A lightweight quantum key injection method for internet of things terminals

Abstract

The application discloses a kind of lightweight quantum key injection methods for Internet of Things terminal, it is related to information security field, including: constructing one-way serial physical link, all Internet of Things terminals to be injected are sequentially head-to-tail cascaded, each terminal has input forwarding and local cache capacity simultaneously;Continuous uninterrupted quantum random bit stream is generated, and continuously injected from the input port of the first terminal at the link head;The application supports Internet of Things terminal series connection batch key synchronization injection, simplifies field deployment operation and maintenance, can be adapted to multiple terminal key configuration according to security level, resists transmission error code interference, can prevent tampering and leakage after key solidification, network terminal change can be adaptively adjusted, global check can be used to check exception and automatically re-inject, deployment efficiency and key security are considered.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically a lightweight quantum key injection method for Internet of Things (IoT) terminals. Background Technology

[0002] Quantum key technology, based on the principles of quantum mechanics, possesses unconditionally secure confidentiality characteristics, which can completely avoid security risks such as eavesdropping and tampering of communication data. It is a core technology direction for adapting to the security protection of the Internet of Things. As the Internet of Things is applied across the entire domain, various lightweight terminal devices are widely deployed in core scenarios such as sensing and transmission. These terminals have simplified hardware configurations and generally have inherent characteristics such as limited computing power, small storage space, and low power consumption.

[0003] The invention patent application with application number 202410940188.1 discloses a secure and lightweight networking and communication method based on quantum key distribution. This application designs a quantum key networking and communication mechanism for IoT scenarios, which can realize quantum key distribution and secure communication between IoT nodes, and adapts to the secure transmission requirements of IoT to a certain extent.

[0004] However, in this technical scenario, the existing mainstream technical solutions have redundant architectures and high resource consumption, making them unsuitable for resource-constrained IoT terminals and unable to support efficient batch key injection.

[0005] To address this, we propose a lightweight quantum key injection method for IoT terminals. Summary of the Invention

[0006] In view of the above-mentioned shortcomings of the existing technology, the present invention provides a lightweight quantum key injection method for Internet of Things terminals, which can effectively solve the problems of the existing technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions; This invention discloses a lightweight quantum key injection method for Internet of Things (IoT) terminals, comprising: A unidirectional serial physical link is constructed, and all IoT terminals to be injected are cascaded end-to-end in sequence. Each terminal has both input forwarding and local buffering capabilities. A continuous and uninterrupted quantum random bit stream is generated and continuously injected from the input port of the first terminal at the beginning of the link. In the initial state, each terminal forwards all bit streams received at the input port to the output port without modification, and simultaneously copies them and stores them in its local buffer. When the data length in the terminal's local buffer reaches the preset key length, the forwarding path from input to output is immediately cut off. The terminal solidifies the complete data block stored in its local buffer into a local quantum key, while keeping the input port closed. The generation and injection of the quantum random bit stream are maintained until the terminal at the end of the link completes key solidification, at which point the generation and injection of the quantum random bit stream are terminated.

[0008] Furthermore, the unidirectional serial physical link uses shielded differential twisted-pair cable with a characteristic impedance of 100Ω as the transmission medium. Each input and output port of the IoT terminal to be injected is equipped with an electrical isolation module, and the matching error between the characteristic impedance of the link and the input and output port impedances of all terminals is no greater than ±5%. At the beginning of the link, a quantum random bit stream and a global synchronization clock signal are generated synchronously. The quantum random bit stream and the global synchronization clock signal are transmitted synchronously through the same shielded differential twisted pair cable, and the transmission rate is completely consistent with the generation rate of the quantum random bit stream.

[0009] Furthermore, each IoT terminal to be injected is equipped with a phase-locked loop module to lock the local cache clock with the global synchronization clock signal. The phase-locking accuracy is not less than 100ps, so that the starting phase of the local cache write operation of all terminals is synchronized with the quantum random bit stream injection phase at the beginning of the link.

[0010] Furthermore, the preset key length is determined through joint dynamic calculation based on the terminal's security level, its concatenation position in the link, the measured cumulative transmission error rate, and the expected key lifetime. ; In the formula: For the first The preset key length for each terminal; This is the minimum key length supported by the system. This is the maximum key length supported by the system. The security level quantification value for the terminal is a positive integer ranging from 1 to N, where N is the highest security level supported by the system. The expected lifespan of the terminal quantum key; The lifecycle of the system's baseline key; Let be the measured cumulative transmission bit error rate at the k-th terminal location; This is the length coefficient for the safety level. For safety level nonlinear coefficients; For safety-error coupling coefficient.

[0011] Furthermore, the trigger time for the terminal to cut off the input-to-output forwarding path is jointly determined based on the terminal's preset key length, the quantum random bit stream transmission rate, the propagation delay of the link cable, the cascaded cumulative value of the forwarding processing delay of each terminal, and the phase-locked loop phase error compensation value: ; in, For the first The trigger time for cutting off the forwarding path of a terminal; For the generation and transmission rate of quantum random bit streams; The signal propagation delay per unit length of differential twisted pair; For the first The total length of the physical link between each terminal and the beginning of the link; For the first The latency of quantum random bit stream forwarding processing at each terminal; For the first Local cache write processing latency for each terminal; For the first The cumulative phase error of the phase-locked loop of each terminal; This is the frequency of the global synchronization clock signal.

