A distributed unique identity generation method and system for quantum secure networks

Abstract

This invention relates to the field of quantum secure communication technology and discloses a distributed unique identifier generation method and system for quantum secure networks. Through innovative ID structure design, a hierarchical node numbering management mechanism, and systematic module deployment, this invention achieves global uniqueness of cryptographic book identifiers and application session identifiers in quantum secure networks, avoiding service interruptions or security risks caused by identifier conflicts; it improves the flexibility and efficiency of identifier management, supporting dynamic partitioning and topology management of autonomous systems and virtual autonomous systems; it enhances identifier security by adopting a quantum-resistant technical solution to ensure identifier security in a quantum computing environment; and it meets the diverse identifier generation needs of different business scenarios, achieving unified generation and management of cryptographic book IDs and application IDs, laying a technical foundation for the large-scale application of quantum secure networks.

Description

Technical Field

[0001] This invention relates to the field of quantum secure communication technology, and in particular to a method and system for generating distributed unique identifiers for quantum secure networks, applicable to the generation and management of cryptographic book identifiers and application session identifiers in quantum key distribution (QKD) networks. Background Technology

[0002] With the increasing demand for communication security in fields such as the energy internet and fintech, the large-scale deployment of quantum secure communication technology is accelerating, and the number of quantum key distribution (QKD) network nodes is growing exponentially. Against this backdrop, traditional centralized key management and identifier allocation mechanisms are facing unprecedented challenges. Taking existing mainstream distributed ID generation schemes such as the Snowflake algorithm as an example, they have significant technical limitations: limited node capacity, typically supporting only 1024 nodes, far from meeting the deployment needs of hundreds of millions of nodes in future quantum secure networks; timestamp accuracy only reaches millisecond levels, easily leading to identifier generation delays or conflicts in high-concurrency business scenarios; and a small sequence number space, making it difficult to support the generation of a large number of identifiers per second by a single node. These shortcomings all prevent them from meeting the core requirements of quantum secure networks for massive, high-concurrency, and highly available identifiers.

[0003] Quantum cryptography, as a key component of quantum-secure networks, is characterized by its short lifespan, high update frequency, and massive quantity. This places more stringent demands on identifier generation schemes: they must not only be compatible with the complex topology of quantum networks and support the flexible partitioning of autonomous and virtual autonomous domains, but also possess quantum-resistant properties to address potential security threats from future quantum computing technologies. However, existing technologies lack adaptability to the specific topologies of quantum networks, making efficient routing planning and network management difficult. Furthermore, they fail to meet the stringent standards of quantum-secure communication in terms of identifier collision resistance and traceability. For example, in quantum-encrypted power distribution automation systems in the energy sector, numerous distribution terminals and the master station system need to exchange keys and interact via QKD networks. If identifier generation conflicts or security vulnerabilities exist, it will directly affect the stable operation and communication security of the power system, and may even trigger serious security incidents.

[0004] Furthermore, in current quantum-secure networks, the generation of cryptographic book identifiers and application session identifiers often employs independent mechanisms, lacking a unified management system. This increases network operation and maintenance complexity and also raises the risk of identifier conflicts. In scenarios involving frequent quantum key updates and high-concurrency transmission of business data, the performance bottlenecks and security vulnerabilities of existing identifier generation schemes become increasingly apparent. There is an urgent need for a distributed unique identifier generation method and system that can balance scalability, high-concurrency processing capabilities, quantum-resistant security, and topology adaptability. Summary of the Invention

[0005] To address the aforementioned shortcomings of existing technologies, this invention proposes a method and system for generating distributed unique identifiers for quantum-secure networks.

[0006] The technical solution of this invention is implemented as follows: 1. A method for generating distributed unique identifiers for quantum-safe networks, comprising: Obtain the active node number of the active node and the passive node number of the passive node that interacts with the active node; Obtain the current timestamp through the time synchronization module; Assign the password book serial number and / or application serial number within the current time unit through the serial number management module; A unique identifier for the quantum cryptography is generated based on the active node number, the passive node number, the current timestamp, and the cryptography sequence number; and / or A basic session identifier is generated based on the autonomous system number, node number, current timestamp, and application sequence number. Application extended data is then appended to the basic session identifier to generate an application session identifier. The active node number and the passive node number both adopt a hierarchical structure. The hierarchical structure includes an autonomous domain number and an intra-domain node number. The autonomous domain number is used to identify the autonomous domain to which the node belongs, and the intra-domain node number is used to identify the unique identity of the node within its autonomous domain.

[0007] Preferably, both the active node number and the passive node number are 32 bits; they are respectively used to identify the node that initiates the identifier generation request and the target node that interacts with that node. The current timestamp is a 32-bit second-level timestamp, representing the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970. The codebook serial number is 16 bits, used to distinguish between the same active node, the same passive node, and different codebooks generated within the same second. The application sequence number is 16 bits and is used to distinguish different application session identifiers generated by the same autonomous system node within the same second.

[0008] Preferably, the autonomous domain number is 16 bits, and the node number within the domain is 16 bits; the node identifier can directly reflect the network autonomous domain to which it belongs.

