculated by the controller based on the business key distribution request and the QKD topology of the target network. After calculating the target path, the controller sends the target path to the head node of the target path, and the head node stores the received target path. All nodes on the target path are nodes in the target network. In one example, the target network corresponds to... Figure 1a or Figure 1b In network 100, the target path is: Quantum Device 1 → Quantum Device 2 → Quantum Device 3 → Quantum Device 4. Quantum Device 1 is the head node of the target path, and Quantum Device 4 is the tail node of the target path.

[0066] A business key distribution request includes at least the address of the source device and the address of the destination device for business key distribution. The source device is the head node of the aforementioned target path, and the destination device is the tail node of the aforementioned target path. In addition to the addresses of the source and destination devices, the business key distribution request also includes other information, such as path constraints. These path constraints indicate the conditions that the path used for business key distribution must meet. This application does not specifically limit the path constraints. As an example, the path constraints may be related to the distribution frequency of the business key. In this scenario, to ensure the security of the business key, the quantum devices on the business key distribution path need to possess sufficient quantum keys to guarantee the security of the business key. In this scenario:

[0067] In one example, the path constraint includes the quantum key generation rate of the quantum devices included on the path of business key distribution. For instance, the path constraint includes the minimum quantum key generation rate of the quantum devices included on the path of business key distribution. The minimum quantum key generation rate is greater than the distribution frequency of the business key.

[0068] In another example, the path constraint includes the quantum key reserve of the quantum devices included in the path of the business key distribution. For example, the path constraint includes the minimum quantum key reserve of the quantum devices included in the path of the business key distribution. The minimum quantum key reserve is greater than a certain threshold to ensure that the quantum devices have sufficient quantum keys to guarantee the security of the business key.

[0069] In another example, the path constraint includes the physical distance between adjacent quantum devices on the path of the business key distribution. The path constraint also includes the maximum physical distance between adjacent quantum devices on the path of the business key distribution. The physical distance between adjacent quantum devices can be mapped to the quantum key reserve of the quantum devices. In one example, the maximum physical distance is, for example, less than a certain distance, thereby ensuring that the quantum devices have sufficient quantum keys to guarantee the security of the business key.

[0070] As another example, the path constraint is not related to the frequency of service key distribution, but to the devices through which the service key distribution passes. For example, the path constraint includes devices that the service key distribution must pass through, or devices that the service key distribution needs to bypass, etc., which will not be described in detail here.

[0071] As another example, the service key distribution request includes a service identifier to indicate the service corresponding to the service key distribution request. This application embodiment does not specifically limit the service identifier; the service identifier may be, for example, a service number or other identifier.

[0072] In this application, the QKD topology of the target network includes the connectivity between quantum devices in the target network and the QKD capabilities of the quantum devices in the target network. The connectivity between quantum devices in the target network indicates which quantum devices have quantum connections. The QKD capabilities of the quantum devices are capabilities related to quantum key distribution.

[0073] Regarding the QKD capability of quantum devices, we will now illustrate it using the QKD capability of the first quantum device in the target network as an example. The first and second quantum devices are connected via a quantum connection. In one example, the QKD capability of the first quantum device includes one or more of the following: whether the first quantum device can generate a quantum key, the quantum key generation rate of the first quantum device, the quantum key reserve of the first quantum device, the identifier of the quantum connection between the first and second quantum devices, the connection status of the quantum connection between the first and second quantum devices, or the physical distance between the first and second quantum devices.

[0074] in:

[0075] An identifier for the quantum connection between the first quantum device and the second quantum device. As an example, this identifier might be the identifier of the port used by the first quantum device to connect to the second quantum device. As another example, this identifier might be the identifier assigned by the first quantum device to the quantum connection. As a specific example, the first quantum device assigns an SRv6 SID to the quantum connection; in this scenario, the identifier of the quantum connection is the SRv6 SID assigned by the first quantum device. In the scenario where the first quantum device assigns an SRv6 SID to the quantum connection, a new type is also defined for this SRv6 SID. This new type is used to indicate that nodes forwarding packets based on this SRv6 SID forward packets based on the quantum connection corresponding to this SRv6 SID. In other words, the type of the SRv6 SID indicates that forwarding based on this SRv6 SID requires forwarding through a quantum connection. Specifically, when forwarding based on this SRv6 SID, the first quantum device first determines the quantum connection corresponding to this SRv6 SID based on the SRv6 SID, and then forwards the packet based on the quantum connection corresponding to this SRv6 SID. This application does not specifically limit the type corresponding to the aforementioned SRv6 SID. The type corresponding to the SRv6 SID may be, for example, Endpoint Key Management (END.KM).

[0076] The state of the quantum connection between the first quantum device and the second quantum device includes a normal state and an abnormal state. The normal state is also known as a successful connection (link up), and the abnormal state is also known as a broken connection (link down).

[0077] Figure 2 The method shown includes the following steps S101-S105.

[0078] S101: The head node of the target path sends a first message to the tail node of the target path through the target path. The payload of the first message includes first key information. The first key information is obtained based on the business key and the first shared quantum key. The first shared quantum key is the shared quantum key between the head node and the next-hop node of the head node on the target path.

[0079] S102: The tail node of the target path receives the first message sent by the head node of the target path.