[0012] Furthermore, the terminal's operation of solidifying the complete data block already stored in the local cache into a local quantum key follows the following rules: The terminal first performs a bit-by-bit parity check on the complete data block in the local cache. After the check passes, the complete data block is written to the independent key partition of the one-time programmable memory. Then, the one-time hardware write protection pin corresponding to the independent key partition is set to a permanent active level, prohibiting any subsequent write or erase operations on the independent key partition.

[0013] Furthermore, when a new or removed IoT terminal to be injected is added to the link, the link head automatically detects the change in the sequence number of the terminal at the link tail, reacquires the security level information of all terminals, calculates the corresponding preset key length and forwarding cutoff trigger time, and then restarts the generation and injection process of the quantum random bit stream.

[0014] Furthermore, before forwarding the quantum random bit stream, each terminal performs self-synchronizing forward error correction coding on the received bit stream. The length of the check bit in the coding is dynamically adjusted according to the measured transmission bit error rate at the terminal's location, with an adjustment range of 2 to 8 bits. Error correction coding uses a pseudo-random sequence generated from the first 16 bits of a quantum random bit stream as the coding base.

[0015] Furthermore, after all terminals have completed key encryption, a system-wide integrity verification is performed synchronously: The link headend generates a system integrity check value based on the solidified key, unique hardware identifier, and batch unique identifier of all terminals through position-related cyclic shift transformation and iterative XOR operation. This value is then sent to each terminal through an independent low-power check channel. Each terminal calculates its local check value and compares it with the received system integrity check value. Among them, system integrity check value ; In the formula: This is the overall integrity verification value for the system. This represents the total number of IoT terminals awaiting key injection that have completed key solidification in the current unidirectional serial physical link. This serves as a unique batch identifier for this quantum key injection operation; Initial values ​​are calculated for iterative calculation; To calculate up to the th The intermediate value of the iteration corresponding to each terminal; For the first The local quantum key has been solidified within each IoT terminal; For the first A unique hardware identifier for each IoT terminal; A fixed number of bits for the cyclic left shift is pre-configured for the system; Represents a binary sequence Perform a circular left shift operation; This is a bitwise XOR operation for binary data.

[0016] Furthermore, if the terminal's local verification value matches the system integrity verification value, the terminal permanently shuts down the physical receiving circuit of the input port, retaining only the encrypted reading interface of the local quantum key, and this reading interface can only be accessed after passing a preset identity authentication process; If the comparison is inconsistent, the terminal automatically erases the key data in the local cache and one-time programmable memory, and sends a re-injection request to the beginning of the link, triggering a new round of quantum key injection process.

[0017] Compared with the known prior art, the technical solution provided by this invention has the following beneficial effects: This invention constructs a unidirectional serial link by cascading terminals, enabling batch synchronous quantum key injection into IoT terminals. It is suitable for lightweight, resource-constrained scenarios, relying on time-synchronized transmission and precise sampling to ensure stable bitstream timing. It dynamically configures key length based on security level, transmission error rate, and key lifecycle, adapting to the security needs of terminals in different industries. It precisely controls the timing of path disconnection by comprehensively considering various link latency parameters, saving terminal storage resources. The error correction and verification bits are dynamically adjusted during transmission to effectively reduce the impact of errors on the key. Hardware locking protection is applied after key solidification to prevent key tampering and leakage. Adding or removing terminals to the link automatically recalculates parameters and restarts the injection process, adapting to flexible on-site networking. Global integrity verification can promptly identify transmission and injection anomalies, automatically initiating re-injection in case of anomalies. After verification compliance, key access permissions are tightened, effectively covering injection efficiency, hierarchical security, network adaptability, and end-to-end key security management. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0019] Figure 1 This is a flowchart illustrating a lightweight quantum key injection method for IoT terminals. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0021] The present invention will be further described below with reference to embodiments. Example

