A quantum key resource pool protection method and system for a fiber ring network

Abstract

The present application relates to quantum secure communication and power industrial control system network security technical field, especially relates to a kind of quantum key resource pool protection method for optical fiber ring network, comprising: S1, between KMS and QKD equipment, the key injection channel of physical isolation is established, and quantum key is continuously written into local key resource pool;S2, for each communication node pair, establish independent key subpool and give unique communication pair identifier;S3, terminal equipment carries communication pair identifier to KMS and initiates transparent key call by standardized interface;S4, KMS monitors subpool balance in real time;S5, key resource pool operation is protected using hash chain mechanism.The present application can provide quantum key protection for all communication pairs in ring network with a set of QKD equipment;Meet the real-time requirements of industrial control system, can be transparently accessed;Communication pair partition mechanism provides fine-grained key isolation;Dynamic water level threshold mechanism guarantees the continuity of key supply under abnormal scenario.

Description

Technical Field

[0001] This invention relates to the fields of quantum secure communication technology, power monitoring system network security technology, and industrial control system communication security technology, and particularly to a quantum key resource pool protection method and system for fiber optic ring networks. Background Technology

[0002] With the rapid development of quantum computing technology, quantum algorithms, represented by Shor's algorithm, pose a fundamental threat to existing public-key cryptosystems such as RSA and ECC. Attackers utilize the store-and-decrypt strategy (HNDL) to intercept and store large amounts of encrypted data before quantum computers mature, and then decrypt it in bulk once quantum computers are available. For communication data in the production control areas of power plants, this includes highly sensitive real-time control information such as unit control commands, grid dispatch orders, and flood control dispatch decisions. If this information is compromised, it will pose a serious threat to the safe and stable operation of the power system.

[0003] Quantum Key Distribution (QKD) technology is based on the fundamental principles of quantum mechanics. It utilizes the non-cloning and measurement collapse properties of quantum states to establish a shared key with information theory security guarantees between the two communicating parties, fundamentally resisting the threat of quantum computing.

[0004] The communication network within the production control area of ​​a power plant typically adopts a fiber optic ring bus topology. Taking a wind farm as an example, the on-site monitoring host is connected to the control units (Wind Turbine Controllers, WTCs) of dozens or even hundreds of wind turbines via a fiber optic ring network; hydropower plants connect multiple units' local control units (LCUs) via a ring bus; and energy storage power stations connect multiple subsystems such as the energy storage management system (EMS), battery management system (BMS), and power conversion system (PCS) via a ring network. These networks typically have the following characteristics: (1) Multi-node nature: There are usually several to dozens of peer communication nodes on a single ring network, and each node needs to establish an independent encrypted communication channel with the monitoring host.

[0005] (2) Ring topology: It adopts a physical or logical ring connection, with inherent redundant paths, and can maintain communication continuity in the event of a single point of failure.

[0006] (3) Real-time controllability: The services transmitted on the ring network include SCADA monitoring, AGC control, AVC reactive power regulation and relay protection, which have extremely strict requirements for communication delay, usually requiring end-to-end delay in the millisecond range.

[0007] (4) Equipment diversity: The ring network contains existing industrial control equipment that has been deployed for many years. These devices have different computing resources and interface forms, and some old devices cannot support complex cryptographic algorithms.

[0008] Existing quantum key distribution (QKD) technologies and related key management schemes are primarily designed for point-to-point communication scenarios, i.e., establishing a quantum channel between two fixed endpoints for key negotiation. Applying existing QKD technology directly to multi-node fiber optic ring networks faces the following fundamental technical obstacles: (1) Topology incompatibility: QKD quantum channels use dedicated optical fibers to transmit single photons or weak coherent optical pulses, and their transmission characteristics are inherently in conflict with the service communication channels shared by multiple nodes in a ring network. The physical mechanism of the QKD system determines that it can only realize key negotiation between two fixed endpoints and cannot directly serve multiple nodes in the middle of the ring network.

[0009] (2) Difficult deployment: If a separate QKD device is deployed for each communication pair in the ring network (such as between the monitoring host and each wind turbine), the number of devices will increase linearly with the number of communication pairs, resulting in extremely high deployment costs. For example, in a wind farm with 50 wind turbines, more than 50 QKD terminals need to be deployed within the farm alone, which is not feasible from an engineering perspective.

[0010] (3) Real-time performance cannot be guaranteed: The key generation process of existing QKD systems involves multiple steps such as quantum state preparation, transmission, measurement and classical post-processing. The key generation rate is usually on the order of kbps and there is a certain time delay. The control command transmission frequency of industrial control business is high. If the key acquisition method of instant application and instant use is adopted, the key waiting delay will seriously affect the real-time performance of the control system.

[0011] (4) Difficulty in compatibility with legacy equipment: A large number of existing industrial control equipment in the ring network do not have interfaces to directly interact with the QKD system, and existing solutions lack a transparent access mechanism for legacy equipment. Summary of the Invention

[0012] Existing technologies have not yet provided a systematic method to effectively solve the topology adaptation problem of QKD with multi-node fiber optic ring networks while simultaneously meeting the real-time requirements of industrial control systems and the compatibility needs of legacy equipment. This invention, a quantum key resource pool protection method and system for fiber optic ring networks, solves these core technical problems. This invention writes the quantum keys generated by a single quantum key distribution (QKD) device into the same physical key resource pool locally within a quantum key management system (KMS). Within this physical resource pool, logical partitioning and isolation management are implemented according to communication pairs. This allows the keys generated by a single QKD device to be shared and reused by all communication pairs in the ring network, thereby solving the topology adaptation problem caused by the linear binding between the number of QKD devices and communication pairs. While meeting the millisecond-level real-time requirements of industrial control systems, it provides quantum key-level security protection for all communication nodes in the ring network. This invention is applicable to scenarios where fiber optic ring bus networks are deployed within the production control area of ​​power plants, including but not limited to wind turbine control networks in wind farms, collector monitoring networks in photovoltaic power plants, LCU control networks in hydropower plants, and energy storage management system networks in energy storage power plants.