[0080] In this application, the head node and the next-hop node of the head node on the target path can generate the same quantum key, wherein the same shared key generated by the head node and the next-hop node of the head node on the target path is the first shared quantum key.

[0081] The head node uses the first shared quantum key to calculate the service key, thereby obtaining the first key information. For example, the head node uses a certain calculation method to calculate the service key based on the first shared quantum key, thereby obtaining the first key information. This application does not specifically limit the calculation method; the calculation method may be, for example, an XOR algorithm, that is, performing an XOR operation on the service key and the first shared quantum key to obtain the first key information.

[0082] In this application, the first message includes not only the first key information, but also the first segment of routing information. The first segment of routing information indicates the target path. That is, after receiving the first message, the forwarding node forwards the first message based on the first segment of routing information, so that the first message can be forwarded to the tail node of the target path through the target path.

[0083] In one example, all devices on the target path support Segment Routing Multi-Protocol Label Switching (SR MPLS), and in this scenario, the first packet is an SR-MPLS packet. Correspondingly, the first segment routing information in the first packet is the MPLS label stack of the first packet.

[0084] In another example, all devices on the target path support SRv6; in this scenario, the first packet is an SRv6 packet. Regarding SRv6, it should be noted that:

[0085] SRv6 is a protocol designed based on source routing principles for forwarding IPv6 packets over a network. SRv6 achieves hop-by-hop forwarding by inserting a segment routing header (SRH) into IPv6 packets. The SRH includes an offset address stack and an explicit IPv6 address stack. Intermediate nodes continuously update the destination address and offset address stack to perform hop-by-hop forwarding. The explicit IPv6 address stack corresponds to the segment identifier list in the SRH (also known as the segment list), and the offset address stack corresponds to the segment left (SL) in the SRH.

[0086] In SRv6, the element used for forwarding is the SRv6 segment. An SRv6 segment is in IPv6 address form and is often referred to as an SRv6 segment identifier (SID). An SRv6 SID consists of two parts: a locator and a function. The format of an SRv6 SID is Locator:Function, where the locator occupies the high-order bits of the IPv6 address, and the function occupies the remaining bits.

[0087] The Locator has routing capabilities, so it must generally be unique within the SR domain. Other nodes in the network can locate this device through the Locator network segment route, and all SRv6 SIDs advertised by this device can also be reached through this Locator network segment route. The Function represents the device's instructions, which are all pre-defined by the device. The Function section is used to instruct the device that generated the SRv6 SID to perform the corresponding functional operations.

[0088] The Function section can also be divided into an optional Arguments section. In this case, the SRv6 SID is represented in the format of Locator:Function:Arguments. Arguments occupy the low bits of the IPv6 address. Information such as packet flow and services can be defined through the Arguments field.

[0089] In scenarios where the first message is an SRv6 message, the first segment routing information in the first message is an SRH. This SRH includes a segment identifier list, often simply referred to as a segment list, which contains multiple SRv6 SIDs. In this application, the segment list of the first message includes at least one SRv6 SID corresponding to a quantum connection. For example: assuming the head node of the target path corresponds to... Figure 1a Quantum device 1 in the target path corresponds to the tail node. Figure 1a The quantum device 4 shown has a target path of: quantum device 1 → quantum device 2 → quantum device 3 → quantum device 4. Therefore, the segment list of the first packet includes: SRv6 SID1 corresponding to the quantum connection between quantum device 1 and quantum device 2, SRv6 SID2 corresponding to the quantum connection between quantum device 2 and quantum device 3, and SRv6 SID3 corresponding to the quantum connection between quantum device 3 and quantum device 4. In addition, the segment list of the first packet also includes the SRv6 SID of the tail node to indicate the tail node for SRv6 forwarding.

[0090] For any SRv6 SID corresponding to a quantum connection included in the segment list of the first message, the type of the SRv6 SID indicates that forwarding based on that SRv6 SID requires traversal through a quantum connection. Alternatively, the type of the SRv6 SID indicates that the node forwarding the message based on that SRv6 SID forwards the message based on the quantum connection corresponding to that SRv6 SID. Specifically, when quantum device 1 forwards based on SRv6 SID1, it is a quantum device forwarding between quantum device 1 and quantum device 2; when quantum device 2 forwards based on SRv6 SID2, it is a quantum device forwarding between quantum device 2 and quantum device 3; when quantum device 3 forwards based on SRv6 SID3, it is a quantum device forwarding between quantum device 3 and quantum device 4. Thus, the first message is sent to quantum device 4 via the target path.

[0091] In scenarios where the first message is an SRv6 message, the destination address of the first message received by the tail node of the target path is the SRv6 SID of the tail node. In this application, the SRv6 SID of the tail node is used to indicate the correspondence between the first key information and the first SRv6 SID stored by the tail node. As a specific example, the type of the SRv6 SID of the tail node indicates the correspondence between the first key information and the first SRv6 SID stored by the tail node. The first SRv6 SID is the last SID in the segment identifier list of the first message. Since the first message is generated by the head node of the target path, the first SRv6 SID is the SRv6 SID corresponding to the head node of the target path. Specifically, the first SRv6 SID is the SRv6 SID assigned by the head node for the quantum connection between the head node and the next-hop node on the target path. The SRH of the first message includes a last entry field, which indicates the position of the first SRv6 SID in the segment list of the first message. After receiving the first message, the tail node extracts the first SRv6 SID from the segment list of the first message using the value of the last entry field, extracts the first key information from the payload of the first message, and further saves the correspondence between the first SRv6 SID and the first key information.