[0022] This embodiment presents a lightweight quantum key injection method for IoT terminals, such as... Figure 1 As shown, it includes: Construct a unidirectional serial physical link and cascade all IoT terminals to be injected sequentially, with each terminal having both input forwarding and local caching capabilities. The unidirectional serial physical link uses shielded differential twisted-pair cable with a characteristic impedance of 100Ω as the transmission medium. Each input and output port of the IoT terminal to be injected is equipped with an electrical isolation module, and the matching error between the characteristic impedance of the link and the input and output port impedances of all terminals is no greater than ±5%. At the beginning of the link, a quantum random bit stream and a global synchronization clock signal are generated synchronously. The quantum random bit stream and the global synchronization clock signal are transmitted synchronously through the same shielded differential twisted pair cable, and the transmission rate is completely consistent with the generation rate of the quantum random bit stream. The synchronous transmission of the quantum random bit stream and the global synchronization clock signal is achieved using time-division multiplexing with time slot alignment. Each global synchronization clock cycle is divided into two consecutive and non-overlapping time slots. The first time slot transmits the rising edge pulse of the global synchronization clock signal, and the second time slot transmits one quantum random bit stream data. In practical applications, the global synchronization clock cycle can be set to the range of 125ns~1μs according to the key injection rate requirements of the IoT terminal. The two non-overlapping time slots within the clock cycle are divided in a 1:1 equal width manner, with each time slot occupying half of the global clock cycle duration. The clock rising edge pulse is sent only at a fixed position at the beginning edge of the first time slot, without occupying additional bit transmission resources. The second time slot is strictly limited to carrying only a single bit of quantum random data. A fixed isolation interval is set between the time slots to avoid crosstalk between the clock signal and the data bits. After detecting the rising edge of the global synchronization clock signal, all terminal input ports sample and latch the quantum random bit stream data after a delay of 1 / 4 clock cycle. Each IoT terminal to be injected is equipped with a phase-locked loop module to lock the local cache clock with the global synchronization clock signal. The phase-locking accuracy is not less than 100ps, so that the starting phase of the local cache write operation of all terminals is synchronized with the quantum random bit stream injection phase at the beginning of the link. A continuous, uninterrupted stream of quantum random bits is generated and continuously injected from the first terminal input port at the beginning of the link; In the initial state, each terminal forwards all bit streams received at the input port to the output port without modification, and at the same time copies them to the local buffer; When the length of the data cached locally on the terminal reaches the preset key length, the forwarding path from input to output is immediately cut off; The preset key length is determined dynamically and jointly based on the terminal's security level, its concatenation position in the link, the measured cumulative transmission error rate, and the expected key lifespan. ; In the formula: For the first The preset key length for each terminal, in bits; The minimum key length supported by the system, in bits; The maximum key length supported by the system, in bits; The security level quantification value for the terminal is a positive integer ranging from 1 to N, where N is the highest security level supported by the system. The expected lifetime of the terminal quantum key is expressed in seconds (s). The system baseline key lifetime, measured in seconds, has a fixed value. ; Let be the measured cumulative transmission bit error rate at the k-th terminal location, with a value ranging from 0 to 1, and be the distance from the beginning of the link to the k-th terminal location. The cumulative bit error rate of all cable segments and forwarding nodes between the terminal input ports; This is the security level length coefficient, measured in bits, with a value range of 16 to 128. This is a nonlinear coefficient for the safety level, with a value ranging from 1.2 to 2.0, and is a positive real number. The safety-error coupling coefficient is dimensionless and ranges from 10 to 100 as a positive integer. The above formula integrates multiple practical influencing factors such as terminal security level, key lifecycle, and cumulative transmission error rate. It constructs the calculation logic based on the superposition of nonlinear security level weighting term, lifecycle logarithmic correction term, and error rate exponential decay term in the basic length interval. Through multi-coefficient linkage, it adapts to the security level gradient classification standard of IoT terminals in different industries. It abandons the traditional fixed key length configuration method and can adaptively output the matching key bit length according to the link transmission quality, terminal usage years, and confidentiality level, effectively balancing the security protection strength and resource consumption of terminals in different scenarios. in, Quantify the security requirements based on the terminal application scenario. The corresponding security levels 1 to 5 are consumer-grade general-purpose terminals, industrial control terminals, automotive-grade terminals, medical device terminals, and military-grade classified terminals, respectively. The key replacement cycle is determined based on the minimum of the terminal's design lifespan and the key replacement cycle, and then converted to seconds. Specifically, it corresponds to 1-3 years for consumer-grade general-purpose terminals, 3-5 years for industrial control terminals, 5-10 years for automotive-grade terminals, 3-8 years for medical equipment terminals, and 1-2 years for military-grade classified terminals. according to to The interval quantization, and varies with the security level The increase is linear, that is... ; ; , Indicates the maximum cumulative transmission error rate allowed by the system; The trigger time for the terminal to cut off the input-to-output forwarding path is jointly determined based on the terminal's preset key length, quantum random bit stream transmission rate, link cable propagation delay, the cascaded cumulative value of the forwarding processing delay of each terminal, and the phase-locked loop phase error compensation value: ; in, For the first The trigger time for cutting off the forwarding path of each terminal is measured in seconds, with the first rising edge of the global synchronization clock as the zero point of time. The generation and transmission rate of quantum random bit streams is expressed in bits per second. The signal propagation delay per unit length of differential twisted pair is expressed in seconds (s / m). For the first The total length of the physical link between each terminal and the beginning of the link, in meters; For the first The quantum random bit stream forwarding processing delay of each terminal, in seconds, is obtained from the terminal's factory calibration and stored in its local non-volatile memory. For the first The local cache write processing latency of each terminal, in seconds, is obtained from the terminal's factory calibration. For the first The cumulative phase error of the phase-locked loop of each terminal, in rad, is obtained by the phase-locked loop module in real time. This is the frequency of the global synchronization clock signal, measured in Hz. The above formula uses a global synchronization clock as the time reference. First, it determines the basic transmission duration based on the key length and bit stream transmission rate. Then, it uniformly deducts the cable propagation delay, the forwarding delay of the preceding terminal cascade, and the local buffer processing delay. At the same time, it introduces the phase error of the phase-locked loop to complete the accurate compensation of the clock synchronization deviation. It comprehensively eliminates the timing error caused by the accumulation of delay of multiple nodes in the serial cascade link and the clock phase offset. It accurately locates the time node when each terminal stops forwarding the bit stream, avoids the incomplete key buffer data due to timing deviation, and ensures the integrity of key data collection of each terminal. The terminal solidifies the complete data block already stored in the local cache into a local quantum