[0013] To achieve the objectives of this invention, the technical solution adopted is: a method for protecting a quantum key pool in an optical fiber ring network, comprising the following steps: S1. Establish a key injection channel between the quantum key management system (KMS) and the single quantum key distribution (QKD) device, and continuously write the quantum key generated by the QKD device through the key injection channel into the same physical key resource pool in the KMS to form a quantum key pre-storage. S2. Based on the topology of the fiber optic ring network, the same physical key resource pool is logically partitioned according to communication pairs. Each pair of communication nodes is divided into an independent key sub-pool, and a unique communication pair identifier is assigned to each key sub-pool, so that the quantum key generated by a single QKD device can be shared and reused by all communication pairs in the fiber optic ring network. S3. Terminal devices in the fiber optic ring network initiate key requests to KMS through a standardized key retrieval interface. The key request carries a communication pair identifier. KMS reads the key from the corresponding key sub-pool based on the communication pair identifier and returns the key to the requesting terminal device, completing the transparent key retrieval. S4 and KMS monitor the capacity status of each key sub-pool in real time. When the remaining amount of any key sub-pool is lower than the preset low water level threshold, the QKD replenishment mechanism is triggered, driving the QKD device to inject newly generated quantum keys into the corresponding key sub-pool until the remaining amount is restored to the preset high water level threshold. The low water level threshold and the high water level threshold are dynamically adjusted according to the real-time key generation rate of the QKD device and the historical key consumption rate of the corresponding key sub-pool. S5. All operations on the key resource pool are protected by a hash chain mechanism. An alarm is triggered and key distribution is suspended in case of an anomaly.

[0014] As an optimized solution of the present invention, in step S1, the key injection channel is physically isolated from the service communication channel of the optical fiber ring network; the quantum key pre-storage adopts a first-in-first-out queue structure, arranged in the order of quantum key generation time, and the earliest generated key is preferentially allocated to the terminal device to ensure key timeliness.

[0015] As an optimized solution of the present invention, in step S2, the partitioning of the key sub-pool is pre-configured according to the communication pair relationship in the optical fiber ring network. The communication pair relationship includes one-to-one communication pairs and one-to-many communication pairs. For the one-to-many communication architecture, an independent key sub-pool is established between the master node and each slave node. The key sub-pools of each slave node are isolated from each other, and the key call of the master node does not affect the key supply of other slave nodes. The access control of the key sub-pool adopts a whitelist mechanism based on the communication pair identifier. Each key sub-pool only allows authorized terminal devices in the corresponding communication pair to read the key. KMS verifies the correspondence between the requester device identifier and the key sub-pool communication pair identifier for each key call request. Requests that fail to verify are rejected and a security alarm is triggered.

[0016] As an optimized solution of the present invention, in step S3, the key call interface adopts a unified key service protocol; the key call interface further includes an interface adaptation unit, which is used to convert the original communication interface protocol of the deployed terminal equipment in the optical fiber ring network into the unified key service protocol, so that the deployed terminal equipment can access the key resource pool protection system without changing the hardware; the interface adaptation unit supports the adaptation and conversion of IEC 60870-5-101 / 104, DNP3 and Modbus industrial control communication protocols.

[0017] As an optimization of the present invention, the unified key service protocol supports three calling modes: one-time key (OTK) mode, session key mode, and batch key mode. The calling mode is selected by the terminal device according to the service type. In the one-time key (OTK) mode, each key call returns an independent key, which is immediately marked as consumed and deleted from the key sub-pool after use. In the session key mode, the key call returns a key that can be reused within the session validity period, which is reclaimed and destroyed by KMS after the session ends. In the batch key mode, the key call returns a preset number of key sequences at once. When key requests of multiple calling modes exist in the same key sub-pool at the same time, KMS prioritizes ensuring the capacity replenishment of the key sub-pool where the high-priority service request using the one-time key (OTK) mode is located.

[0018] As an optimized solution of the present invention, in step S4, the low water level threshold and the high water level threshold are dynamically adjusted according to the following parameters: the real-time key generation rate of the QKD device, the historical key consumption rate of the terminal device served by the corresponding key sub-pool, and the current service load level; when the key generation rate of the QKD device drops below the preset minimum rate or the key injection channel is interrupted, the KMS automatically raises the low water level threshold of each key sub-pool from the initial set value to the preset emergency water level value, so as to increase the frequency of supplementary triggering and extend the available consumption time of each key sub-pool, and ensure the continuity of key supply.

[0019] As an optimized solution of the present invention, in step S5, the hash chain mechanism is specifically implemented as follows: for each operation record of the key resource pool, a log entry containing the operation type, operation timestamp, key identifier involved, key sub-pool identifier involved, and operation result summary is generated; the hash value of the previous log entry is used as the input of the current entry to participate in the hash calculation to form an immutable hash chain; when the verification finds that the hash chain is broken, the break position and the key sub-pool identifier to which it belongs are recorded, the key distribution of the key sub-pool is only suspended, and the break information is reported to the superior key management node.

[0020] To achieve the objectives of this invention, the technical solution adopted is: a system employing a quantum key pool protection method for fiber optic ring networks, comprising: A key injection module is connected to a single quantum key distribution (QKD) device. It is used to receive the quantum key generated by the QKD device through negotiation and continuously write the quantum key into the same physical key resource pool. The key injection channel between the key injection module and the QKD device is independent of the service communication channel of the optical fiber ring network. The key resource pool management module is used to perform logical partitioning management within the same physical key resource pool according to communication pairs. It divides an independent key sub-pool for each pair of communication nodes, maintains a mapping table of communication pair identifiers for each key sub-pool, enables the quantum key generated by a single QKD device to be shared and reused by all communication pairs in the fiber optic ring network, and monitors the capacity status of each key sub-pool in real time. The key invocation interface module is deployed at each terminal access point of the optical fiber ring network to receive key requests initiated by terminal devices. The key request carries a communication pair identifier. The key invocation interface module obtains the corresponding key from the key resource pool management module according to the identifier and returns it to the requesting terminal, so that the terminal device is unaware of the existence of the underlying QKD device and its link status during the key invocation process. The capacity monitoring and replenishment module is connected to the key resource pool management module and the QKD device. It is used to trigger a replenishment command when the remaining amount of any key sub-pool is lower than the preset low water level threshold, and drive the QKD device to inject quantum keys into the corresponding key sub-pool. The integrity protection module is used to protect the integrity of all operation records of the key resource pool using a hash chain mechanism. It periodically performs hash chain verification. When an anomaly is detected, it only notifies the key resource pool management module to suspend key distribution of the key sub-pool where the anomaly occurred and triggers an alarm. The key distribution of other key sub-pools is not affected.