[0092] In this application, the first key information is carried in the payload of the first message. The embodiments of this application do not specifically limit the carrier of the first key information. In a specific example, the first key information is carried in a first ICMP message. In other words, the payload of the first message includes a first ICMP message, and the first ICMP message includes the aforementioned first key information. The structure of the first ICMP message is referenced below. Figure 3 To understand, Figure 3 This is a schematic diagram illustrating the structure of a first ICMP message provided in an embodiment of this application. Figure 3 As shown, the first ICMP message includes: a type field, a code field, a checksum field, and a message body field. The message body field carries the aforementioned first key information.

[0093] The type field indicates that the message is an ICMP message, or the type field and the code field together indicate that the message is an ICMP message.

[0094] The checksum field is a checksum of three fields: type field, code field, and message body field.

[0095] In one example, the type field of the first ICMP message instructs the tail node to determine the service key based on the key information corresponding to the SIDs other than the first SID in the segment list of the first packet. Here, the first SID in the segment list of the first packet is the SRv6 SID of the tail node; that is, the first SID in the segment list of the first packet is the destination address of the first packet received by the tail node. The other SIDs in the segment list of the first packet, excluding the first SID, include the SRv6 SIDs corresponding to each quantum connection included on the target path. Specifically, the tail node determines the service key based on the fourth shared quantum key between the tail node and its previous hop node on the target path, and the key information corresponding to the other SIDs in the segment list of the first packet, excluding the first SID.

[0096] In another example, the type field of the first ICMP message also indicates that the first message is a service key negotiation message. In one example, after the tail node receives the first message, it determines that the first message is a key negotiation message based on the type field of the first ICMP message. Optionally, the service key negotiation message also indicates that the tail node does not need to reply to the first message.

[0097] In another example, the first key information is carried via a first Transmission Control Protocol (TCP) message. In other words, the payload of the first message includes a first TCP message, which contains the aforementioned first key information.

[0098] For the structure and forwarding process of the first message, please refer to [link / reference]. Figure 4a Understand the application scenarios shown. Figure 4a This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. For example... Figure 4a As shown:

[0099] The target path is: Quantum Device 1 → Quantum Device 2 → Quantum Device 3 → Quantum Device 4. The SRv6 SID corresponding to the quantum connection between Quantum Device 1 and Quantum Device 2 is A:1::1; the SRv6 SID corresponding to the quantum connection between Quantum Device 2 and Quantum Device 3 is A:2::1; the SRv6 SID corresponding to the quantum connection between Quantum Device 3 and Quantum Device 4 is A:3::1; Quantum Device 4 also corresponds to SRv6 SID A:3::100; and the IPv6 address of the head node is B:1::1. Therefore:

[0100] In the IPv6 header of the first packet sent by the head node (i.e., quantum device 1), the source address is B:1::1 and the destination address is A:2::1. The SRH of the first packet sent by the head node includes four SRv6 SIDs, where segment list[0] = A:3::100, segment list[1] = A:3::1, segment list[2] = A:2::1, and segment list[3] = A:1::1. Based on segment list[3], the head node determines the quantum connection to be forwarded based on A:1::1. In addition, before forwarding the first packet, the head node decrements the value of the SL field in the SRH by 1. Therefore, the value of the SL field of the first packet sent by the head node is 2. Among them, segment list[0] is the first SID in the segment list of the first packet, and segment list[3] is the last SID in the segment list of the first packet.

[0101] Additionally, the value of the last entry field in the SRH of the first message sent by the head node is 3, and this value remains unchanged during the forwarding of the first message. The payload of the first message includes the first key information. Figure 4a In the middle, with K1⊕K 12 This represents the first key information, where: K1 is the business key, ⊕ indicates the XOR operation, and K... 12 This represents the first shared quantum key. The payload of the first message remains unchanged during forwarding.

[0102] After receiving the first message sent by the head node, quantum device 2 determines that the first message is forwarded based on the quantum connection corresponding to the destination address A:2::1. In addition, quantum device 2 decrements the value of SL in the first message by 1 to get 1, and updates the destination address of the first message to the value of segment list[1]. Therefore, the destination address of the first message sent by quantum device 2 is A:3::1 and the value of the SL field is 1.

[0103] After receiving the first message sent by quantum device 2, quantum device 3 determines that the first message will be forwarded based on the quantum connection corresponding to the destination address A:3::1. Additionally, quantum device 3 decrements the value of SL in the first message by 1, resulting in 0, and updates the destination address of the first message to the value of segment list[0]. Therefore, the destination address of the first message sent by quantum device 3 is A:3::100, and the value of the SL field is 0.

[0104] After receiving the first message, quantum device 4 will remove the SRH from the first message because the destination address is its own SRv6 SID and the value of the SL field in the first message is 0.

