A network security enhancement method based on hybrid-state decoy-state quantum key distribution

Abstract

This invention discloses a network security enhancement method for quantum key distribution based on hybrid-state decoy states, specifically relating to the field of quantum communication technology. The transmitting end prepares a hybrid-state quantum signal by probabilistically gating multiple parallel fixed optical attenuation paths. Each path is independently subjected to a random phase before being combined for output, ensuring that the photon number distribution is directly determined by the fixed attenuator, independent of the modulation voltage. A local monitoring detector continuously collects samples and uses statistical inference to lock the actual selection probability online. Combined with active delay compensation, the arrival time difference of each pulse is stabilized within one-twentieth of the pulse width. The receiving end achieves continuous monitoring throughout the entire process using wavelength division multiplexing (WDM) reference light. This invention achieves high-fidelity locking of the hybrid state at the transmitting end and network-level attack fingerprint protection at the receiving end without relying on the linearity of analog devices, effectively enhancing the security resilience of the quantum key distribution system in practical deployment environments.

Description

Technical Field

[0001] This invention relates to the field of quantum communication technology, and more specifically, to a network security enhancement method based on mixed-state decoy quantum key distribution. Background Technology

[0002] Quantum key distribution (QKD) technology, based on the fundamental principles of quantum mechanics, provides theoretically unconditionally secure shared keys to communicating parties. In practical QKD systems, single-photon sources are difficult to implement due to factors such as channel loss and detector efficiency; therefore, weakly coherent light sources are typically used instead of ideal single-photon sources. However, weakly coherent light sources contain multi-photon pulses, which can be exploited by eavesdroppers using photon number splitting attacks to obtain partial key information undetected. The decoy state method, by randomly interspersing decoy states of varying intensities within the signal state and monitoring the count rate changes of each intensity state, estimates the contribution of single-photon pulses, thereby effectively resisting photon number splitting attacks and ensuring the practical security of key distribution.

[0003] In existing decoy state QKD implementations, each intensity state is typically prepared using active intensity modulation, such as by changing the modulator drive voltage to attenuate the light pulse intensity. The linearity and extinction ratio of the intensity modulator directly determine the accuracy of the decoy state preparation. However, the nonlinear response, temperature drift, and aging effects of the modulator introduce intensity deviations, causing the actual transmitted quantum state to deviate from the preset parameters. This not only affects the theoretical calculation of the final key rate but may also create opportunities for eavesdroppers to exploit device vulnerabilities. Furthermore, the response speed of intensity modulation limits further increases in the system's operating frequency, becoming one of the bottlenecks restricting the performance of QKD systems.

[0004] To address the aforementioned issues, no existing technology offers a complete solution that fundamentally overcomes the nonlinear limitations of intensity modulators while simultaneously providing real-time monitoring at the transmitter and self-calibrating fingerprint verification capabilities at the receiver. In high-speed, long-distance, and networked deployment scenarios, eliminating the inherent defects of analog devices in the decoy state preparation process and establishing an attack detection mechanism independent of the channel model remain critical technical challenges that need to be solved in the QKD field. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a network security enhancement method based on hybrid-state decoy quantum key distribution.

[0006] To achieve the above objectives, the present invention provides the following technical solution: A network security enhancement method based on hybrid-state decoy quantum key distribution includes the following steps: S1: The network control center assigns a mixed-state decoy target distribution containing multiple sets of average photon counts and corresponding selection probabilities to the transmitting node, and distributes the parameters to the receiving node as a fingerprint verification benchmark. S2: The transmitter randomly selects one of multiple optical paths according to the selection probability. Each path attenuates the light pulse to the corresponding average photon number and applies an independent random phase before combining the beams. After beam splitting, one part enters the quantum channel and the other part is guided to the local monitoring detector. S3: The local monitoring detector detects the split light pulses, estimates the actual selection probability through statistical inference, calculates the difference between the current distribution and the target distribution, and fine-tunes the selection probability until the difference falls back to the allowable range if it exceeds the threshold. S4: The receiver receives the quantum signal and demodulates and detects it, recording the detection results to form the original key and auxiliary statistics; S5: Basis comparison stage. The sending end publishes the hybrid configuration information, and the receiving end compares the measured fingerprint features with the published fingerprint. If they are within the security envelope, the verification is passed; otherwise, the data is discarded and the link is marked as untrusted. S6: After verification, both parties perform parameter estimation and key distillation based on the hybrid decoy state to generate a secure key.