[0021] As an optimized solution of the present invention, the key resource pool management module further includes a key lifecycle management unit, which is used to perform lifecycle management on the quantum keys stored in each key sub-pool of the key resource pool; the lifecycle management includes: forcibly destroying and triggering replenishment of keys that have exceeded the preset storage time limit; recycling and destroying keys that have been allocated but have not been consumed after exceeding the preset usage time limit; performing secure zeroing on the remaining amount of key sub-pools that have been consumed; and recording all destruction and recycling operations in the hash chain of the integrity protection module.

[0022] As an optimized solution of the present invention, the quantum key resource pool protection system also includes a topology adaptive module for monitoring topology changes in the optical fiber ring network. When a new terminal node is added to the ring network, the topology adaptive module automatically creates a key sub-pool for the new communication pair and triggers initialization injection. When a node leaves the ring network, the topology adaptive module automatically cancels the corresponding key sub-pool and securely clears all keys in it. Topology change events and corresponding key sub-pool operations are recorded in the hash chain of the integrity protection module.

[0023] This invention has the following positive effects: 1) This invention fundamentally solves the QKD topology adaptation problem. By uniformly writing the quantum keys generated by a single QKD device into the same physical key resource pool, and then logically partitioning the key source by communication pair, and centralizing and decoupling the key distribution design, the point-to-point key negotiation capability of QKD is transformed into the key supply capability for multi-node ring networks. This eliminates the transmission effect of QKD topology constraints on the terminal side, so that a single set of QKD devices can provide quantum key protection for all communication pairs in the ring network, without the need to linearly deploy QKD devices according to the number of communication pairs; 2) This invention meets the millisecond-level real-time requirements of industrial control systems. The key pre-storage mechanism allows terminal devices to directly read keys from the local key sub-pool when initiating a key request, without waiting for the real-time key negotiation process of the QKD system. The key retrieval latency can be reduced to below milliseconds, meeting the communication security requirements of high real-time services such as AGC control and relay protection.

[0024] 3) This invention enables transparent access for legacy devices. Terminal devices interact with KMS through a standardized key call interface, without being aware of the underlying QKD system. This allows existing industrial control equipment to access the quantum key protection system without hardware replacement, significantly reducing transformation costs and engineering complexity.

[0025] 4) This invention provides fine-grained communication pair key isolation. The communication pair partitioning mechanism establishes an independent key sub-pool for each pair of communication nodes, ensuring that the keys of different communication pairs are isolated from each other, preventing key contamination, and improving the overall security of the system.

[0026] 5) This invention provides highly reliable key supply continuity assurance. The dynamic water level threshold mechanism automatically raises the low water level threshold to a preset emergency water level value when the key generation rate of the QKD device decreases or the key injection channel is interrupted, extending the available consumption time of each key sub-pool and ensuring key supply continuity in short-term abnormal scenarios.

[0027] 6) This invention provides trusted auditing capabilities through hash chain integrity protection. Hash chain protection of all operation records in the key resource pool not only prevents key pool data from being tampered with, but also provides trusted operation records for security auditing, meeting the compliance auditing requirements of the power industry. Attached Figure Description

[0028] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0029] Figure 1 This is a diagram of the overall system architecture of the present invention, showing the functional modules of the quantum key resource pool protection system and their connection relationships with QKD devices and fiber optic ring network terminal devices; Figure 2 This is a schematic diagram of the partitioned key resource pool structure of the present invention, showing the organizational structure of each key sub-pool after partitioning by communication pair within the key resource pool and the mapping relationship of communication pair identifiers; Figure 3 This is a flowchart of the method of the present invention, illustrating the complete execution process of the quantum key resource pool protection method from key injection to integrity protection; Figure 4 This is a schematic diagram of the hash chain integrity protection structure of the present invention, showing the structural composition of operation log entries and the chain-like binding method of the hash chain. Detailed Implementation

[0030] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. These embodiments are for illustrative purposes only and should not be construed as limiting the scope of protection of the present invention.

[0031] This invention discloses a method for protecting quantum key pools in fiber optic ring networks, such as... Figure 3 As shown, it includes the following steps: Step S1 (Key Injection): A key injection channel is established between the Quantum Key Management System (KMS) and the single Quantum Key Distribution (QKD) device. The key injection channel is physically isolated from the service communication channel of the fiber optic ring network. The QKD device continuously writes the negotiated quantum keys into the same physical key resource pool on the KMS through the key injection channel. The quantum keys in the key resource pool are stored in a first-in-first-out (FIFO) queue structure and arranged in the order of quantum key generation time.

[0032] Step S2 (Partitioning and Pooling): Based on the topology of the fiber optic ring network, the same physical key resource pool is logically partitioned by communication pairs. An independent key sub-pool is created for each pair of communication nodes, and a unique communication pair identifier is assigned to each key sub-pool. This allows the quantum key generated by a single QKD device to be shared and reused by all communication pairs in the ring network without requiring a separate QKD device for each communication pair. For a one-to-many communication architecture, independent key sub-pools are created between the master node and each slave node, and the key sub-pools of each slave node are isolated from each other.