[0105] S103: The intermediate node of the target path sends a second message to the tail node of the target path. The payload of the second message includes second key information. The second key information is obtained based on a second shared quantum key and a third shared quantum key. The second shared quantum key is a shared quantum key between the intermediate node and the previous hop node of the intermediate node on the target path. The third shared quantum key is a shared quantum key between the intermediate node and the next hop node of the intermediate node on the target path.

[0106] S104: The tail node of the target path receives the second message sent by the intermediate node of the target path.

[0107] In this application, the target path includes one or more intermediate nodes, and for each intermediate node in the target path, the step corresponding to S103 is executed. Correspondingly, the tail node of the target path receives the second message sent by each intermediate node.

[0108] In this application, intermediate nodes and their next-hop nodes on the target path can generate the same quantum key, and intermediate nodes and their previous-hop nodes on the target path can also generate the same quantum key. The shared key generated between intermediate nodes and their previous-hop nodes on the target path is called the second shared quantum key, and the shared key generated between intermediate nodes and their next-hop nodes on the target path is called the third shared quantum key.

[0109] Intermediate nodes use the second shared quantum key and the third shared quantum key to obtain the second key information. For example, intermediate nodes use a certain calculation method to calculate the second shared quantum key and the third shared quantum key to obtain the second key information. This application does not specifically limit the calculation method; the calculation method may be, for example, an XOR algorithm, that is, performing an XOR calculation on the second shared quantum key and the third shared quantum key to obtain the second key information.

[0110] In this application, in addition to the second key information, the second message also includes a second segment of routing information. The second segment of routing information indicates the sub-path from the intermediate node to the tail node in the target path. That is, after the forwarding node receives the second message, it forwards the second message based on the second segment of routing information, so that the second message can be forwarded to the tail node of the target path through the sub-path from the intermediate node to the tail node in the target path.

[0111] In one example, similar to the first message, the second message is an SR-MPLS message or an SRv6 message.

[0112] In scenarios where the second message is an SRv6 message, the second segment of routing information in the second message is an SRH. The SRH of the second message includes a segment list, which contains at least one SRv6 SID. In this application, the segment list of the second message includes at least one SRv6 SID corresponding to a quantum connection. For example: assume the head node of the destination path corresponds to... Figure 1a Quantum device 1 in the target path corresponds to the tail node. Figure 1a The target path for quantum device 4 shown is: quantum device 1 → quantum device 2 → quantum device 3 → quantum device 4. Therefore:

[0113] If the intermediate node is quantum device 2, then the segment list of the second message includes: SRv6 SID2 corresponding to the quantum connection between quantum device 2 and quantum device 3, and SRv6 SID3 corresponding to the quantum connection between quantum device 3 and quantum device 4. In addition, the segment list of the second message also includes the SRv6 SID of the tail node to indicate the tail node to which SRv6 forwarding occurred.

[0114] If the intermediate node is quantum device 3, then the segment list of the second message includes the SRv6 SID3 corresponding to the quantum connection between quantum device 3 and quantum device 4. In addition, the segment list of the second message also includes the SRv6 SID of the tail node to indicate the tail node to which the SRv6 is forwarded.

[0115] For any SRv6 SID corresponding to a quantum connection included in the segment list of the second message, the type of the SRv6 SID indicates that forwarding based on that SRv6 SID requires traversal through a quantum connection. For example, when quantum device 2 forwards based on SRv6 SID2, it is a quantum device forwarding between quantum device 2 and quantum device 3; when quantum device 3 forwards based on SRv6 SID3, it is a quantum device forwarding between quantum device 3 and quantum device 4.

[0116] In the scenario where the second message is an SRv6 message, the destination address of the second message received by the tail node of the target path is the SRv6 SID of the tail node. In this application, the SRv6 SID of the tail node is used to indicate the correspondence between the second key information and the second SRv6 SID stored by the tail node. As a specific example, the type of the SRv6 SID of the tail node indicates the correspondence between the second key information and the second SRv6 SID stored by the tail node. The second SRv6 SID is the last SID in the segment identifier list of the second message. Since the second message is generated by an intermediate node of the target path, the second SRv6 SID is the SRv6 SID corresponding to the intermediate node that generated the second message. Specifically, the second SRv6 SID is the SRv6 SID assigned by the intermediate node that generated the second message for the quantum connection between itself and its next-hop node on the target path. Similar to the first message, the SRH of the second message includes a last entry field, which indicates the position of the second SRv6 SID in the segment list of the second message. After receiving the second message, the tail node extracts the second SRv6 SID from the segment list of the second message using the value of the last entry field, extracts the second key information from the payload of the second message, and further saves the correspondence between the second SRv6 SID and the second key information.

[0117] In this application, the second key information is carried in the payload of the second message. Similar to how the first key information is carried in the first message, in one specific example, the second key information is carried in a second TCP message; in other words, the payload of the second message includes the second TCP message, and the second TCP message includes the aforementioned second key information. In another example, the second key information is carried in a second ICMP message. In other words, the payload of the second message includes the second ICMP message, and the second ICMP message includes the aforementioned second key information. Regarding the structure of the second ICMP message, please refer to the description of the first ICMP message above, and it will not be repeated here.

[0118] In one example, the type field of the second ICMP message indicates that the second message is a service key negotiation message. In another example, after the tail node receives the second message, it determines that the second message is a key negotiation message based on the type field of the second ICMP message. Optionally, the service key negotiation message also indicates that the tail node does not need to reply to the second message.