key, while keeping the input port closed. The terminal's operation of solidifying the complete data block already stored in the local cache into a local quantum key follows the following rules: The terminal first performs a bit-by-bit parity check on the complete data block in the local cache. The bit-by-bit parity check process is as follows: count the total number of binary "1"s in the complete data block, compare the total number with the system's preset parity check rules, if the total number meets the preset parity check rules, the check is considered to have passed, otherwise the check is considered to have failed. After the check passes, the complete data block is written to the independent key partition of the one-time programmable memory. Then, the one-time hardware write protection pin corresponding to the independent key partition is set to a permanent active level, prohibiting any subsequent write or erase operations on the independent key partition. The generation and injection of the quantum random bit stream are maintained until the end of the link completes key solidification, at which point the generation and injection of the quantum random bit stream are terminated. After all terminals have completed key encryption, a system-wide integrity check is performed synchronously: The link headend generates a system integrity check value based on the solidified key, unique hardware identifier, and batch unique identifier of all terminals through position-related cyclic shift transformation and iterative XOR operation. This value is then sent to each terminal through an independent low-power check channel. Each terminal calculates its local check value and compares it with the received system integrity check value. Among them, system integrity check value ; In the formula: This is the overall system integrity check value, and its binary bit length is equal to... ; This represents the total number of IoT terminals awaiting key injection that have completed key solidification in the current unidirectional serial physical link. This is a unique batch identifier corresponding to this quantum key injection operation, randomly generated by the link headend before the key injection process begins, and its binary length is equal to... ; Initial values ​​are calculated for iterative calculation; To calculate up to the th The intermediate value corresponding to each terminal. Let be the sequential number of the terminal in the link, and let its value be a positive integer that satisfies . ; For the first The local quantum key that has been permanently embedded in each IoT terminal has a bit length equal to... ; For the first Each IoT terminal has a unique hardware identifier, the length of which is equal to [missing information - likely a number]. ; The fixed number of bits for the circular left shift is pre-configured for the system and is a positive integer; Represents a binary sequence Perform a circular left shift operation if the shifted number of bits is greater than the binary sequence. Total bit length Then the number of shifts is used to pair The result after modulo is used as the actual number of bits shifted. This is a bitwise XOR operation for binary data. The above formula uses the unique identifier of the key injection batch as the initial value for iteration. After performing a bitwise XOR operation on the solidified key of each terminal and the unique hardware identifier, it combines a fixed-bit cyclic left shift operation to iteratively update the intermediate verification value step by step. Finally, it gathers all terminal information to generate a global verification value. It adopts lightweight operations such as cyclic shift and XOR to adapt to the low computing power hardware characteristics of IoT terminals, deeply binds batch information, terminal keys, and hardware identities, supports independent local recalculation of verification results by terminals, and can efficiently identify problems such as key injection anomalies and tampering of link data transmission. It achieves integrity and trustworthy verification of the entire chain key system under the premise of low power consumption. in, For the length of the quantum key stored in a single terminal, during the terminal's local verification value calculation stage, the terminal first obtains the batch unique identifier B corresponding to this key injection, the total number of terminals in the link M, and the system's preset fixed cyclic left shift number. Each terminal within the link has a sequential number, a fixed quantum key, and a unique hardware identifier; the batch unique identifier B is used as the initial value for iteration. According to the above calculation formula, the step-by-step iterative operation is performed on all terminals in the link in sequence. During the iteration process, the rules of cyclic left shift, bit-by-bit XOR and modulo of the number of shift bits are strictly followed. The final result obtained after completing all M-order iterations is the local check value. The terminal compares the calculated local check value with the system integrity check value received from the check channel. If they match, the integrity check is successful; if they do not match, it is determined that there is an anomaly in key injection or data transmission. When a new IoT terminal to be injected is added or removed from the link, the link head automatically detects the change in the serial number of the terminal at the link tail, reacquires the security level information of all terminals and calculates the corresponding preset key length and forwarding cutoff trigger time, and then restarts the generation and injection process of quantum random bit stream. Among them, the security level information is pre-stored in the parameter partition of the one-time programmable memory of each IoT terminal to be injected, including the terminal security level quantification value and the expected life cycle of the key. The link head end broadcasts the security level query command to all terminals through a unidirectional serial physical link. After receiving the query command, each terminal returns the locally stored security level information to the link head end through an independent low-power feedback channel. Before forwarding the quantum random bit stream, each terminal performs self-synchronizing forward error correction coding on the received bit stream. The length of the code check bits is dynamically adjusted according to the measured transmission bit error rate at the terminal location, with an adjustment range of 2 to 8 bits. Error-correcting coding uses a pseudo-random sequence generated from the first 16 bits of a quantum random bit stream as the coding base; The execution flow of self-synchronous forward error correction coding is as follows: The terminal first extracts the first 16 bits of the received quantum random bit stream. Using these 16 bits as a random seed, a pseudo-random sequence is generated, and this pseudo-random sequence is set as the encoding basis for this encoding. The pseudo-random sequence is generated using the Linear Feedback Shift Register (LFSR) algorithm, with the extracted 16-bit quantum random bit stream used as the initial seed value for the register. The register order is fixed at 16. The bit stream is divided into 8-bit blocks, and regardless of the parity bit length (which can be any value between 2 and 8 bits), each original data block remains 8 bits. The corresponding dynamically adjusted error correction check bits are added, and after framing, fixed-length data packets are formed and forwarded downstream. Then, combined with the transmission bit error rate measured at the corresponding link position of this terminal, the length of the check bits used for this encoding is determined within the range of 2 bits to 8 bits. Then, using the encoding base as the operation basis, the received quantum random bit stream is processed into groups, and error correction check bits are generated group by group according to the determined check bit length. Finally, the original quantum random bit stream and the corresponding error correction check bits are framed and integrated to obtain the encoded bit stream, and the terminal forwards the framed bit stream to the downstream terminal. If the terminal's local verification value matches the system integrity verification value, the terminal will permanently shut down the physical receiving circuit of the input port, retaining only the encrypted reading interface of the local quantum key, and this reading interface can only be accessed after passing a preset identity authentication process. If the comparison is inconsistent, the terminal automatically erases the key data in the local cache and one-time programmable memory, and sends a re-injection request to the beginning of the link, triggering a new round of quantum key injection process.