[0009] Preferably, the method supports Virtual Autonomous Zone (VAZ) partitioning. Based on the autonomous zone number, the first 8 digits are used as the VAZ number, supporting 256 virtual autonomous zones; the last 8 digits are used as the node number within the VAZ, supporting 256 nodes within each virtual autonomous zone. When creating a VAZ, a VAZ number lease is generated, and a mapping relationship is established between the VAZ, physical autonomous zone, node number within the zone, and node role.

[0010] Preferably, the basic session identifier is 80 bits, generated by sequentially combining the 16-bit autonomous system number, the 16-bit node number, the 32-bit current timestamp, and the 16-bit application sequence number; the application session identifier is generated by appending the application extended data after the basic session identifier, and the application extended data includes at least one of the following: application type, security level, and session validity period.

[0011] This invention also discloses a distributed unique identifier generation system for quantum-safe networks, comprising: ID Generator: Deployed on each QKD node, responsible for generating local identifiers. The ID generator generates Codebook IDs and App IDs according to a preset ID structure based on the node's role, valid node lease, logical timestamp, sequence number, and business parameters. Since the identifier generation process is completed locally, without relying on sequential allocation from a central node, it supports high concurrency and low latency identifier generation. The generated identifiers are asynchronously synchronized to the Autonomous System Management (AS / RS) module or audit module for subsequent conflict detection, tracing, and routing planning. The Autonomous System (VAZ) management module, deployed at the core management node of the quantum-safe network, is responsible for the allocation, lease maintenance, and network topology maintenance of Autonomous System (AS) numbers, Virtual Autonomous System (VAZ) numbers, and node numbers within the AZ. This module generates candidate node numbers based on node registration requests, queries the lease table to determine if a number is occupied, and if not, writes a lease record including the node number, AZ, VAZ, node role, lease term, and version number. If a node migrates, a lease expires, or the topology is adjusted, the module updates or releases the corresponding number to ensure consistency between the node number and the network topology. The time synchronization module achieves network-wide time synchronization based on Network Time Protocol (NTP), Enhanced NTP, PTP, or other high-precision time synchronization technologies, and provides the current physical timestamp to the ID generator. To avoid duplicate identifiers caused by local clock rollback, this invention further includes a logical time compensation module: when the current timestamp is greater than the previous generated timestamp, the current timestamp is used and the sequence number is reset; when the current timestamp is equal to the previous generated timestamp, the sequence number is incremented; when the current timestamp is less than the previous generated timestamp and the rollback difference does not exceed the threshold, the previous generated timestamp continues to be used as the logical timestamp; when the rollback difference exceeds the threshold, generation is paused and a time synchronization alarm is triggered. The sequence number management module, deployed on each QKD node, is responsible for managing the allocation and use of codebook sequence numbers and application sequence numbers. This module maintains two independent sequence number counters for each node, corresponding to the codebook sequence number and the application sequence number respectively, and resets the corresponding counters to 0 at the beginning of each logical second. The counters increment with each identifier generation request. When the counters reach their maximum value of 65,535, the module enters an overflow control state, first checking if a reserved sequence range exists; if it does, a reserved sequence is allocated; otherwise, it waits for the next logical second or returns a rate-limiting prompt, thus avoiding identifier conflicts caused by sequence number wrapping. The active node number and the passive node number both adopt a hierarchical structure. The hierarchical structure includes an autonomous domain number and an intra-domain node number. The autonomous domain number is used to identify the autonomous domain to which the node belongs, and the intra-domain node number is used to identify the unique identity of the node within its autonomous domain.

[0012] Preferably, the serial number management module maintains an independent password book serial number counter and an application serial number counter for each node; at the beginning of each second, both the password book serial number counter and the application serial number counter are reset to 0, and increment sequentially as identifiers are generated; when the password book serial number counter or the application serial number counter reaches its maximum value, it automatically waits for the next second before assigning serial numbers.

[0013] Preferably, the ID generator generates the identifier locally without needing to interact with other nodes on the network. After generating the identifier, the ID generator also verifies the uniqueness of the generated identifier. Once the verification is successful, the identifier is associated with and stored in the corresponding quantum cryptography book or application session, and synchronized to the autonomous region management module.

[0014] Preferably, the time synchronization module performs periodic synchronization with a standard time source based on a network time protocol; in scenarios requiring high precision, the time synchronization module uses an enhanced network time protocol for time synchronization.

[0015] Preferably, after receiving a node registration request, the Autonomous System Management (ASM) module reads the physical autonomous system, virtual autonomous system, node role, node public key, or device certificate information from the request and generates a candidate node number. It then queries the number lease table to determine if the candidate node number is within a valid lease period. If the candidate number is not occupied, a lease record containing the node number, autonomous system number, VAZ number, intra-domain node number, node role, lease term, version number, and status flag is written, and the node number and lease certificate are returned to the node. If the candidate number is occupied, a new candidate number is selected from the intra-domain node number pool. The node generates an identifier locally during the lease validity period and sends a renewal request according to a preset cycle. When a node migrates, cancels, or exceeds the renewal period, the ASM module releases or freezes the corresponding number.