[0119] In another example, the first key information is carried via a first TCP message.

[0120] For the structure and forwarding process of the second message, please refer to [link / reference]. Figure 4b and Figure 4c Understand the application scenarios shown. Figure 4b and Figure 4c These are schematic diagrams illustrating two other application scenarios provided in the embodiments of this application. Figure 4b and Figure 4c In the scenario shown:

[0121] The target path is: Quantum Device 1 → Quantum Device 2 → Quantum Device 3 → Quantum Device 4. The SRv6 SID corresponding to the quantum connection between Quantum Device 1 and Quantum Device 2 is A:1::1; the SRv6 SID corresponding to the quantum connection between Quantum Device 2 and Quantum Device 3 is A:2::1; the SRv6 SID corresponding to the quantum connection between Quantum Device 3 and Quantum Device 4 is A:3::1; Quantum Device 4 also corresponds to SRv6 SID A:3::100; the IPv6 address of the head node is B:1::1; the IPv6 address of Quantum Device 2 is B:2::1; and the IPv6 address of Quantum Device 3 is B:3::1. Therefore, if... Figure 4b As shown:

[0122] In the IPv6 header of the second packet sent by quantum device 2, the source address is B:2::1 and the destination address is A:3::1. The SRH of the second packet sent by quantum device 2 includes three SRv6 SIDs, where segment list[0] = A:3::100, segment list[1] = A:3::1, and segment list[2] = A:2::1. Based on segment list[2], quantum device 2 determines the quantum connection to be forwarded based on A:2::1. In addition, before forwarding the second packet, quantum device 2 decrements the value of the SL field in the SRH of the second packet by 1. Therefore, the value of the SL field in the second packet sent by quantum device 2 is 1.

[0123] Additionally, the value of the last entry field in the SRH of the second message sent by quantum device 2 is 2, and this value remains unchanged during the forwarding of the second message. The payload of the second message includes second key information. Figure 4b In the middle, with K 12 ⊕K 23 This represents the second key information, where: K 12 For the first shared quantum key, ⊕ indicates the XOR operation, K 23 This represents the second shared quantum key. The payload of the second message remains unchanged during forwarding.

[0124] After receiving the second message sent by quantum device 2, quantum device 3 determines that the first message will be forwarded based on the quantum connection corresponding to the destination address A:3::1. Additionally, quantum device 3 decrements the value of SL in the second message by 1, resulting in 0, and updates the destination address of the second message to the value of segment list[0]. Therefore, the destination address of the second message sent by quantum device 3 is A:3::100, and the value of the SL field is 0.

[0125] After receiving the second message, quantum device 4 will remove the SRH from the second message because the destination address is its own SRv6 SID and the value of the SL field in the second message is 0.

[0126] like Figure 4c As shown:

[0127] In the IPv6 header of the second packet sent by quantum device 3, the source address is B:3::1 and the destination address is A:3::100. The SRH of the second packet sent by quantum device 3 includes two SRv6 SIDs, where segment list[0] = A:3::100 and segment list[1] = A:3::1. Based on segment list[1], quantum device 3 determines the quantum connection to be forwarded based on A:3::1. In addition, before forwarding the second packet, quantum device 3 decrements the value of the SL field in the SRH of the second packet by 1. Therefore, the value of the SL field in the second packet sent by quantum device 3 is 0.

[0128] Additionally, the value of the last entry field in the SRH of the second message sent by quantum device 3 is 1, and this value remains unchanged during the forwarding of the second message. The payload of the second message includes second key information. Figure 4c In the middle, with K 23 ⊕K 34 This represents the second key information, where: K 23 For the first shared quantum key, ⊕ indicates the XOR operation, K 34 This represents the second shared quantum key. The payload of the second message remains unchanged during forwarding.

[0129] After receiving the second message, quantum device 4 will remove the SRH from the second message because the destination address is its own SRv6 SID and the value of the SL field in the second message is 0.

[0130] In one example, after receiving the first message, the intermediate node then sends the second message to the tail node. That is: Figure 2In this example, S101 is executed before S103. However, in some embodiments, S103 can be executed before S101, as long as the validity of the first key information and the second key information can be guaranteed within the same period. For example, the head node periodically sends the first message to the tail node according to a certain period, and the intermediate nodes periodically send the second message to the tail node according to a certain period. In this scenario, S103 may also be executed before S101.

[0131] S105: The tail node of the target path obtains the service key based on the first key information and the second key information.

[0132] After receiving the first and second messages, the tail node obtains the service key based on the first and second key information. Specifically, after receiving the second message, the tail node saves the correspondence between the second SRv6 SID and the second key information based on the type of the destination address of the second message. After receiving the first message, the tail node saves the correspondence between the first SRv6 SID and the first key information based on the type of the destination address of the first message. In addition, the tail node also determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message (excluding the first SID) based on the type field of the first ICMP message in the first message. Specifically, the tail node extracts the other SIDs in the segment identifier list of the first message (excluding the first SID), and uses each of the other SIDs as an index to query the saved correspondence between the key information and the SRv6 SID to obtain the first and second key information. Furthermore, it performs calculations on the first and second key information, such as XORing the first and second key information, to obtain the service key.