[0033] Step S3 (Transparent Invocation): The terminal device in the fiber optic ring network initiates a key request to the KMS through the standardized key invocation interface. The key request carries a communication pair identifier. The KMS reads the key from the corresponding key sub-pool based on the communication pair identifier and returns the key to the requesting terminal. During the key invocation process, the terminal device is unaware of the existence of the underlying QKD device and its link status, achieving transparency of the key source to the terminal.

[0034] Step S4 (Capacity Monitoring and Replenishment): KMS monitors the capacity status of each key sub-pool in real time. When the remaining capacity of any key sub-pool falls below a preset low-water level threshold, the QKD replenishment mechanism is triggered, driving the QKD device to inject newly generated quantum keys into the corresponding key sub-pool until the remaining capacity is restored to the preset high-water level threshold. The low-water level threshold and the high-water level threshold are dynamically adjusted based on the real-time key generation rate of the QKD device and the historical key consumption rate of the corresponding key sub-pool.

[0035] Step S5 (Integrity Protection): All write, read, and delete operations in the key resource pool are protected for integrity using a hash chain mechanism. Each operation generates a log entry containing the operation type, operation timestamp, involved key identifiers, involved key sub-pool identifiers, and an operation result digest. The hash value of the previous log entry is used as the input for calculating the current entry, forming a chain-like immutable structure. KMS periodically verifies the integrity of the hash chain. When an anomaly is detected, key distribution for the key sub-pool where the anomaly occurred is suspended and an alarm is triggered; key distribution for other key sub-pools remains unaffected.

[0036] 1.1 System Composition

[0037] like Figure 1 As shown, the present invention also provides a quantum key resource pool protection system for optical fiber ring networks, including: a key injection module, a key resource pool management module, a key call interface module, a capacity monitoring and replenishment module, and an integrity protection module.

[0038] (1) Key injection module

[0039] The key injection module is deployed within the KMS and connects to the QKD device via a dedicated key injection channel. This channel uses a separate fiber optic cable or out-of-band management network for transmission, physically isolated from the service communication channels of the fiber optic ring network to prevent interception of quantum keys during transmission. The key injection module continuously retrieves negotiated quantum keys from the QKD device using a polling or event-driven approach, writes the keys into the corresponding key sub-pools according to the key sub-pool partitioning rules, and simultaneously reports the write operation record to the integrity protection module.

[0040] (2) Key Resource Pool Management Module

[0041] The key resource pool management module is the core component of this invention, responsible for the overall management of the key resource pool. It performs logical partitioning management within the same physical key resource pool based on communication pairs, dividing each communication node pair into an independent key sub-pool, maintaining a mapping table of communication pair identifiers for each key sub-pool, enabling the quantum key generated by a single QKD device to be shared and reused by all communication pairs in the fiber optic ring network, and monitoring the capacity status of each key sub-pool in real time. Its main functions include: maintaining the mapping table between communication pair identifiers and key sub-pools; performing creation, expansion, compression, and deregistration operations on each key sub-pool; managing the lifecycle of quantum keys within the key sub-pool according to a FIFO strategy, including write registration, read allocation, usage confirmation, and expiration destruction; and real-time statistics on the remaining capacity, consumption rate, and generation rate of each key sub-pool, reporting the statistical data to the capacity monitoring and replenishment module.

[0042] (3) Key call interface module

[0043] The key retrieval interface module is deployed at each terminal access point of the fiber optic ring network, providing a unified key service interface to terminal devices. Terminal devices initiate key requests via a standardized key service protocol, carrying a communication pair identifier and the required key type (one-time key OTK, session key, or batch key) in the key request message. The key retrieval interface module verifies the requester's identity and the communication pair identifier. Upon successful verification, it retrieves the corresponding key from the key resource pool management module and returns it to the requesting terminal, ensuring that the terminal device is unaware of the underlying QKD device's existence and link status during the key retrieval process. The key retrieval interface module also includes an interface adaptation unit, supporting adaptation and conversion of industrial control communication protocols such as IEC 60870-5-101 / 104, DNP3, and Modbus, enabling existing industrial control equipment to connect without hardware replacement.

[0044] (4) Capacity monitoring and replenishment module

[0045] Connected to the key resource pool management module and the QKD device, this module triggers a replenishment command when the remaining balance of any key sub-pool falls below a preset low-water mark threshold, driving the QKD device to inject quantum keys into the corresponding key sub-pool. The capacity monitoring and replenishment module continuously receives capacity statistics reported by the key resource pool management module and monitors the remaining balance of each key sub-pool. When the remaining balance of any key sub-pool falls below the preset low-water mark threshold (L_low), the capacity monitoring and replenishment module sends a replenishment command to the key injection module. The key injection module then drives the QKD device to accelerate key generation and write to the corresponding key sub-pool until the remaining balance reaches the high-water mark threshold (L_high). The low-water mark threshold and the high-water mark threshold are dynamically adjusted based on the following parameters: the current key generation rate of the QKD device R_qkd (kbps), the average key consumption rate of the corresponding key sub-pool over the past 30 minutes R_consume (kbps), and the current service load level. When the key generation rate of the QKD device drops below the preset minimum rate, or when the key injection channel is interrupted, the capacity monitoring and replenishment module automatically raises the low water level threshold of each key sub-pool from the initial setting value to the preset emergency water level value, so as to increase the replenishment trigger frequency and extend the available consumption time of each key sub-pool. If the deployment scheme is also configured with an upper-level key pool (see Section 1.4 Optional Extension Scheme), the capacity monitoring and replenishment module can also initiate a cross-level replenishment request to the upper-level key pool if the QKD device is still unable to restore local replenishment within a preset time.