[0016] Preferably, the generation process of the codebook identifier includes: First, the ID generator obtains the active node number of the current node and the passive node number of the target interactive node, and verifies that both are within a valid lease period. Then, the time synchronization module obtains the UTC second-level timestamp, and the logical time compensation algorithm handles clock rollback or time standstill. Next, the sequence number management module assigns the codebook sequence number within the current logical second, ensuring that the codebook sequence number is not repeated for the same active node, the same passive node, and within the same logical second. Subsequently, the security verification module calculates the security verification field based on the QKD key material, quantum random number, active node number, passive node number, timestamp, and codebook sequence number. Finally, the above fields are combined in a preset order to generate a 128-bit CodebookID.

[0017] Preferably, the process of generating the application session identifier (App ID) includes: Basic distributed field generation: The first 80 bits of the App ID consist of a 16-bit autonomous system number, a 16-bit node number, a 32-bit timestamp, and a 16-bit application sequence number. The autonomous system number and node number come from valid node leases, the timestamp comes from a logical time compensation algorithm, and the application sequence number is assigned by an application sequence counter that increments within the current logical second. Complete App ID Extension: In addition to the basic distributed fields, an 8-bit application type, an 8-bit security level, a 16-bit session validity period, and a 16-bit security verification field are added to form a complete 128-bit App ID. The application type is used to distinguish business categories such as key application, remote control command, status reporting, and file transfer; the security level is used to identify the key strength, business priority, or security domain level required for the session; the session validity period is used to limit the available time range of the application session ID; the security verification field is calculated by the security verification tag generation algorithm based on QKD key material, quantum random numbers, and the aforementioned fields, and is used to quickly verify the integrity and authenticity of the App ID.

[0018] Compared with the prior art, the present invention has the following beneficial effects: This invention addresses the technical challenges of identifier generation and management in existing quantum secure networks, providing a distributed unique identifier generation method and system that supports large-scale node deployment, high concurrency generation capabilities, and quantum computing resistance. It achieves global uniqueness of cryptographic book identifiers and application session identifiers in quantum secure networks, avoiding service interruptions or security risks caused by identifier conflicts; improves the flexibility and efficiency of identifier management, supporting dynamic partitioning and topology management of autonomous systems and virtual autonomous systems; enhances identifier security by employing quantum computing-resistant technical solutions to ensure identifier security in quantum computing environments; and simultaneously meets the diverse identifier generation needs of different business scenarios, achieving unified generation and management of cryptographic book IDs and application IDs, laying a technical foundation for the large-scale application of quantum secure networks. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the 128-bit distributed unique ID structure of the present invention; Figure 2 This is a schematic diagram of the node numbering hierarchical structure of the present invention; Figure 3 This is a schematic diagram of the quantum cryptography ID structure of the present invention; Figure 4 This is a schematic diagram of the session ID structure used in this invention; Figure 5 This is a system architecture block diagram of the present invention; Figure 6 This is a flowchart of the quantum cryptographic identifier generation process according to Embodiment 1 of the present invention. Detailed Implementation

[0020] The present invention will now be clearly and completely described with reference to the accompanying drawings in the embodiments of the present invention.

[0021] This invention provides a distributed unique identifier generation method and system for quantum-safe networks, the specific scheme of which is as follows: 128-bit globally unique ID structure: To meet the requirements of generating massive numbers of nodes and high-concurrency identifiers in quantum-safe networks, this invention designs a 128-bit globally unique ID structure. This structure adopts a typed field layout, including at least a node number field, a time field, a sequence field, and a security verification field, forming a quantum cryptography ID and an application session ID based on the identifier type. The quantum cryptography ID uses the following 128-bit structure: 32-bit active node number, 32-bit passive node number, 32-bit timestamp, 16-bit cryptography sequence number, and 16-bit security verification field; the application session ID uses the following 128-bit structure: 16-bit autonomous system number, 16-bit node number, 32-bit timestamp, 16-bit application sequence number, 8-bit application type, 8-bit security level, 16-bit session validity period, and 16-bit security verification field. The functions and value ranges of each field are as follows: 32-bit active node ID: Used to identify the node that initiates the ID generation request. It supports the deployment of up to 4,294,967,296 active nodes, which can fully meet the needs of large-scale node expansion in future quantum-safe networks.

[0022] 32-bit passive node number: Used to identify the target node that interacts with the active node. It also supports 4,294,967,296 passive nodes, ensuring accurate identification of interactions between nodes in complex network topologies.

[0023] 32-bit second-level timestamp: Represents the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970. Compared with the traditional millisecond-level timestamp, it effectively expands the time representation range while ensuring time accuracy, avoids time overflow problems after long-term operation, and provides a reliable basis for the time sequence management and traceability of the identifier.

[0024] 16-bit codebook serial number: used to distinguish different codebooks generated within the same active node, the same passive node, and within the same second. It supports a single node to generate 65,536 codebook IDs per second. When the counter reaches its maximum value, the serial number management module executes an overflow control algorithm, prioritizing the use of reserved sequence intervals or waiting for the next logical second to avoid serial number wrapping that could cause identifier conflicts.