[0023] The method described in the above embodiments can realize the synchronous injection of quantum keys in batches of IoT terminals, eliminating the need for individual configuration of each terminal, simplifying on-site deployment and maintenance, dynamically matching the key length according to the application security level, adapting to various terminal scenarios such as consumer, industrial, automotive, medical, and military, autonomously correcting errors during transmission to resist line error interference, hardware locking after key solidification to prevent tampering and leakage, automatic parameter adaptation and restart injection when adding or removing terminals in the network, and global verification to quickly identify anomalies and autonomously initiate re-injection, effectively improving key deployment efficiency, scenario adaptability, and operational security.

[0024] See the method example in the above embodiments for an application example of this method: In this embodiment, the method is applied to the IoT integrated networking scenario of a large industrial park. The park deploys IoT terminal devices covering five security levels, specifically including consumer-grade general environmental sensing terminals, conventional industrial control terminals, park logistics vehicle-grade terminals, factory medical support monitoring terminals, and park military-related security terminals. The system sets the highest security level to 5, which corresponds to and matches the five types of terminals one by one.

[0025] First, based on the system plan, a hardware transmission architecture was built. A unidirectional serial physical link was constructed using shielded differential twisted-pair cable with a characteristic impedance of 100 ohms. Twelve different types of IoT terminals within the park were cascaded sequentially according to their deployment locations. Each IoT terminal awaiting key injection had a dedicated electrical isolation module configured for both its input and output ports. Simultaneously, the matching error between the link's characteristic impedance and the impedances of all terminal input and output ports was strictly controlled, keeping the error within ±5%. High-speed digital opto-isolation modules with an insulation withstand voltage of no less than 2500Vrms were used for the terminal input and output ports, employing capacitive isolation coupling to achieve lossless differential signal transmission. Link impedance matching adopted a design using parallel precision matching resistors at each terminal input port. High-precision impedance matching resistors were connected in parallel at each terminal input port, fine-tuning the port impedance to align with the characteristic impedance of the 100Ω shielded differential twisted-pair cable, controlling the overall impedance matching error within ±5%, and suppressing signal reflection and transmission ringing interference. A quantum random bit stream generator is deployed at the beginning of the link. This device synchronously generates a quantum random bit stream and a global synchronization clock signal. Both signals are transmitted synchronously via the same shielded differential twisted-pair cable using time-division multiplexing with time slot alignment, ensuring the transmission rate is completely consistent with the original generation rate of the quantum random bit stream. In actual deployment, each global synchronization clock cycle is divided into two consecutive, non-overlapping time slots. The first time slot transmits the rising edge pulse of the global synchronization clock signal, and the second time slot transmits one quantum random bit stream data. All IoT terminal input ports, upon detecting the rising edge of the global synchronization clock signal, delay by a quarter clock cycle to sample and latch the quantum random bit stream data. Each IoT terminal integrates a phase-locked loop (PLL) module. This module performs phase-locked calibration between the terminal's local cache clock and the global synchronization clock signal, achieving a stable phase-locking accuracy of 100 picoseconds. This ensures that the starting phase of all terminal local cache write operations is precisely synchronized with the injection phase of the quantum random bit stream at the beginning of the link. It should be noted that: The terminal adopts a low-power all-digital phase-locked loop architecture, which is adapted to the lightweight and low-power hardware characteristics of IoT terminals. The phase-locked loop adopts a two-stage synchronization mechanism of coarse acquisition and fine locking. In the coarse acquisition stage, the global synchronization clock frequency range is quickly identified and frequency pulling alignment is completed. In the fine locking stage, the local cache clock phase is finely adjusted step by step in 1ps until the phase deviation with the injected phase at the beginning of the link is stably controlled within 100ps. The clock drift is continuously tracked in real time and the phase error is dynamically compensated.