[0046] (5) Integrity Protection Module

[0047] like Figure 4As shown, the integrity protection module uses a hash chain mechanism to protect the integrity of all operation records in the key resource pool. It periodically performs hash chain verification, and when an anomaly is detected, it only notifies the key resource pool management module to suspend key distribution for the affected key sub-pool and triggers an alarm; key distribution for other key sub-pools remains unaffected. The integrity protection module generates operation log entries for all operations in the key resource pool (including key writing, key reading, key deletion, key expiration and destruction, and configuration changes), and uses a hash chain mechanism to link these entries together. Each log entry includes: operation sequence number (seq), operation type (op_type), operation timestamp (timestamp), involved key identifier (key_id), involved key sub-pool identifier (pool_id), operation result digest (result_hash), and the previous destination hash value (prev_hash). The final hash value of the current entry is calculated using the SHA-256 algorithm based on the concatenation of all the above fields. The integrity protection module periodically (once every 60 seconds by default) verifies the integrity of the hash chain. When a hash chain break is detected, the break location and the identifier of the key sub-pool to which it belongs are recorded. Only the key distribution of that key sub-pool is suspended, while the key distribution of other key sub-pools is unaffected. An alarm is also issued to the security administrator.

[0048] 1.2 Detailed explanation of the key resource pool partitioning mechanism; like Figure 2 As shown, the partitioning of the key resource pool is performed according to the following rules: During the deployment and configuration phase, the system pre-configures all communication pairs based on the topology of the fiber optic ring network. Assume there are N terminal nodes in the ring network, including one master monitoring node (M) and N-1 slave nodes (S1, S2, …, S…). N-1 The system provides communication for each communication pair (M, S). i Establish independent key sub-pools, with a total of N-1 key sub-pools. Each key sub-pool is assigned a unique communication pair identifier (Pool_ID).

[0049] For the same slave node S i When it needs to communicate with both the monitoring master node M and the adjacent slave node S j During communication, the system is (M, S) i ) and (S i , S j Each key sub-pool is established independently. Access control between each key sub-pool is independent of each other, from node S. i The key access request can only be accessed via S i A key subpool that is a member cannot access the key subpools of other node pairs.

[0050] The initial capacity Q_init of the key sub-pool is determined according to the following formula: Q_init = R_consume × T_buffer × (1 + margin);

[0051] Where R_consume is the estimated key consumption rate (kbps) for this communication pair, T_buffer is the design buffer time window (30 minutes is recommended), and margin is the security margin coefficient (0.2 is recommended).

[0052] Detailed explanation of the three key invocation modes; The key invocation interface module supports the following three key invocation modes, which the terminal device can choose according to the service type: (a) One-Time Key (OTK) Mode: Each key call returns an independent, fixed-length quantum key. This key is marked as allocated by the KMS. After the terminal device finishes using the key, it sends a usage confirmation message to the KMS, which then marks the key as consumed and removes it from the key sub-pool. OTK mode is suitable for business scenarios with the highest security requirements and relatively low communication frequency, such as flood control dispatch control commands and relay protection trip commands, to achieve one-time keying.

[0053] (b) Session Key Mode: Each key call returns a session key and its validity period (dynamically set by KMS based on the remaining key pool, typically 5–30 minutes). The terminal device can reuse this key to encrypt multiple messages within the session's validity period. After the session expires, KMS actively reclaims and destroys the key. Session key mode is suitable for high-frequency communication scenarios such as SCADA monitoring data acquisition and AVC adjustment, achieving a balance between security and key consumption efficiency.

[0054] (c) Batch Key Mode: Key invocation returns a preset number of key sequences n at once (n is specified by the terminal device in the request message, and KMS verifies and returns the actual number of allocable keys based on the remaining key sub-pool capacity). Each key is accompanied by a unique sequence number. The terminal device uses the batch keys in sequence number order. Each message uses one key and is accompanied by a corresponding sequence number. The receiver retrieves the corresponding key from the same batch keys using the sequence number for decryption. Batch key mode is suitable for business scenarios that require high-frequency encryption, such as continuous reporting of wind turbine control telemetry data, minimizing the impact of key request frequency on communication latency. When multiple key requests with different invocation modes exist simultaneously in the same key sub-pool, and the capacity monitoring and replenishment module has limited replenishment resources, priority is given to replenishing the capacity of the key sub-pool containing high-priority business requests using the one-time key OTK mode. The replenishment priority of the key sub-pool corresponding to the session key mode and the batch key mode decreases in that order. For specific scheduling rules, see Example 2 in Section 1.6 and Example 3 in Section 1.7.

[0055] 1.4 Detailed explanation of the three-level key pool linkage mechanism;

[0056] The core protection scope of this invention is the site-level key resource pool partition management and retrieval mechanism as defined in the claims (i.e., the content described in claims 1-8, the structure of which is shown in [reference]). Figure 1 , Figure 2 As an optional engineering extension solution, the site-level key resource pool of this invention can be further linked and connected with the upper-level key pool during deployment to address key supply guarantee requirements under abnormal scenarios such as QKD device failure or link interruption; this extension solution facilitates the understanding of the scalability of this invention in actual deployment by those skilled in the art. The three-level linkage structure consists of the following: Site-level key pool (Level 1): Deployed at the site where the fiber optic ring network is located, it is continuously replenished by local QKD devices and directly serves the key access requests of the ring network terminal devices. Under normal operation, the site-level key pool is self-sufficient and does not require intervention from a higher-level key pool.

[0057] Regional-level key pool (second level): Deployed in the central control center, it serves as the first-level external key source to support the site level when the site-level key resource pool cannot be supplemented through local QKD.

[0058] Group-level key pool (Level 3): Deployed at the headquarters of the power generation group, it serves as the final source of key reserve support and provides support when the regional key pool cannot meet the replenishment needs of the site.

[0059] All cross-level supplementary operations are transmitted via quantum-secure links, which will not introduce new security vulnerabilities.

[0060] The technical problem solved by this invention is the mismatch between the inherent point-to-point topology constraints of quantum key distribution (QKD) technology and the multi-node fiber optic ring network in the production control area of ​​a power plant, as well as the resulting insufficient real-time key supply and difficulties in compatibility with legacy equipment.