[0025] 16-bit application serial number: Used to distinguish different application session identifiers generated within the same second by nodes in the same autonomous system, supporting a single node to generate 65,536 application IDs per second. The application session ID further includes business fields such as application type, security level, and session validity period, enabling the identifier to be directly parsed by business systems and used for session management, access control, and security auditing.

[0026] Hierarchical management mechanism for node numbers: To adapt to the complex topology of quantum-safe networks and achieve efficient network routing and node management, this invention adopts a hierarchical node numbering design and uses a lease-based node numbering allocation algorithm to ensure the uniqueness of node numbers within autonomous systems and virtual autonomous systems. The specific hierarchical method and allocation process are as follows: Basic hierarchical structure: Node numbers (including active node numbers and passive node numbers) adopt a 32-bit hierarchical design. The first 16 bits are the autonomous system number, supporting the division of up to 65,536 autonomous systems; the last 16 bits are the node number within the domain, and each autonomous system can support 65,536 nodes. This hierarchical structure allows the node identifier to directly reflect the network autonomous system to which it belongs, greatly simplifying the network routing planning and node management process.

[0027] Virtual Autonomous Domain (VAZ) Support: Addressing the potential virtual network architecture requirements in quantum-safe networks, this invention further supports Virtual Autonomous Domain (VAZ) partitioning. Based on the autonomous domain number, the first 8 digits are used as the VAZ number, supporting 256 virtual autonomous domains; the last 8 digits are used as the node number within each VAZ, supporting 256 nodes per virtual autonomous domain. The autonomous domain management module generates a VAZ number lease when creating a VAZ and establishes a mapping relationship between the VAZ, physical autonomous domain, node numbers within the domain, and node roles. This ensures that the same physical node can obtain non-conflicting virtual node numbers in multi-tenant or cross-regional scenarios.

[0028] Node number lease allocation algorithm: After receiving a node registration request, the Autonomous System Management (ASM) module reads the physical autonomous system (PAS), virtual autonomous system (VAZ), node role, and node public key or device certificate information from the request, and generates a candidate node number. It then queries the number lease table to determine if the candidate node number is within a valid lease period. If the candidate number is not occupied, a lease record containing the node number, AAS number, VAZ number, intra-domain node number, node role, lease term, version number, and status flag is written, and the node number and lease certificate are returned to the node. If the candidate number is occupied, a new candidate number is selected from the intra-domain node number pool. During the lease validity period, nodes can generate identifiers locally and send renewal requests according to a preset cycle. When a node migrates, is deregistered, or exceeds the renewal period, the AAS module releases or freezes the corresponding number. Through this lease-based allocation algorithm, the system can maintain local ID generation efficiency while preventing different nodes from obtaining the same node number.

[0029] Quantum cryptography codebook ID generation method: As the core data carrier in quantum key distribution (QKD) networks, the quantum codebook requires uniqueness, timeliness, traceability, and security verification capabilities for its identification. The quantum codebook ID (Codebook ID) designed in this invention adopts a 128-bit structure, as follows: 32-bit active node ID + 32-bit passive node ID + 32-bit timestamp + 16-bit password book serial number + 16-bit security check field During the generation process, the ID generator first obtains the active node number of the current node and the passive node number of the target interaction node, and verifies that both are within a valid lease period. Then, the time synchronization module obtains a UTC second-level timestamp, and a logical time compensation algorithm handles clock rollback or time standstill. Next, the sequence number management module assigns a codebook sequence number within the current logical second, ensuring that the codebook sequence number is unique for the same active node, the same passive node, and within the same logical second. Subsequently, the security verification module calculates a security verification field based on the QKD key material, quantum random number, active node number, passive node number, timestamp, and codebook sequence number. Finally, the above fields are combined in a preset order to generate a 128-bit Codebook ID. This structure not only uniquely identifies each quantum codebook but also enables source tracing, interaction object location, and generation sequence management through node numbers and timestamps, and achieves rapid integrity verification and forgery detection through the security verification field.

[0030] How to generate an application session App ID: Application session IDs (App IDs) are used to identify the session processes of various application services in a quantum-safe network. They need to balance compatibility with traditional distributed identification schemes with the unique security requirements of quantum networks. The App ID designed in this invention adopts a fixed 128-bit structure, and its generation method is as follows: Basic Distributed Field Generation: The first 80 bits of the App ID consist of a 16-bit Autonomous System (AS) ID, a 16-bit node ID, a 32-bit timestamp, and a 16-bit application sequence number. The AS and node IDs are derived from valid node leases, the timestamp is derived from a logical time compensation algorithm, and the application sequence number is assigned by an application sequence counter incrementing within the current logical second. This 80-bit basic field borrows the idea of ​​local generation of distributed IDs while extending the node space to the AS structure of quantum-safe networks.

[0031] Complete App ID Extension: In addition to the basic distributed fields, an 8-bit application type, an 8-bit security level, a 16-bit session validity period, and a 16-bit security verification field are added, forming a complete 128-bit App ID. The application type distinguishes business categories such as key requests, remote control commands, status reporting, and file transfers; the security level identifies the key strength, business priority, or security domain level required for the session; the session validity period limits the available time range of the application session ID; and the security verification field, calculated by the security verification tag generation algorithm based on QKD key materials, quantum random numbers, and the aforementioned fields, is used for rapid verification of the App ID's integrity and source authenticity.