[0007] Specifically, in S1: The complete parameters of the target distribution include the average photon number vector for each path, the path selection probability vector for each path, and the photon number distribution commitment signed by hash; The selection probability vector satisfies that the sum of the selection probabilities of all paths is 1, and the average photon number is determined by the attenuation of the precisely fixed optical attenuator in each path, and is independent of the analog voltage.

[0008] Specifically, in S2: The random phases of each path are uniformly distributed and independent within the range of 0 to 2π; The phase randomness of each pulse is provided by the same high-speed true random number generator, which provides independent random phase values ​​for the phase modulators of each path, ensuring that true incoherent mixing is achieved after beam combining.

[0009] Specifically, in S2: The optical path lengths of each path are initially coarsely matched to ensure that the time difference between the arrival of each pulse at the beam combiner is controlled within the order of pulse width. Each path is also connected in series with an adjustable fiber delay line driven by piezoelectric ceramics to form an active time delay compensation loop. By coupling part of the optical signal from the input end of the combiner and monitoring the envelope overlap factor of each pulse and the reference pulse, the voltage of the delay line is dynamically adjusted by a proportional-integral control algorithm. This allows the time difference of each pulse arriving at the combiner to be initially controlled within one-tenth of the pulse width. Moreover, this locking process is performed in the system's idle time slot or within a dedicated calibration frame, without interfering with the normal generation of the quantum signal.

[0010] Specifically, in S3: Using the Dirichlet distribution as the prior distribution of the selection probability vector, the Metropolis-Hastings sampling algorithm is used to obtain the posterior distribution of the probability vector through the Markov chain Monte Carlo method, and the maximum posterior estimate is taken as the estimate of the actual selection probability. Substituting the actual selection probability and the known average photon number into the photon number distribution formula, we obtain the current actual mixed state distribution. We then calculate the Kullback-Leibler divergence between this distribution and the target distribution in S1 as a measure of difference. If the cumulative selection probability correction of a certain channel exceeds the preset safety threshold within multiple consecutive calibration cycles, it is determined that the fixed optical attenuator of that channel has aged significantly. The system automatically suspends the quantum signal transmission of that channel and triggers the out-of-band attenuator recalibration process to re-measure the actual value of the average photon number of that channel and update the system parameters.

[0011] Specifically, in S4: The receiver is equipped with a programmable photon statistics monitoring module, which includes an optical switch, a beam splitter and two single-photon detectors. During the fingerprint verification window or communication idle period, the receiver switches the input light to this module and obtains the normalized second-order correlation function and average photon number estimate of the mixed state through Hanbury-Brown-Twiss coincidence measurement.

[0012] Specifically, in S4: After the beam splitter, the transmitting end also couples a weak reference laser whose wavelength differs from that of the quantum signal by several nanometers to be transmitted in the same path as the quantum signal. The power of this reference laser is constant and far below the level of a single photon. The receiver is equipped with a wavelength division multiplexer to separate the reference light into a dedicated monitoring channel. By monitoring the normalized second-order correlation function and average photon number of the reference light in real time and comparing them with a preset reference security fingerprint, continuous monitoring of parameter attacks is performed throughout the entire communication period without consuming quantum signal pulses.

[0013] Specifically, in S5: The fingerprint features include a normalized second-order correlation function of mixed states and an average photon count; the security envelope is defined as an interval near the expected value of each fingerprint feature under attack-free conditions, with a half-width consisting of multiples of the standard deviation of statistical fluctuations. The statistical fluctuations are approximated by Poisson counting, and the standard deviation is estimated by the square root of the measured count rate; if all feature parameters are within the security envelope, the verification is passed; otherwise, the receiver issues a security alarm and discards all data in this round.