[0061] The beneficial effects of this invention are as follows: a single QKD device can provide quantum key protection for all communication pairs in a ring network; the key retrieval latency is less than 1ms, meeting the real-time requirements of industrial control systems; legacy devices can be transparently connected without hardware modification; the communication pair partitioning mechanism provides fine-grained key isolation; the dynamic water level threshold mechanism ensures the continuity of key supply in short-term abnormal scenarios; and hash chain protection provides trusted auditing capabilities.

[0062] 1.5 Example 1: Deployment of a quantum key resource pool for a wind farm fiber optic ring network; Scene background

[0063] A wind farm has 48 wind turbines. The on-site monitoring host is connected to the control units of the 48 turbines via a dual-redundant fiber optic ring network (main ring + backup ring). Communication services include: SCADA telemetry data reporting (once per turbine per second, message length 512 bytes), AVC reactive power control commands (once per turbine every 2 minutes, message length 128 bytes), and turbine control commands (up to 5 times per turbine per second, message length 256 bytes). The wind farm has established quantum-secure communication with the central control center via a wide-area backbone link, and a complete KMS is deployed at the central control center. Quantum key level protection is required for the communication security of the on-site fiber optic ring network.

[0064] Deployment Plan

[0065] Step S1 (Key Injection): Deploy a site-level KMS in the site monitoring room and connect it to the QKD terminal equipment in the wide-area backbone layer via an independent management fiber to establish a key injection channel. The QKD equipment continuously writes quantum keys to the site-level KMS at a key generation rate of 10kbps. The key injection channel is physically isolated from the service communication fiber optic ring network of the 48 wind turbines.

[0066] Step S2 (Partition Pooling): Based on the topology of the 48 wind turbines, the site-level KMS establishes 48 independent key sub-pools within the key resource pool, corresponding to the communication pairs between the monitoring host and wind turbines WTC_01 to WTC_48, with Pool_IDs assigned as POOL_WTC01 to POOL_WTC48. The initial capacity of each key sub-pool is calculated based on the communication load of the corresponding wind turbine: R_consume is approximately (512+256)×8×5 / 1000≈30.7kbps, T_buffer=30min, Q_init≈30.7×1800×1.2≈66kbit≈8.25kB.

[0067] Step S3 (Transparent Invocation): Install a key invocation interface adapter gateway (external type, no modification required to the original wind turbine control unit) in the control cabinet of each wind turbine. This gateway communicates with the WTC through the industrial control protocol adapter unit and interacts with the site-level KMS through the key service protocol. Control data sent by the WTC is transparently encrypted by the key invocation interface adapter gateway before being transmitted to the monitoring host. The WTC itself does not need to be aware of the underlying QKD system.

[0068] Step S4 (Capacity Monitoring): The site-level KMS continuously monitors the remaining capacity of the 48 key sub-pools. Taking POOL_WTC01 as an example, the low-water threshold is set to Q_init × 30% ≈ 2.5kB, and the high-water threshold is set to Q_init × 90% ≈ 7.4kB. When the remaining capacity of POOL_WTC01 is lower than 2.5kB, a replenishment mechanism is triggered. The KMS drives the QKD device to preferentially inject quantum keys into this key sub-pool until the remaining capacity reaches 7.4kB.

[0069] Step S5 (Integrity Protection): The integrity protection module generates a hash chain for all key operations of the site-level KMS and performs chained integrity verification every 60 seconds. During the annual security audit, the key operation history at any point in time can be traced based on the hash chain record.

[0070] Technical effect

[0071] In this embodiment, all on-site communication of the 48 wind turbines is protected by quantum key distribution (QKD) technology. The key retrieval latency, as tested, is approximately 0.3ms, meeting the real-time requirements of wind turbine control services. Compared to deploying a separate QKD device for each wind turbine, the number of devices is reduced by approximately 92%, significantly lowering engineering costs. The on-site KMS and the wide-area backbone QKD share the same quantum key infrastructure, achieving unified management of on-site ring network protection and wide-area backbone protection.

[0072] 1.6 Example 2: Deployment of Quantum Key Resource Pool for LCU Control Network in Hydropower Plant

[0073] Scene background

[0074] A hydropower plant has six generating units, each equipped with a Local Control Unit (LCU). The LCUs are connected to the plant-level monitoring host (FAR) via a fiber optic ring bus. Communication services include: unit status telemetry (every LCU every 500ms, message length 1024 bytes), unit start-up and shutdown control commands (high-security services related to flood control scheduling, message length 256 bytes), and sequence of events (SOE) alarms (event-driven, message length 128 bytes). Considering the extremely high security level of the hydropower plant's flood control scheduling control commands, start-up and shutdown control commands are required to be protected with a one-time key (OTK).

[0075] Deployment Plan

[0076] Step S1: Deploy a site-level KMS in the central control room of the hydropower plant, connecting it to the QKD optical network of the central control center via a dedicated optical fiber. The QKD key generation rate is 8kbps, and the key injection channel is physically isolated from the LCU control optical fiber ring network.

[0077] Step S2: Establish 7 key sub-pools, corresponding to the 6 communication pairs between FAR and LCU_01 to LCU_06, and 1 system management key sub-pool reserved for FAR. The start / stop control command sub-pool (Pool_ID: POOL_LCU_CTRL_01 to POOL_LCU_CTRL_06) and the telemetry sub-pool (Pool_ID: POOL_LCU_TELE_01 to POOL_LCU_TELE_06) are independently partitioned, creating a total of 12 functional sub-pools.

[0078] Step S3: The existing LCU control software remains unchanged. A key access interface gateway is installed in series between the LCU and the communication fiber optic ring network. The gateway supports IEC 60870-5-101 protocol adaptation. A corresponding gateway is also installed on the FAR side. Start-up and shutdown control commands are encrypted in OTK mode via the corresponding sub-pool of POOL_LCU_CTRL, with each command using an independent key. Telemetry data is encrypted in session key mode via the corresponding sub-pool of POOL_LCU_TELE, with the session key being changed every 30 minutes.