[0032] This invention discloses a distributed unique identifier generation system for quantum-safe networks. The system comprises the following modules, which work collaboratively to achieve efficient generation, management, and maintenance of identifiers: ID Generator: Deployed on each QKD node, responsible for generating local identifiers. The ID generator generates Codebook IDs and App IDs according to a preset ID structure based on the node's role, valid node lease, logical timestamp, sequence number, and business parameters. Since the identifier generation process is completed locally, without relying on sequential allocation from a central node, it supports high concurrency and low latency identifier generation. The generated identifiers are asynchronously synchronized to the Autonomous System Management (AS / RS) module or audit module for subsequent conflict detection, tracing, and routing planning.

[0033] Autonomous System (AS) Management Module: Deployed at the core management node of the quantum-safe network, this module is responsible for allocating AS numbers, VAZ numbers, and node numbers within the AS, maintaining leases, and maintaining network topology relationships. Based on node registration requests, this module generates candidate node numbers and queries the lease table to determine if a number is occupied. If not occupied, it writes a lease record including the node number, AS, VAZ, node role, lease term, and version number. If a node migrates, a lease expires, or the topology is adjusted, the module updates or releases the corresponding number to ensure consistency between node numbers and the network topology.

[0034] Time synchronization module: Based on Network Time Protocol (NTP), Enhanced NTP, PTP, or other high-precision time synchronization technologies, it achieves network-wide time synchronization and provides the current physical timestamp to the ID generator. To avoid duplicate identifiers caused by local clock rollback, this invention further includes a logical time compensation module: When the current timestamp is greater than the previous generated timestamp, the current timestamp is used and the sequence number is reset; when the current timestamp is equal to the previous generated timestamp, the sequence number is incremented; when the current timestamp is less than the previous generated timestamp and the rollback difference does not exceed the threshold, the previous generated timestamp continues to be used as the logical timestamp; when the rollback difference exceeds the threshold, generation is paused and a time synchronization alarm is triggered.

[0035] The sequence number management module, deployed on each QKD node, is responsible for managing the allocation and use of codebook and application sequence numbers. This module maintains two independent sequence number counters for each node, one for the codebook sequence number and one for the application sequence number, resetting the corresponding counters to 0 at the start of each logical second. The counters increment with each identifier generation request. When the counter reaches its maximum value of 65,535, the module enters overflow control mode, first checking if a reserved sequence range exists. If it does, a reserved sequence is allocated; otherwise, it waits for the next logical second or returns a rate-limiting prompt, thus avoiding identifier conflicts caused by sequence number wrapping.

[0036] Security Verification Module: The security verification module is used to generate and verify the security verification field in the ID. Preferably, the security verification module derives a session verification key from the key material Kq obtained from the QKD network and the random number Rq obtained from the quantum random number source. It takes all fields in the ID to be generated, except for the security verification field, as message input, executes cryptographic algorithms such as SM3, SHA-3, KMAC, or HKDF, and truncates the lower 16 bits or 16 bits according to a preset rule as the fast security verification field after obtaining the digest value. For applications requiring a higher level of security, the complete digest value can be written to the audit log or metadata table along with the ID for subsequent strong verification. This module enables the ID to have fast integrity verification, source consistency verification, and abnormal forgery detection capabilities.

[0037] Topology Resolution Module: This module is used to reverse-engineer the topology information of the quantum secure network based on the ID field. For the Codebook ID, the module resolves the active node number and passive node number respectively, extracting the Autonomous System ID (ASID), VAZ number, and intra-AS node number, and determines whether they belong to the same VAZ, the same ASID, or different ASIDs. For the AppID, the module resolves the ASID number, node number, application type, and security level, and selects a local route, intra-AS route, or cross-AS gateway route based on the resolution results. The resolution results are synchronously written to the auditing module for key routing, session location, fault tracing, and security policy matching.

[0038] Audit Module: The audit module receives the identifier generation records asynchronously reported by the ID generator. The records include node number, logical timestamp, sequence number, identifier type, security verification field, topology resolution result, and generation status. The audit module does not participate in every ID synchronization generation, therefore it will not become a performance bottleneck in high-concurrency generation paths. Its main function is to perform duplicate detection, abnormal time rollback statistics, security verification failure statistics, and node lease consistency checks in the background.

[0039] like Figure 1The diagram shows the 128-bit distributed unique ID structure of this invention. The diagram intuitively illustrates the field composition, field length, and order relationship of the 128-bit globally unique ID. It clearly presents the layout relationship of the active node number, passive node number, timestamp, cryptographic sequence number, and security verification fields in the quantum cryptographic book ID, as well as the autonomous system number, node number, timestamp, application sequence number, application type, security level, session validity period, and security verification fields in the application session ID.

[0040] like Figure 2 The flowchart of the hierarchical structure of node numbering in this invention is as follows: This diagram shows the hierarchical design of node numbering (active node numbering and passive node numbering), including the division between autonomous system numbering and node numbering within the system, the division between virtual autonomous system (VAZ) numbering and node numbering within the VAZ, as well as the length and value range of each layer field, clarifying the correspondence between node numbering and network topology.