[0014] Specifically, in S5: The target distribution also includes a vacuum channel with an average photon count of approximately zero. During fingerprint verification, the receiver calculates the normalized count rate of the vacuum channel to obtain the sum of background noise and dark count in real time, calculates the net count rate ratio between different non-vacuum channels, and compares it with the theoretical intensity ratio published by the transmitter. The net count rate ratio is always equal to the theoretical intensity ratio under ideal eavesdropping conditions and is completely independent of the total channel attenuation, thereby achieving self-calibrated fingerprint verification without relying on channel loss model estimation.

[0015] Specifically, in S6: The network control center periodically updates the mixed-state target distribution of each node. Different nodes are assigned different target distributions, making it impossible for eavesdroppers to crack the fingerprint through long-term statistical learning. A statistical fingerprint protection layer is superimposed on the quantum key distribution network.

[0016] The technical effects and advantages of this invention are as follows: This invention employs a hybrid approach combining a multi-path parallel fixed attenuation structure with probabilistic gating, allowing the average photon count to be directly determined by the attenuation of a precisely fixed optical attenuator, independent of the modulation voltage. This fundamentally eliminates the intensity deviation introduced by the nonlinear response of the intensity modulator and the finite extinction ratio, ensuring the long-term stability of the photon count distribution at the transmitter output to a preset value. Furthermore, by setting adjustable fiber delay lines driven by piezoelectric ceramics in each path and implementing active delay compensation based on the envelope overlap factor, the time difference between each pulse arriving at the combiner is locked to within one-twentieth of the pulse's full width at half maximum (FWHM), effectively suppressing the leakage of path distinguishability information caused by temperature drift and fiber thermostriction. Simultaneously, the local monitoring detector continuously collects the small number of light pulses, and combines the Markov chain Monte Carlo method to infer the actual selection probability online and calculate the KL divergence between the actual selection probability and the target distribution. Once a deviation occurs, the probability mapping table is corrected in time, forming a "preparation-monitoring-feedback" closed-loop locking mechanism. This ensures that the system always maintains the optimal operating point corresponding to the preset security model under actual working conditions such as slow environmental drift, providing high-fidelity quantum state resources for subsequent key distillation.

[0017] This invention constructs a multi-layered fingerprint verification and attack detection system at the receiver. On one hand, a weak reference laser, co-transmitted with the quantum signal via wavelength division multiplexing, enables real-time monitoring throughout the entire communication period without affecting the continuity of key distribution. This completely eliminates the dependence of traditional verification mechanisms on dedicated time windows, maximizing the key generation rate. Simultaneously, the introduction of a vacuum channel allows the receiver to deduct the effects of background noise and dark counts in real time. Self-calibration comparison is performed using the net count rate ratio between different non-vacuum channels, making the fingerprint verification process independent of the channel loss model and significantly improving the reliability of parameter attack detection in practical deployment environments. Furthermore, the network control center periodically updates the mixed-state target distribution of each node, preventing eavesdroppers from cracking the fingerprint pattern through long-term statistical learning. This adds a layer of statistical fingerprint protection for practical systems on top of quantum mechanical security, effectively enhancing the overall security resilience against the imperfections of QKD network adversarial devices and malicious parameter manipulation. Attached Figure Description

[0018] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] like Figure 1 As shown, the steps of a network security enhancement method based on hybrid-state decoy quantum key distribution are as follows: Step 1: The network control center assigns a unique set of mixed-state decoy target distributions to each trusted transmitting node. This target distribution is defined as a set of average photon number vectors. and the corresponding selection probability vector ,satisfy ,in The total number of mixed channels and The photon number statistics of the target distribution are expressed as the photon number probability after phase randomization. .in Let n be the probability of having n photons in the mixed state (i.e., the photon number distribution). Let be the probability that the i-th channel is selected. Let be the average number of photons corresponding to the i-th channel. It is a natural constant. Photon number for factorial.