[0133] Now combined Figures 4a to 4c The operations performed on the tail node are explained.

[0134] After the tail node (i.e., quantum device 4) receives the first message sent by the head node (i.e., quantum device 1), based on the type of the destination address A:3::100 of the first message, it first determines the first SRv6 SID as: segment list[3]=A:1::1 according to the value 3 of the last entry field. Furthermore, it saves K1⊕K 12 The correspondence between A:1::1 and A:1::1.

[0135] After the tail node receives the second message sent by quantum node 2, based on the type of the destination address A:3::100 of the second message, it first determines the second SRv6 SID as: segment list[2] = A:2::1 according to the value 2 of the last entry field. Then, it saves K12 ⊕K 23 The correspondence between A:2::1 and A:2::1.

[0136] After the tail node receives the second message sent by quantum node 3, based on the type of the destination address A:3::100 of the second message, it first determines the second SRv6 SID as segment list[1] = A:3::1 according to the value 1 of the last entry field. Then, it saves K 23 ⊕K 34 The correspondence between A:3::1 and A:3::1.

[0137] Additionally, after receiving the first message, the tail node determines, based on the type field of the first ICMP message in the first message, that it needs to perform the operation of determining the service key. The tail node extracts the other SRv6 SIDs from the first message, excluding the first SID. Figure 4a In the scenario shown, the tail node can extract three SRv6 SIDs: A:3::1, A:2::1, and A:1::1. Based on the correspondence between the locally stored SRv6 SIDs and key information, the tail node can use A:3::1 to determine the key information K. 23 ⊕K 34 The tail node can determine the key information K using A:2::1. 12 ⊕K 23 The tail node can determine the key information K1⊕K using A:1::1. 12 Additionally, the tail node can also determine the fourth shared quantum key K. 34 According to K 23 ⊕K 34 K 12 ⊕K 23 K1⊕K 12 and K 34 The tail node can then determine the business key K1. For example, the tail node obtains the business key K1 using the following formula: K 23 ⊕K 34 ⊕K 12 ⊕K 23 ⊕K1⊕K 12 ⊕K 34 =K1.

[0138] As described above, using the scheme provided in this application embodiment, the head node uses a first shared quantum key to securely protect the business key, and the tail node obtains the business key based on the first key information and the second key information. This ensures the security of the business key while enabling the distribution of the business key from the head node to the tail node. Furthermore, during the distribution process, only the head node and the tail node know the business key; other intermediate nodes on the target path are unaware of the business key, thus effectively ensuring the security of the business key distribution.

[0139] Based on the communication method provided in the above embodiments, this application also provides a corresponding communication device, which will be described below with reference to the accompanying drawings.

[0140] See Figure 5 The figure is a schematic diagram of the structure of a communication device provided in an embodiment of this application. Figure 5 The communication device 500 shown includes a transceiver unit 510 and a processing unit 520, wherein the processing unit 520 is optional. The transceiver unit 510 is used to perform receiving and / or transmitting operations, and the processing unit 520 is used to perform other operations besides receiving and transmitting operations. The transceiver unit 510 includes a receiving unit 511 and / or a transmitting unit 512, wherein the receiving unit 511 is used to perform receiving operations, and the transmitting unit 512 is used to instruct transmitting operations.

[0141] In one example Figure 5 The communication device 500 shown is applied to the tail node of the target path and is used to execute the communication method provided in the above embodiments, which is executed by the tail node of the target path. For example, it executes... Figure 2 The communication method shown includes steps performed by the tail node of the target path, where all nodes on the target path are quantum nodes. For this case:

[0142] The receiving unit 511 is configured to receive a first message sent by the head node of the target path, the payload of which includes first key information, which is obtained based on a service key and a first shared quantum key. The first shared quantum key is a shared quantum key between the head node and its next-hop node on the target path. The service key is used to securely protect service data between the head node and the tail node. The receiving unit 511 also receives a second message sent by an intermediate node of the target path, the payload of which includes second key information, which is obtained based on a second shared quantum key and a third shared quantum key. The second shared quantum key is a shared quantum key between the intermediate node and its previous-hop node on the target path. The third shared quantum key is a shared quantum key between the intermediate node and its next-hop node on the target path.

[0143] The processing unit 520 is used to obtain the business key based on the first key information and the second key information.

[0144] In one possible implementation, the first message is an Internet Protocol version 6 (IP6) segment routing (SRv6) message, the destination address of the first message received by the tail node is the SRv6 segment identifier (SID) of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID, and the first SRv6 SID is the last SID in the segment identifier list of the first message.

[0145] In one possible implementation, the payload of the first message includes a first Internet Control Message Protocol (ICMP) message, the first ICMP message including a type field, the type field of the first ICMP message indicating that the tail node determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message excluding the first SID.

[0146] In one possible implementation, the type field of the first ICMP message is also used to indicate that the first message is a business key negotiation message.

[0147] In one possible implementation, the segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on the SRv6 SID forwards the message based on the quantum connection corresponding to the SRv6 SID.

[0148] In one possible implementation, the second message is an SRv6 message, the destination address of the second message received by the tail node is the SRv6 SID of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID, and the second SRv6 SID is the last SID in the segment identifier list of the second message.