[0041] like Figure 3 The diagram shows the structure of the quantum codebook ID of this invention: The diagram illustrates the composition and order of the fields of the 112-bit Codebook ID, namely the combination of the 32-bit active node number, the 32-bit passive node number, the 32-bit timestamp, and the 16-bit codebook sequence number. The function of each field is also marked to facilitate understanding of the generation logic and application scenarios of the Codebook ID.

[0042] like Figure 4 This is a schematic diagram of the App ID structure for this invention: The diagram illustrates the process of generating the App ID, including the structure of the basic Snowflake ID (16-bit autonomous system number, 16-bit node number, 32-bit timestamp, 16-bit application serial number) and the location and function of the application extended data, reflecting the compatibility and flexibility design of the App ID.

[0043] like Figure 5 The above is a system architecture block diagram of the present invention. The diagram shows the deployment location of each core module (ID generator, autonomous region management module, time synchronization module, serial number management module), the interaction relationship between modules, and the data flow in the system architecture of the present invention, and clarifies the functional positioning and collaborative working mechanism of each module in the system.

[0044] The following provides several typical embodiments in specific quantum-safe network application scenarios to illustrate the specific implementation process and effects of the present invention in detail.

[0045] like Figure 6 The diagram shows the generation of a quantum cryptographic book identifier according to Embodiment 1 of the present invention, including: This embodiment uses a QKD node in a quantum-encrypted power distribution automation system in the energy field as an example to specifically illustrate the generation process of the quantum codebook ID. This process includes node lease verification, logical timestamp acquisition, sequence number allocation, security verification field calculation, and identifier combination. Node information determination: QKD node A is selected as the active node. The autonomous system number of this node is 0x0101, and the node number within the domain is 0x0001. Therefore, the active node number is 0x01010001. The master station system node that interacts with node A through key exchange is selected as the passive node. Its autonomous system number is also 0x0101, and the node number within the domain is 0x0002. Therefore, the passive node number is 0x01010002.

[0046] Timestamp Acquisition: The current UTC timestamp is obtained through the time synchronization module. To ensure consistency in the example, it is assumed that the current time corresponds to a second-level timestamp of 0x5F24D178 (i.e., the number of UTC seconds corresponding to 10:30:00 on July 31, 2020). The logical time compensation module reads the last generated timestamp lastTs. If the current timestamp is not less than lastTs, then the current timestamp is used as the logical timestamp for this generation.

[0047] Serial number allocation: The serial number management module allocates a password book serial number of 0x0001 for the current second based on the current password book serial number usage of node A (since no other password book IDs have been generated in the current second, the serial number starts from 0 and increments, with the first serial number being 0x0001).

[0048] Codebook ID Generation: The security verification module takes the QKD key material Kq, quantum random number Rq, active node number 0x01010001, passive node number 0x01010002, timestamp 0x5F24D178, and codebook sequence number 0x0001 as input, and executes Tag=Trunc16(SM3(Kq||Rq||0x01010001|| 0x01010002||0x5F24D178||0x0001)) to obtain a 16-bit security verification field. Assuming the security verification field is 0xA6F3, it is combined sequentially according to the preset CodebookID structure to generate a 128-bit Codebook ID: 0x01010001010100025F24D1780001A6F3.

[0049] Identifier Verification and Storage: After generating the Codebook ID, the ID generator first performs a fast duplicate check in the local cache. If the check passes, the Codebook ID is associated with the corresponding quantum cryptography book and stored, and then asynchronously synchronized to the Autonomous System Management (AS / RS) module and the audit module. The AS / RS module parses the AS / RS and its intra-AS node information based on the active node number and the passive node number, for subsequent cryptography book management, cross-domain routing planning, and lifecycle tracing.

[0050] As can be seen from this embodiment, the Codebook ID generated by the present invention can uniquely identify the quantum cryptography book and includes node information, timing information and security verification information, which facilitates the traceability, verification and management of the quantum cryptography book. At the same time, since the generation process is mainly completed locally, the central management node only undertakes lease maintenance and asynchronous auditing functions, thus meeting the application requirements of high concurrency and low latency quantum secure networks.

[0051] Example 2: Application Session Identifier Generation: This embodiment, based on QKD node A in Embodiment 1 above, further illustrates the process of generating the application session ID (App ID), taking the quantum-encrypted service session between the power distribution terminal and the master station system as an example: Basic Distributed Field Generation: First, generate the first 80 bits of the App ID's basic field. This field consists of a 16-bit Autonomous System ID (0x0101), a 16-bit Node ID (0x0001), a 32-bit Timestamp (0x5F24D178), and a 16-bit Application Sequence Number (0x0001). Therefore, the basic field is 0x010100015F24D1780001.