[0021] each The value is determined by the attenuation of the precisely fixed optical attenuators in each path, and is independent of the analog voltage, fundamentally eliminating the nonlinearity of the intensity modulator and the residual extinction ratio. Probability vector The table lookup logic of the high-speed true random number generator at the transmitting end is loaded into the generator. Simultaneously, the complete parameters of the target distribution and the hash-signed photon number distribution commitment are securely distributed to the corresponding receiving node via a classical channel as the basis for subsequent fingerprint verification. Furthermore, each optical attenuator within the transmitting node integrates a high-speed phase modulator, which receives independent values ​​from 0 to 1 within each pulse period from the same true random number generator. Uniform random phase values ​​ensure that the phases of subsequent pulses are completely independent when they are combined, thus achieving true incoherent mixing.

[0022] Step 2: Within each clock cycle, the transmitter generates a random channel selection signal based on the currently locked probability vector using a true random number generator, driving a 1×N high-speed optical switch to select one of the N parallel optical paths. Each path is connected in series with a precision fixed optical attenuator and a high-speed phase modulator. The first path also serves as a time reference channel, with its optical path length acting as the locking reference for active delay compensation in the other paths. The phase modulator in this path still applies a random phase normally, without affecting its function as a time reference. The high-intensity light pulses emitted by the main laser are split and enter each path, first being attenuated by the fixed optical attenuator to a preset average photon number. The pulse is then applied independently via a phase modulator. The optical path lengths of all paths are initially coarsely matched, ensuring that the time difference between each pulse arriving at the N×1 incoherent combiner is initially controlled within the pulse width order, providing initial acquisition conditions for the subsequent active delay compensation loop. Due to temperature drift and device aging, the accuracy of this coarse matching deteriorates over time; therefore, the following active compensation mechanism is introduced to achieve long-term stable locking. Since the phases of each pulse are random and independent, the optical field state after combining is strictly a classical mixture of multiple coherent states, and its photon number distribution is precisely the target weighted superposition distribution. Subsequently, this mixed-state pulse passes through a 99:1 fiber beam splitter, with 99% of the intensity entering the quantum channel and being transmitted to the receiver, while 1% is directed to a locally monitored single-photon detector. In this fabrication method, all intensity references are determined by a fixed attenuator, resulting in extremely low temperature drift. Furthermore, the overall photon number distribution shape of the mixed state depends only on the probability vector, eliminating the need for linearity in any analog devices, thus giving the decoy state fabrication inherently high stability.

[0023] To further eliminate the time delay drift introduced by gradual temperature changes and achieve high-precision pulse arrival time locking, an adjustable fiber delay line driven by piezoelectric ceramics is connected in series between the fixed optical attenuator and phase modulator in each parallel path, forming an active time delay compensation loop. Specifically, a very small amount of light (approximately 0.1%) is coupled from the input of the incoherent combiner and connected to a high-speed photodetector to monitor the envelope waveform of each pulse superposition in real time. The relative arrival time difference between the path pulse and the reference pulse (e.g., path 1). When the value deviates from the preset zero value, the overlap of the detector's output electrical signal envelope will decrease. Define the envelope overlap factor. ,in For the first pulse in time shift The resulting light intensity waveform, Let be the arrival time difference between the i-th pulse and the first pulse. For an integral infinitesimal element, For the first The normalized time-domain light intensity waveform of the path pulse, when hour To achieve the maximum value, the control unit adjusts the voltage applied to the piezoelectric delay line using a proportional-integral control algorithm based on the gradient of the overlap factor's change, dynamically compensating for the thermal expansion and contraction of the fiber optic link, and ensuring that the arrival time difference between any two pulses remains stable within a certain range. Within ( The pulse width at half maximum (FWHM) is far superior to the originally planned one-tenth pulse width threshold. This locking process is performed in system idle time slots or dedicated calibration frames, without interfering with the normal generation of quantum signals, and can compress path distinguishability information caused by time delay to a negligible level.