[0026] The system is pre-set to support a minimum key length of 256 bits and a maximum key length of 2048 bits, with a fixed base key lifespan of 31,536,000 seconds. Combining the security level quantification of each terminal, the link cascading layout, the measured cumulative transmission error rate of the link, and the expected key lifespan, the preset key length for each terminal is dynamically calculated. Specifically, the preset key length for Level 1 consumer-grade general-purpose terminals is 320 bits, for Level 2 industrial control terminals it is 512 bits, for Level 3 automotive-grade logistics terminals it is 896 bits, for Level 4 medical equipment monitoring terminals it is 1280 bits, and for Level 5 military-grade classified security terminals it is 1792 bits. The expected key lifecycle for various terminals is strictly converted to seconds according to scenario specifications: 2 years for consumer-grade general terminals, 4 years for industrial control terminals, 8 years for automotive-grade terminals, 5 years for medical equipment terminals, and 1.5 years for military-grade classified terminals. The security level length coefficient, security level nonlinearity coefficient, and security-error coupling coefficient are all quantitatively adapted according to the system's set interval rules to match the parameter characteristics of each level of terminal. The maximum cumulative transmission error rate measured in the link also meets the value constraints of the security-error coupling coefficient.

[0027] According to the system rules, and taking into account the preset key length of each terminal, the fixed transmission rate of the quantum random bit stream, the propagation delay of the differential twisted pair signal per unit length, the cumulative value of the cascaded forwarding processing delay of each terminal, the local cache write processing delay of the terminal, and the phase-locked loop phase error compensation value, the trigger time for cutting off the forwarding path of each terminal is uniformly calculated. The first rising edge of the global synchronization clock is taken as the time zero point. The trigger time of the first terminal on the link is 0.002 seconds, the trigger time of the second terminal is 0.0035 seconds, the trigger time of the third terminal is 0.0051 seconds, and the trigger time of the remaining terminals are determined according to their own link position and hardware parameters. When the terminal reaches the preset trigger time, it immediately cuts off the bit stream forwarding path from its input port to its output port.

[0028] In its initial working state, the terminal forwards the quantum random bit stream received at the input port downstream without modification, while simultaneously copying and storing the data to its local cache. Once the length of the local cached data reaches the preset key length calculated earlier, the forwarding path is immediately cut off. Subsequently, the terminal performs bit-by-bit parity checking on the complete data block in its local cache. By comparing the total number of binary '1's in the data block with the system's preset parity check rules, the parity check results for all 12 IoT terminals in the park were deemed successful. The system uniformly uses an even parity check rule as the benchmark: if the total number of binary '1's in the complete data block is even, the check is considered successful; if it is odd, the check fails. If the check fails, the terminal automatically discards the current cached data block, keeps the forwarding path open, continues forwarding the bit stream downstream, and re-caches the local cache until a complete key data block satisfying the even parity check rule is collected before the hardening operation can be performed. After successful verification, the terminal writes the complete block of quantum random bit data from its local cache into a dedicated key partition of its one-time programmable memory. Then, it sets the one-time hardware write protection pin corresponding to this key partition to a permanently active level, completely prohibiting any subsequent write or erase operations on this key partition. The beginning of the link maintains continuous generation and injection of the quantum random bit stream until the 12th terminal at the end of the serial link completes its key-writing operation, at which point the system terminates the generation and injection process of the quantum random bit stream.

[0029] During the operation and maintenance of IoT links in the park, if two new industrial control terminals are added to the serial physical link, the link head-end device can automatically detect the change in the terminal sequence number at the end of the link and then broadcast a security level query command to all terminals through the unidirectional serial physical link. After receiving the query command, each terminal transmits the security level quantization value, expected key lifespan, and other information pre-stored in the parameter partition of the one-time programmable memory back to the link head-end via an independent low-power feedback channel. The head-end device then recalculates the preset key length and forwarding path cutoff trigger time for all 14 terminals. After the parameters are verified, the quantum random bit stream generation and injection process is automatically restarted to solidify the key configuration of the new terminals. Similarly, if two old and idle consumer-grade general-purpose terminals are removed from the link later, the system can automatically recognize the change in the number of terminals, recalculate the parameters, and start a new round of key injection process to adapt to the dynamic networking requirements of adding and removing links.