[0052] Application Extension Data Determination: Based on the business requirements of the distribution automation system, the application extension fields are determined. Assume this application session is a distribution terminal remote control command transmission service, the application type is "Remote Control Command" (coded 0x01), the security level is "Highest Security Level" (coded 0x03), and the session validity period is 300 seconds (coded 0x012C). The security verification module takes the QKD key material Kq, the quantum random number Rq, and the first 112 bits of the App ID as input, and executes Tag=Trunc16(SM3(Kq||Rq|| 0x010100015F24D17800010103012C)) to obtain a 16-bit security verification field. Assuming the security verification field is 0x7B21, the complete App ID is 0x010100015F24D17800010103012C7B21.

[0053] App ID Generation and Verification: The ID generator combines the basic fields, application type, security level, session validity period, and security verification fields in sequence to generate a 128-bit App ID, which is then returned to the business application. Upon receiving the App ID, the business recipient recalculates the security verification fields using the same security verification algorithm. If the recalculated result matches the security verification fields carried in the ID, the App ID is deemed tamper-proof; otherwise, the session is rejected and a security alert is recorded.

[0054] Example 3: Clock rollback and serial number overflow handling: In a QKD node, assuming the previously generated timestamp `lastTs` is 0x5F24D178, and the current physical timestamp `nowTs` read from the time synchronization module is 0x5F24D176, the difference between the two is 2 seconds. If the system's preset allowed rollback threshold is 3 seconds, the logical time compensation module will not use `nowTs`, but will continue to use `lastTs` as the logical timestamp, and will continue to allocate unused sequence numbers within this logical second. If the difference between `nowTs` and `lastTs` exceeds 3 seconds, the ID generator will pause generating new identifiers, trigger a time synchronization alarm, and wait for time synchronization to resume.

[0055] When the password book sequence number counter reaches 0xFFFF within a certain logical second, the sequence number management module enters overflow control mode. If the system is configured with a reserved sequence range, a sequence number is allocated from the reserved range and the overflow event is recorded in the audit module; if the reserved range is unavailable, the ID generator waits for the next logical second before continuing generation, or returns a rate limiting prompt to the upper-layer business. Through the above processing, the system avoids the risk of duplicate identification caused by clock rollback and sequence number wrapping.

[0056] Example 4: Topology-Aware Resolution and Cross-Domain Routing When the network management system receives the Codebook ID 0x01010001020100025F24D1780001A6F3, the topology resolution module reads the active node number 0x01010001 and the passive node number 0x02010002, and resolves the autonomous system (AS) to which the active node belongs (0x0101) and the nodes within that AS (0x0001), and the AS to which the passive node belongs (0x0201) and the nodes within that AS (0x0002). Since the AS numbers are different, the topology resolution module determines the key interaction corresponding to this identifier as a cross-AS interaction and selects a cross-domain gateway routing strategy. If the AS numbers are the same but the VAZ numbers are different, a virtual autonomous system (VAZ) routing strategy within the same physical AS is selected. Through this resolution process, the ID field is not only used for unique identification but also directly participates in the routing location, key management, and security auditing of the quantum secure network.

Claims

1. A method for generating distributed unique identifiers for quantum-safe networks, characterized in that, include: Obtain the active node number of the active node and the passive node number of the passive node that interacts with the active node; Obtain the current timestamp through the time synchronization module; Assign the password book serial number and / or application serial number within the current time unit through the serial number management module; A unique identifier for the quantum cryptography is generated based on the active node number, the passive node number, the current timestamp, and the cryptography sequence number. and / or A basic session identifier is generated based on the autonomous system number, node number, current timestamp, and application sequence number. Application extended data is then appended to the basic session identifier to generate an application session identifier. The active node number and the passive node number both adopt a hierarchical structure. The hierarchical structure includes an autonomous domain number and an intra-domain node number. The autonomous domain number is used to identify the autonomous domain to which the node belongs, and the intra-domain node number is used to identify the unique identity of the node within its autonomous domain.

2. The distributed unique identity generation method for quantum secure networks according to claim 1, characterized in that, Both the active node number and the passive node number are 32 bits; they are respectively used to identify the node that initiates the identifier generation request and the target node that interacts with the node. The current timestamp is a 32-bit second-level timestamp, representing the number of seconds that have elapsed since 00:00:00 UTC on January 1, 1970. The codebook serial number is 16 bits, used to distinguish between the same active node, the same passive node, and different codebooks generated within the same second. The application sequence number is 16 bits and is used to distinguish different application session identifiers generated by the same autonomous system node within the same second.

3. The method for distributed unique identity generation for quantum secure networks of claim 2, wherein, The autonomous domain number is 16 bits, and the node number within the domain is 16 bits; the node identifier can directly reflect the network autonomous domain to which it belongs.

4. The distributed unique identity generation method for a quantum secure network according to claim 2, wherein, The method supports Virtual Autonomous Zone (VAZ) partitioning. Based on the VAZ number, the first 8 digits are used as the VAZ number, supporting 256 virtual autonomous zones; the last 8 digits are used as the node number within the VAZ, supporting 256 nodes within each virtual autonomous zone. When creating a VAZ, a VAZ number lease is generated, and a mapping relationship is established between the VAZ, physical autonomous zone, node number within the zone, and node role.