[0149] In one possible implementation, the payload of the second message includes a second ICMP message, the second ICMP message including a type field, the type field of the second ICMP message indicating that the second message is a service key negotiation message.

[0150] In another example, Figure 5 The communication device 500 shown is applied to the head node of the target path and is used to execute the communication method provided in the above embodiments, which is executed by the head node of the target path. For example, it executes... Figure 2 The communication method shown comprises steps performed by the head node of the target path, where all nodes on the target path are quantum nodes. In this case:

[0151] The sending unit 512 is used to send a first message to the tail node of the target path through the target path. The payload of the first message includes first key information. The first key information is obtained based on the business key and the first shared quantum key. The first shared quantum key is the shared quantum key between the head node and the next-hop node of the head node on the target path.

[0152] In one possible implementation, the first message is an Internet Protocol version 6 (IP6) segment routing (SRv6) message, the destination address of the first message received by the tail node is the SRv6 segment identifier (SID) of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID, and the first SRv6 SID is the last SID in the segment identifier list of the first message.

[0153] In one possible implementation, the payload of the first message includes a first Internet Control Message Protocol (ICMP) message, the first ICMP message including a type field, the type field of the first ICMP message indicating that the tail node determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message excluding the first SID.

[0154] In one possible implementation, the type field of the first ICMP message is also used to indicate that the first message is a business key negotiation message.

[0155] In one possible implementation, the segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on the SRv6 SID forwards the message based on the quantum connection corresponding to the SRv6 SID.

[0156] In yet another example, Figure 5 The communication device 500 shown is applied to an intermediate node of the target path to execute the communication method provided in the above embodiments, which is performed by the intermediate node of the target path. For example, it executes... Figure 2 The communication method shown comprises steps performed by intermediate nodes along the target path, where all nodes along the target path are quantum nodes. In this case:

[0157] The sending unit 512 is used to send a second message to the tail node of the target path. The payload of the second message includes second key information. The second key information is obtained based on a second shared quantum key and a third shared quantum key. The second shared quantum key is a shared quantum key between the intermediate node and the previous hop node of the intermediate node on the target path. The third shared quantum key is a shared quantum key between the intermediate node and the next hop node of the intermediate node on the target path.

[0158] In one possible implementation, the second message is an SRv6 message, the destination address of the second message received by the tail node is the SRv6 SID of the tail node, the type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID, and the second SRv6 SID is the last SID in the segment identifier list of the second message.

[0159] In one possible implementation, the payload of the second message includes a second ICMP message, the second ICMP message including a type field, the type field of the second ICMP message indicating that the second message is a service key negotiation message.

[0160] For details on the implementation of each unit of the device 500, please refer to the relevant descriptions in the above embodiments; they will not be repeated here.

[0161] In this application, the aforementioned communication device 500 may have the following hardware structure: Figure 6 The structure shown, Figure 6 This is a schematic diagram of the structure of a device provided in an embodiment of this application.

[0162] Please see Figure 6 As shown, device 600 includes: a processor 610, a communication interface 620, and a memory 630. The number of processors 610 in device 600 may be one or more. Figure 6 Taking a processor as an example. In this embodiment, the processor 610, communication interface 620, and memory 630 can be connected via a bus system or other means. Figure 6 Taking the connection between China and Israel via the Bus System 640 as an example.

[0163] Processor 610 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP. Processor 610 may further include hardware chips. These hardware chips may be application-specific integrated circuits (ASICs), programmable logic devices (PLDs), or combinations thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0164] Memory 630 may include volatile memory, such as random-access memory (RAM); memory 630 may also include non-volatile memory, such as flash memory, hard disk drive (HDD), or solid-state drive (SSD); memory 630 may also include combinations of the above types of memory. Figure 6 When the device 600 shown is the head node of the target path, the memory 630 stores, for example, the aforementioned target path; when Figure 6 When the device 600 shown is an intermediate node, the memory 630 stores, for example, second key information; when Figure 6 When the device 600 shown is the tail node of the aforementioned target path, the memory 630 stores, for example, the first key information and the second key information.

[0165] Optionally, the memory 630 stores an operating system and programs, executable modules, or data structures, or subsets thereof, or extended sets thereof. The programs may include various operation instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and handling hardware-based tasks. The processor 610 can read the programs from the memory 630 to implement the communication methods provided in the embodiments of this application.

[0166] The bus system 640 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus system 640 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0167] This application also provides a computer-readable storage medium, including instructions or a computer program, which, when run on a computer, causes the computer to perform the communication method provided in the above embodiments.

[0168] This application also provides a computer program product containing instructions or computer programs, which, when run on a computer, causes the computer to execute the communication method provided in the above embodiments.

[0169] This application also provides a communication system, which includes at least two of the following: a head node, an intermediate node, or a tail node of a target path mentioned in the above embodiments. The head node of the target path is used to perform the operations performed by the head node of the target path as provided in the above embodiments; the intermediate node of the target path is used to perform the operations performed by the intermediate node of the target path as provided in the above embodiments; and the tail node of the target path is used to perform the operations performed by the tail node of the target path as provided in the above embodiments.

[0170] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0171] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0172] In the embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical business division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0173] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0174] Furthermore, the various business units in the embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software business unit.