[0079] Step S4: Start-up and shutdown control commands are high-security services, and their corresponding key sub-pool has a high low-water threshold (set to 50% of the initial capacity) to ensure sufficient OTK keys are available under any circumstances. When the remaining balance of the control command key sub-pool falls below the low-water threshold, QKD supplementary resources are obtained first, over the telemetry key sub-pool.

[0080] Step S5: All key operation records related to start-up and shutdown control commands are marked with high-security level tags in the hash chain, triggering more frequent integrity verification (once every 10 seconds, instead of the default once every 60 seconds), to meet the security audit requirements of flood control dispatch control commands.

[0081] Technical effect

[0082] This embodiment implements one-time key protection for hydropower plant unit control commands, with a key retrieval delay of approximately 0.5ms, meeting the real-time requirements of the hydropower unit control system. During flood control scheduling, when six units simultaneously issue start-up and shutdown commands, the system key supply remains continuous and uninterrupted, and the remaining capacity of the six control command key sub-pools is maintained above the low water level threshold, verifying the concurrent service capability of the multi-sub-pool key resource pool.

[0083] 1.7 Example 3: Three-level linkage degradation protection during QKD equipment failure

[0084] Scene background

[0085] This embodiment further demonstrates the application effect of the optional engineering expansion scheme (three-level linkage structure) described in Section 1.4 in a real-world fault scenario. During the operation of the wind farm in Embodiment 1, the QKD equipment in the wide-area backbone layer was temporarily interrupted due to fiber optic line construction, resulting in a key injection channel interruption. The site-level KMS could no longer obtain new quantum keys from the QKD equipment, and the remaining amount in each key sub-pool of the key resource pool entered the consumption stage.

[0086] Downgrade protection process; Phase 1 (Autonomous Consumption Phase): After the QKD injection is interrupted, the site-level KMS continues to provide key services to terminal devices from the existing key sub-pool reserves. Simultaneously, the capacity monitoring and replenishment module detects that the QKD device generation rate has dropped to 0 and immediately raises the low-water threshold of each key sub-pool to 60% of its initial capacity, triggering more frequent monitoring polling.

[0087] Phase Two (Cross-Level Supplement Phase): When the sub-pool whose remaining balance in the site-level key pool first drops to the low water level threshold (60%) triggers a cross-level supplement request, the site-level KMS initiates an application to the regional-level key pool in the central control center. After reviewing the supplement request, the regional-level KMS distributes the supplementary key to the site-level key pool through the quantum-secure backbone fiber (with valid keys backed up in advance), restoring the remaining balance of each key sub-pool to the high water level threshold.

[0088] Phase 3 (Service Priority Scheduling): If the QKD interruption time is too long, and cross-level supplementation cannot meet the needs of all 48 key sub-pools, KMS will automatically schedule key resources according to service priority: high-priority service (AVC reactive power control, wind turbine emergency shutdown command) key sub-pools will be given priority; telemetry data key sub-pools will be downgraded to session key reuse mode to reduce key consumption rate; when resources are severely insufficient, a downgrade notification will be sent to low-priority terminals to switch to non-quantum encrypted communication mode.

[0089] Phase 4 (Recovery Phase): After the QKD fiber optic line is restored, the key injection channel is automatically rebuilt, KMS resumes receiving quantum keys from the QKD device and replenishes each key sub-pool in FIFO order, the balance of each key sub-pool is gradually restored to the normal level, and the downgraded terminal devices are automatically upgraded back to quantum key encryption mode.

[0090] Technical effect

[0091] This embodiment verifies the service continuity assurance capability of the present invention in QKD equipment failure scenarios. Through a three-level linkage mechanism, critical control services (AVC, emergency shutdown) can still continue to receive quantum key protection after QKD interruption; telemetry data is smoothly degraded when key resources are scarce, and the entire degradation and recovery process is transparent to upper-layer service applications without manual intervention.

[0092] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for protecting a quantum key pool in an optical fiber ring network, characterized in that: Includes the following steps: S1. Establish a key injection channel between the quantum key management system (KMS) and the single quantum key distribution (QKD) device, and continuously write the quantum key generated by the QKD device through the key injection channel into the same physical key resource pool in the KMS to form a quantum key pre-storage. S2. Based on the topology of the fiber optic ring network, the same physical key resource pool is logically partitioned according to communication pairs. Each pair of communication nodes is divided into an independent key sub-pool, and a unique communication pair identifier is assigned to each key sub-pool, so that the quantum key generated by a single QKD device can be shared and reused by all communication pairs in the fiber optic ring network. S3. Terminal devices in the fiber optic ring network initiate key requests to KMS through a standardized key retrieval interface. The key request carries a communication pair identifier. KMS reads the key from the corresponding key sub-pool based on the communication pair identifier and returns the key to the requesting terminal device, completing the transparent key retrieval. S4 and KMS monitor the capacity status of each key sub-pool in real time. When the remaining amount of any key sub-pool is lower than the preset low water level threshold, the QKD replenishment mechanism is triggered, driving the QKD device to inject newly generated quantum keys into the corresponding key sub-pool until the remaining amount is restored to the preset high water level threshold. The low water level threshold and the high water level threshold are dynamically adjusted according to the real-time key generation rate of the QKD device and the historical key consumption rate of the corresponding key sub-pool. S5. All operations on the key resource pool are protected by a hash chain mechanism. An alarm is triggered and key distribution is suspended in case of an anomaly.

2. The method for protecting a quantum key pool in an optical fiber ring network according to claim 1, characterized in that: In step S1, the key injection channel is physically isolated from the service communication channel of the fiber optic ring network; the quantum key pre-storage adopts a first-in-first-out queue structure, arranged in the order of quantum key generation time, and the earliest generated key is preferentially allocated to the terminal device to ensure key timeliness.