[0030] Before forwarding the quantum random bit stream downstream, each IoT terminal performs self-synchronizing forward error correction coding on the received bit stream. The length of the code parity bit is dynamically adjusted based on the measured transmission bit error rate at the terminal's link location, maintaining an adjustment range between 2 and 8 bits. In actual operation, the terminal first extracts the first 16 bits of the currently received quantum random bit stream, uses this data as a random seed to generate a pseudo-random sequence, and sets it as the coding base for this encoding. Combining the measured bit error rate of the link, terminals with low bit error rate at the front end of the link uniformly use a 4-bit parity bit length, while terminals with high cumulative bit error rate at the back end of the link use a 7-bit parity bit length. Using the coding base as the calculation basis, the terminal groups the received quantum random bit stream, generates error correction parity bits group by group according to the selected parity bit length, then frames and integrates the original quantum random bit stream with the corresponding error correction parity bits, and finally forwards the encoded and framed bit stream to downstream IoT terminals, ensuring the error correction and fault tolerance capability of the bit stream transmission.

[0031] After all IoT terminals have completed key solidification, the system synchronously initiates the overall integrity verification process. At the initial stage of key injection, the link headend randomly generates a unique batch identifier for this operation, with the identifier's binary bit length consistent with the quantum key bit length of a single terminal. Subsequently, the link headend combines the solidified keys of all terminals, the unique hardware identifier of the device, and the batch unique identifier, using a position-dependent cyclic shift transformation and iterative XOR operation to generate a system integrity verification value. The system presets a fixed cyclic left shift bit of 16 bits. After the operation, a unique overall system integrity verification value is obtained and distributed to each IoT terminal through an independent low-power verification channel. The system's fixed cyclic left shift bit n0 has a general value range of 8 to 32 bits and is an integer multiple of 8, with 16-bit and 24-bit standard configurations preferred. When the terminal key length is not equal to an integer multiple of n0, the modulo operation is strictly performed according to the formula, using the shift bit number modulo the key bit length. The modulo result is used as the actual cyclic left shift bit, ensuring that terminals with different key lengths can uniformly adapt to the iterative verification operation rules. Each terminal locally acquires its batch unique identifier, total number of terminals in the link, fixed left shift bit, link sequence number of each terminal, its own embedded quantum key, and unique hardware identifier. Using the batch unique identifier as the initial value for iterative calculation, and strictly following the rules of left shift, bitwise XOR, and modulo shift bit, it completes the iterative calculation of the entire link terminal step by step. After the calculation, the local integrity verification value of the terminal is obtained. The local verification values ​​calculated by all terminals in the park completely match the integrity verification values ​​issued by the system, and the overall integrity verification of the system is judged to be qualified.

[0032] IoT terminals that pass integrity verification will permanently shut down the physical receiving circuit of their input ports, retaining only the encrypted reading interface for their local quantum keys. This reading interface must pass a dual pre-set authentication process involving device hardware identity and campus network permissions before it can read keys and make encrypted service calls. If artificially simulated link transmission interference or abnormal bit stream forwarding causes a discrepancy between a terminal's local verification value and the system integrity verification value, the terminal will automatically erase all key data stored in its local cache and one-time programmable memory. Simultaneously, it will proactively send a key re-injection request to the link headend. Upon receiving the request, the system will immediately initiate a new round of quantum random bit stream generation, link injection, terminal key solidification, and system integrity verification.

[0033] In summary, the method described in the above embodiments constructs a unidirectional serial link by cascading terminals, enabling batch synchronous quantum key injection into IoT terminals. It is suitable for lightweight, resource-constrained terminal scenarios, relies on time-synchronized transmission and precise sampling to ensure stable bitstream timing, and dynamically configures key length based on security level, transmission error rate, and key lifecycle to meet the security needs of terminals in different industries. It comprehensively controls the timing of path disconnection by considering various latency parameters of the link, saving terminal storage resources. Dynamic adjustment of error correction and verification bits during transmission effectively reduces the impact of errors on the key. Hardware locking protection is implemented after key solidification to prevent key tampering and leakage. Adding or removing terminals to the link automatically recalculates parameters and restarts the injection process, adapting to flexible on-site networking. Global integrity verification can promptly identify transmission and injection anomalies, automatically initiating re-injection in case of anomalies. After verification compliance, key access permissions are tightened, effectively covering injection efficiency, hierarchical security, network adaptability, and end-to-end key security management.

[0034] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A lightweight quantum key injection method for Internet of Things (IoT) terminals, characterized in that, include: Construct a unidirectional serial physical link and cascade all IoT terminals to be injected sequentially, with each terminal having both input forwarding and local caching capabilities. A continuous, uninterrupted stream of quantum random bits is generated and continuously injected from the first terminal input port at the beginning of the link; In the initial state, each terminal forwards all bit streams received at the input port to the output port without modification, and at the same time copies them to the local buffer; When the length of the data cached locally on the terminal reaches the preset key length, the forwarding path from input to output is immediately cut off; The terminal solidifies the complete data block already stored in the local cache into a local quantum key, while keeping the input port closed. The generation and injection of the quantum random bit stream are maintained until the end of the link completes key solidification, at which point the generation and injection of the quantum random bit stream are terminated.

2. The lightweight quantum key injection method for IoT terminals according to claim 1, characterized in that, The unidirectional serial physical link uses shielded differential twisted-pair cable with a characteristic impedance of 100Ω as the transmission medium. Each input and output port of the IoT terminal to be injected is equipped with an electrical isolation module, and the matching error between the characteristic impedance of the link and the input and output port impedances of all terminals is no greater than ±5%. At the beginning of the link, a quantum random bit stream and a global synchronization clock signal are generated synchronously. The quantum random bit stream and the global synchronization clock signal are transmitted synchronously through the same shielded differential twisted pair cable, and the transmission rate is completely consistent with the generation rate of the quantum random bit stream.