5. The method for distributed unique identity generation for quantum secure network according to claim 3, characterized in that, The basic session identifier is 80 bits, generated by sequentially combining the 16-bit Autonomous Region ID, the 16-bit Node ID, the 32-bit Current Timestamp, and the 16-bit Application Sequence Number; the application session identifier is generated by appending the application extended data after the basic session identifier, and the application extended data includes at least one of the following: application type, security level, and session validity period.

6. A distributed unique identity generation system for a quantum secure network for implementing the method of any of claims 1-5, characterized in that, include: The ID generator, deployed at each quantum key distribution node, is used to generate a unique identifier for the quantum keybook and / or an application session identifier according to a preset identifier structure, based on the active node number of the active node, the passive node number of the passive node interacting with the active node, the current timestamp, and the keybook sequence number and / or application sequence number assigned by the sequence number management module. The Autonomous System Management (AS / RS) module, deployed on the core management node of the quantum-safe network, is used to perform the allocation and management of AS / RS numbers, as well as the maintenance of the network topology; the AS / RS module is also used to support the creation, deletion, and configuration of virtual autonomous systems. The time synchronization module is used to achieve accurate time synchronization of all nodes in the network, providing a unified current timestamp for identifier generation; The serial number management module, deployed at each quantum key distribution node, is used to manage the allocation and use of the codebook serial number and the application serial number; Both the active node number and the passive node number adopt a hierarchical structure. The hierarchical structure includes an autonomous domain number and an intra-domain node number. The autonomous domain number is used to identify the autonomous domain to which the node belongs, and the intra-domain node number is used to identify the unique identity of the node within its autonomous domain.

7. The distributed unique identity generation system for a quantum secure network of claim 6, wherein, The serial number management module maintains an independent password book serial number counter and an application serial number counter for each node. At the beginning of each second, both the password book serial number counter and the application serial number counter are reset to 0, and increment sequentially as identifiers are generated. When the password book serial number counter or the application serial number counter reaches its maximum value, it automatically waits for the next second before assigning serial numbers.

8. The distributed unique identity generation system for a quantum secure network of claim 6, wherein, The ID generator generates the identifier locally without needing to interact with other nodes on the network. After generating the identifier, the ID generator also verifies the uniqueness of the generated identifier. Once the verification is successful, the identifier is associated with the corresponding quantum cryptography or application session and stored, and synchronized to the autonomous region management module.

9. The distributed unique identity generation system for a quantum secure network of claim 6, wherein, The time synchronization module performs periodic synchronization with a standard time source based on a network time protocol; in scenarios requiring high precision, the time synchronization module uses an enhanced network time protocol for time synchronization.

10. The distributed unique identity generation system for a quantum secure network of claim 6, wherein, After receiving a node registration request, the Autonomous System Management (ASM) module reads the physical autonomous system (PAS), virtual autonomous system (VAZ), node role, node public key, or device certificate information from the request and generates a candidate node number. It then queries the number lease table to determine if the candidate node number is within a valid lease period. If the candidate number is not occupied, it writes a lease record containing the node number, AAS number, VAZ number, intra-domain node number, node role, lease term, version number, and status flag, and returns the node number and lease certificate to the node. If the candidate number is already occupied, it reselects a candidate number from the intra-domain node number pool. The node generates an identifier locally during the lease validity period and sends a renewal request according to a preset cycle. When a node migrates, is deregistered, or exceeds the renewal period, the AAS module releases or freezes the corresponding number.

11. The distributed unique identifier generation system for quantum-safe networks according to claim 6, characterized in that, The generation process of the codebook identifier includes: First, the ID generator obtains the active node number of the current node and the passive node number of the target interactive node, and verifies that both are within a valid lease period. Then, the time synchronization module obtains the UTC second-level timestamp, and the logical time compensation algorithm handles clock rollback or time standstill. Next, the sequence number management module assigns the codebook sequence number within the current logical second, ensuring that the codebook sequence number is not repeated for the same active node, the same passive node, and within the same logical second. Subsequently, the security verification module calculates the security verification field based on the QKD key material, quantum random number, active node number, passive node number, timestamp, and codebook sequence number. Finally, the above fields are combined in a preset order to generate a 128-bit Codebook ID.

12. The distributed unique identity generation system for a quantum secure network of claim 6, wherein, The process of generating the application session identifier (App ID) includes: Basic distributed field generation: The first 80 bits of the App ID consist of a 16-bit autonomous system number, a 16-bit node number, a 32-bit timestamp, and a 16-bit application sequence number. The autonomous system number and node number come from valid node leases, the timestamp comes from a logical time compensation algorithm, and the application sequence number is assigned by an application sequence counter that increments within the current logical second. Complete App ID Extension: In addition to the basic distributed fields, an 8-bit application type, an 8-bit security level, a 16-bit session validity period, and a 16-bit security verification field are added to form a complete 128-bit App ID. The application type is used to distinguish business categories such as key application, remote control command, status reporting, and file transfer; the security level is used to identify the key strength, business priority, or security domain level required for the session; the session validity period is used to limit the available time range of the application session ID; the security verification field is calculated by the security verification tag generation algorithm based on QKD key material, quantum random numbers, and the aforementioned fields, and is used to quickly verify the integrity and authenticity of the App ID.

Images