3. The method for protecting a quantum key pool in an optical fiber ring network according to claim 1, characterized in that: In step S2, the partitioning of the key sub-pool is pre-configured based on the communication pair relationships in the fiber optic ring network. The communication pair relationships include one-to-one communication pairs and one-to-many communication pairs. For the one-to-many communication architecture, an independent key sub-pool is established between the master node and each slave node. The key sub-pools of each slave node are isolated from each other, and the key call of the master node does not affect the key supply of other slave nodes. The access control of the key sub-pool adopts a whitelist mechanism based on the communication pair identifier. Each key sub-pool only allows authorized terminal devices in the corresponding communication pair to read the keys in it. KMS verifies the correspondence between the requester device identifier and the key sub-pool communication pair identifier for each key call request. Requests that fail to verify are rejected and a security alarm is triggered.

4. The method for protecting a quantum key pool in an optical fiber ring network according to claim 1, characterized in that: In step S3, the key call interface adopts a unified key service protocol; the key call interface also includes an interface adaptation unit, which is used to convert the original communication interface protocol of the terminal equipment already deployed in the optical fiber ring network into the unified key service protocol, so that the deployed terminal equipment can access the key resource pool protection system without changing the hardware; the interface adaptation unit supports the adaptation and conversion of IEC 60870-5-101 / 104, DNP3 and Modbus industrial control communication protocols.

5. A method for protecting a quantum key pool in an optical fiber ring network according to claim 4, characterized in that: The unified key service protocol supports three invocation modes: One-Time Key (OTK), Session Key, and Batch Key. The invocation mode is selected by the terminal device based on the service type. In the One-Time Key (OTK) mode, each key invocation returns an independent key, which is immediately marked as consumed and deleted from the key sub-pool after use. In the Session Key mode, the key invocation returns a key that can be reused within the session's validity period, which is then reclaimed and destroyed by KMS after the session ends. In the Batch Key mode, the key invocation returns a preset number of key sequences at once. When multiple key requests using different invocation modes exist simultaneously in the same key sub-pool, KMS prioritizes replenishing the capacity of the key sub-pool containing high-priority service requests using the One-Time Key (OTK) mode.

6. A method for protecting a quantum key pool in an optical fiber ring network according to claim 5, characterized in that: In step S4, the low water level threshold and high water level threshold are dynamically adjusted according to the following parameters: the real-time key generation rate of the QKD device, the historical key consumption rate of the terminal devices served by the corresponding key sub-pool, and the current service load level. When the key generation rate of the QKD device drops below the preset minimum rate or the key injection channel is interrupted, the KMS automatically raises the low water level threshold of each key sub-pool from the initial setting value to the preset emergency water level value to increase the frequency of supplementary triggering and extend the available consumption time of each key sub-pool, thereby ensuring the continuity of key supply.

7. A method for protecting a quantum key pool in an optical fiber ring network according to claim 6, characterized in that: In step S5, the hash chain mechanism is specifically implemented as follows: For each operation record in the key resource pool, a log entry is generated containing the operation type, operation timestamp, key identifier involved, key sub-pool identifier involved, and operation result summary. The hash value of the previous log entry is used as the input of the current entry to participate in the hash calculation, forming an immutable hash chain. When the verification finds that the hash chain is broken, the break position and the key sub-pool identifier to which it belongs are recorded. Only the key distribution of that key sub-pool is suspended, and the break information is reported to the superior key management node.

8. A system employing the quantum key pool protection method for fiber optic ring networks as described in claim 1, characterized in that, include: A key injection module is connected to a single quantum key distribution (QKD) device. It is used to receive the quantum key generated by the QKD device through negotiation and continuously write the quantum key into the same physical key resource pool. The key injection channel between the key injection module and the QKD device is independent of the service communication channel of the optical fiber ring network. The key resource pool management module is used to perform logical partitioning management within the same physical key resource pool according to communication pairs. It divides an independent key sub-pool for each pair of communication nodes, maintains a mapping table of communication pair identifiers for each key sub-pool, enables the quantum key generated by a single QKD device to be shared and reused by all communication pairs in the fiber optic ring network, and monitors the capacity status of each key sub-pool in real time. The key invocation interface module is deployed at each terminal access point of the optical fiber ring network to receive key requests initiated by terminal devices. The key request carries a communication pair identifier. The key invocation interface module obtains the corresponding key from the key resource pool management module according to the identifier and returns it to the requesting terminal, so that the terminal device is unaware of the existence of the underlying QKD device and its link status during the key invocation process. The capacity monitoring and replenishment module is connected to the key resource pool management module and the QKD device. It is used to trigger a replenishment command when the remaining amount of any key sub-pool is lower than the preset low water level threshold, and drive the QKD device to inject quantum keys into the corresponding key sub-pool. The integrity protection module is used to protect the integrity of all operation records of the key resource pool using a hash chain mechanism. It periodically performs hash chain verification. When an anomaly is detected, it only notifies the key resource pool management module to suspend key distribution of the key sub-pool where the anomaly occurred and triggers an alarm. The key distribution of other key sub-pools is not affected.

9. A quantum key pool protection system for fiber optic ring networks according to claim 8, characterized in that: The key resource pool management module also includes a key lifecycle management unit, which is used to perform lifecycle management on the quantum keys stored in each key sub-pool of the key resource pool. The lifecycle management includes: forcibly destroying keys that have exceeded the preset storage time limit and triggering replenishment; recycling and destroying keys that have been allocated but have exceeded the preset usage time limit and have not been consumed; and safely clearing the remaining amount of key sub-pools that have been consumed. All destruction and recycling operations are recorded in the hash chain of the integrity protection module.

10. A quantum key pool protection system for fiber optic ring networks according to claim 8, characterized in that: The quantum key resource pool protection system also includes a topology adaptation module for monitoring topology changes in the fiber optic ring network. When a new terminal node is added to the ring network, the topology adaptation module automatically creates a key sub-pool for the new communication pair and triggers initialization injection. When a node leaves the ring network, the topology adaptation module automatically cancels the corresponding key sub-pool and securely clears all keys in it. Topology change events and corresponding key sub-pool operations are recorded in the hash chain of the integrity protection module.

Images