3. A lightweight quantum key injection method for IoT terminals according to claim 2, characterized in that, Each IoT terminal to be injected is equipped with a phase-locked loop module to lock the local cache clock with the global synchronization clock signal. The phase-locking accuracy is not less than 100ps, so that the starting phase of the local cache write operation of all terminals is synchronized with the quantum random bit stream injection phase at the beginning of the link.

4. A lightweight quantum key injection method for IoT terminals according to claim 1, characterized in that, The preset key length is determined dynamically based on the terminal's security level, its concatenation position in the link, the measured cumulative transmission error rate, and the expected key lifespan. ； In the formula: For the first The preset key length for each terminal; This is the minimum key length supported by the system. This is the maximum key length supported by the system. The security level quantification value for the terminal is a positive integer ranging from 1 to N, where N is the highest security level supported by the system. The expected lifespan of the terminal quantum key; The lifecycle of the system's baseline key; Let be the measured cumulative transmission bit error rate at the k-th terminal location; This is the length coefficient for the safety level. For safety level nonlinear coefficients; For safety-error coupling coefficient.

5. A lightweight quantum key injection method for IoT terminals according to claim 4, characterized in that, The trigger time for the terminal to cut off the input-to-output forwarding path is determined jointly based on the terminal's preset key length, quantum random bit stream transmission rate, link cable propagation delay, the cascaded cumulative value of the forwarding processing delay of each terminal, and the phase-locked loop phase error compensation value: ； in, For the first The trigger time for cutting off the forwarding path of a terminal; For the generation and transmission rate of quantum random bit streams; The signal propagation delay per unit length of differential twisted pair; For the first The total length of the physical link between each terminal and the beginning of the link; For the first The latency of quantum random bit stream forwarding processing at each terminal; For the first Local cache write processing latency for each terminal; For the first The cumulative phase error of the phase-locked loop of each terminal; This is the frequency of the global synchronization clock signal.

6. A lightweight quantum key injection method for IoT terminals according to claim 1, characterized in that, The terminal's operation of solidifying the complete data block already stored in the local cache into a local quantum key follows the following: The terminal first performs a bit-by-bit parity check on the complete data block in the local cache. After the check passes, the complete data block is written to the independent key partition of the one-time programmable memory. Then, the one-time hardware write protection pin corresponding to the independent key partition is set to a permanent active level, prohibiting any subsequent write or erase operations on the independent key partition.

7. A lightweight quantum key injection method for IoT terminals according to claim 1, characterized in that, When a new IoT terminal to be injected is added or removed from the link, the link head automatically detects the change in the serial number of the terminal at the link tail, reacquires the security level information of all terminals, calculates the corresponding preset key length and forwarding cutoff trigger time, and then restarts the generation and injection process of the quantum random bit stream.

8. A lightweight quantum key injection method for IoT terminals according to claim 2, characterized in that, Before forwarding the quantum random bit stream, each terminal performs self-synchronizing forward error correction coding on the received bit stream. The length of the code check bits is dynamically adjusted according to the measured transmission bit error rate at the terminal location, with an adjustment range of 2 to 8 bits. Error correction coding uses a pseudo-random sequence generated from the first 16 bits of a quantum random bit stream as the coding base.

9. A lightweight quantum key injection method for IoT terminals according to claim 6, characterized in that, After all terminals have completed key encryption, a system-wide integrity check is performed synchronously: The link headend generates a system integrity check value based on the solidified key, unique hardware identifier, and batch unique identifier of all terminals through position-related cyclic shift transformation and iterative XOR operation. This value is then sent to each terminal through an independent low-power check channel. Each terminal calculates its local check value and compares it with the received system integrity check value. Among them, system integrity check value ; In the formula: This is the overall integrity verification value for the system. This represents the total number of IoT terminals awaiting key injection that have completed key solidification in the current unidirectional serial physical link. This serves as a unique batch identifier for this quantum key injection operation; Initial values ​​are calculated for iterative calculation; To calculate up to the th The intermediate value of the iteration corresponding to each terminal; For the first The local quantum key has been solidified within each IoT terminal; For the first A unique hardware identifier for each IoT terminal; A fixed number of bits for the cyclic left shift is pre-configured for the system; Represents a binary sequence Perform a circular left shift operation; This is a bitwise XOR operation for binary data.

10. A lightweight quantum key injection method for IoT terminals according to claim 9, characterized in that, If the terminal's local verification value matches the system integrity verification value, the terminal will permanently shut down the physical receiving circuit of the input port, retaining only the encrypted reading interface of the local quantum key, and this reading interface can only be accessed after passing a preset identity authentication process. If the comparison is inconsistent, the terminal automatically erases the key data in the local cache and one-time programmable memory, and sends a re-injection request to the beginning of the link, triggering a new round of quantum key injection process.

Images