[0175] If the integrated unit is implemented as a software business unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0176] Those skilled in the art will recognize that, in one or more of the examples above, the services described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these services can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium accessible to general-purpose or special-purpose computers.

[0177] The above specific embodiments further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above are merely specific embodiments of the present invention.

[0178] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A communication method characterized by comprising: The method, applied to the tail node of a target path where all nodes are quantum nodes, includes: The system receives a first message sent by the head node of the target path. The payload of the first message includes first key information. The first key information is obtained based on a service key and a first shared quantum key. The first shared quantum key is a shared quantum key between the head node and the next-hop node of the head node on the target path. The service key is used to securely protect the service data between the head node and the tail node. The system receives a second message sent by an intermediate node in the target path. The payload of the second message includes second key information. The second key information is obtained based on a second shared quantum key and a third shared quantum key. The second shared quantum key is a shared quantum key between the intermediate node and the previous hop node of the intermediate node in the target path. The third shared quantum key is a shared quantum key between the intermediate node and the next hop node of the intermediate node in the target path. The business key is obtained based on the first key information and the second key information.

2. The method of claim 1, wherein, The first message is an Internet Protocol version 6 (IP6) segment routing (SRv6) message. The destination address of the first message received by the tail node is the SRv6 segment identifier (SID) of the tail node. The type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID. The first SRv6 SID is the last SID in the segment identifier list of the first message.

3. The method of claim 2, wherein, The payload of the first message includes a first Internet Control Message Protocol (ICMP) message. The first ICMP message includes a type field, which indicates that the tail node determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message, excluding the first SID.

4. The method of claim 3, wherein, The type field of the first ICMP message is also used to indicate that the first message is a business key negotiation message.

5. The method according to any one of claims 2-4, characterized in that, The segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on the SRv6 SID forwards the message based on the quantum connection corresponding to the SRv6 SID.

6. The method according to any one of claims 1-5, characterized in that, The second message is an SRv6 message. The destination address of the second message received by the tail node is the SRv6 SID of the tail node. The type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID. The second SRv6 SID is the last SID in the segment identifier list of the second message.

7. The method of claim 6, wherein, The payload of the second message includes a second ICMP message, which includes a type field indicating that the second message is a service key negotiation message.

8. A communication method characterized by comprising: The method, applied to the head node of a target path where all nodes are quantum nodes, includes: A first message is sent to the tail node of the target path through the target path. The payload of the first message includes first key information. The first key information is obtained based on the business key and the first shared quantum key. The first shared quantum key is the shared quantum key between the head node and the next-hop node of the head node on the target path.

9. The method of claim 8, wherein, The first message is an Internet Protocol version 6 (IP6) segment routing (SRv6) message. The destination address of the first message received by the tail node is the SRv6 segment identifier (SID) of the tail node. The type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the first key information and the first SRv6 SID. The first SRv6 SID is the last SID in the segment identifier list of the first message.

10. The method of claim 9, wherein, The payload of the first message includes a first Internet Control Message Protocol (ICMP) message. The first ICMP message includes a type field, which indicates that the tail node determines the service key based on the key information corresponding to the other SIDs in the segment identifier list of the first message, excluding the first SID.

11. The method of claim 10, wherein, The type field of the first ICMP message is also used to indicate that the first message is a business key negotiation message.

12. The method according to any one of claims 9-11, characterized in that, The segment identifier list of the first message includes multiple SRv6 SIDs corresponding to quantum connections. The type of each SRv6 SID corresponding to a quantum connection included in the segment identifier information indicates that the node forwarding the message based on the SRv6 SID forwards the message based on the quantum connection corresponding to the SRv6 SID.

13. A method of communication, comprising: The method, applied to intermediate nodes of a target path where all nodes are quantum nodes, includes: A second message is sent to the tail node of the target path. The payload of the second message includes second key information. The second key information is obtained based on a second shared quantum key and a third shared quantum key. The second shared quantum key is a shared quantum key between the intermediate node and the previous hop node of the intermediate node on the target path. The third shared quantum key is a shared quantum key between the intermediate node and the next hop node of the intermediate node on the target path.

14. The method of claim 13, wherein, The second message is an SRv6 message. The destination address of the second message received by the tail node is the SRv6 SID of the tail node. The type of the SRv6 SID of the tail node indicates that the tail node stores the correspondence between the second key information and the second SRv6 SID. The second SRv6 SID is the last SID in the segment identifier list of the second message.

15. The method of claim 14, wherein, The payload of the second message includes a second ICMP message, which includes a type field indicating that the second message is a service key negotiation message.

16. A communication device, characterized in that, The device includes multiple functional modules that interact with each other to implement the method as described in any one of claims 1-15.

17. A communication device, comprising a processor and a memory, the memory for storing program code, the processor for calling the program code in the memory to cause the communication device to perform the method as claimed in any one of claims 1-15.

18. A computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1-15.

19. A computer program product, characterised in that, Includes program code that, when a computer runs the computer program product, causes the computer to perform the method as described in any one of claims 1-15.

20. A communication system, characterized by The system includes at least two of the following: The tail node of the method according to any one of claims 1-7, the head node of the method according to any one of claims 8-12, or the middle node of the method according to any one of claims 13-15.

Images