[0024] Step 3: The local monitoring single-photon detector receives the 1% optical pulses diverted in step 2, operating in gated mode with the gate width aligned with the pulse arrival time, recording the response of each pulse as either 0 or 1. Assume the monitoring detector efficiency is... Furthermore, the average number of photons in each path has been precisely calibrated. The parameters are considered known constants after factory calibration and remain fixed during the locking process. The monitoring module continuously accumulates data. Construct a likelihood function for the sequence of detected events of the nth pulse: For the nth pulse... The probability of detecting "1" in a given pulse is... The probability of "0" is In the formula: To monitor the detection efficiency of single-photon detectors locally; Using the Dirichlet distribution as the probability vector Based on the prior, this likelihood is used to run the Metropolis-Hastings algorithm via the Markov chain Monte Carlo method for 10 iterations. 4 In the next iteration, discard the posterior distribution of the probability vector obtained in the first 2000 iterations, and take the maximum a posteriori estimate (p^_{1},…,p^_{N}). Compare this estimate with the known... Substituting all the values ​​into the photon number distribution formula, we obtain the current actual mixed state distribution. Calculate its relationship with the target distribution The Kullback-Leibler divergence is measured. If the divergence exceeds a preset threshold, closed-loop adjustment is triggered: only the probability mapping table of the true random number generator is finely adjusted, and the selection probability of each channel is gradually corrected so that the actual probability vector approaches the target vector, until the divergence falls back to the allowable range. If, within multiple consecutive calibration cycles, the cumulative correction of the selection probability of a certain channel exceeds a preset safety threshold (e.g., exceeding ±20% of the initial value), it is determined that the fixed attenuator of that channel may have undergone significant aging. The system automatically suspends the quantum signal transmission of that channel and triggers the out-of-band attenuator recalibration process to remeasure the divergence. The actual value is then updated to the system parameters.

[0025] This process is executed entirely locally, without occupying quantum channel capacity. It can effectively combat mixed weight distortion caused by environmental factors such as slow temperature drift, ensuring that the transmitter always outputs a mixed decoy state that is precisely consistent with the preset security model.

[0026] Step 4: After being monitored and split, the master quantum signal is transmitted to the receiving node along the quantum channel. The receiving node and the transmitting end pre-agree on the basis selection logic, use standard BB84 or MDI protocol optical demodulation, and a high-efficiency single-photon detector records the detection time, selected basis, and detection results to form the original key and auxiliary statistics. Inside the receiving node, a programmable photon statistics monitoring module is also configured: this module includes a 1×2 optical switch, a 50:50 beam splitter, and two single-photon detectors; during normal key distribution, this module is in bypass mode and does not affect communication; during the fingerprint verification window set by the protocol or during communication idle periods, the receiving end switches the input light to this module, using the 50:50 beam splitter and dual detectors to perform Hanbury Brown-Twiss coincidence measurements, directly obtaining the normalized second-order intensity correlation function of the mixed state. And the average photon number estimation. Any attempt by an eavesdropper to intercept and retransmit quantum signals will be detected by subsequent fingerprint verification because the statistical characteristics of the photon number in the mixed state cannot be accurately replicated.

[0027] To achieve real-time continuous monitoring of hybrid fingerprints without interrupting key distribution, this invention introduces a wavelength division multiplexing parallel monitoring mechanism in the receiving node of step 4. After the 99:1 beam splitter described in step 2, the transmitting end additionally couples a weak reference laser with a slightly different wavelength (wavelength...). With quantum signal wavelength (Difference of several nanometers), this laser also passes through an incoherent beam combining path, ensuring its temporal envelope is strictly synchronized with the mixed-state quantum pulse, and its power is constant and far below the single-photon level. At the receiving end, a wavelength division multiplexer is added at the original quantum channel entrance to... Separated to a dedicated monitoring channel, and The quantum signal continues to enter the normal demodulation module via its original path. The monitoring channel connects to the HBT photon statistical monitoring module described in step 4, performing continuous coincidence measurements. Since the reference light and quantum signal propagate linearly in the same path, their statistical characteristics faithfully map the intensity fluctuations and distribution changes of the mixed state. The normalized second-order correlation function of the reference light is calculated and monitored in real time. By comparing the average photon count with a preset reference security fingerprint, continuous detection of potential parameter attacks can be achieved throughout the entire communication period without consuming any quantum signal pulses. This completely eliminates window conflicts between fingerprint verification and key distribution, maximizing the code generation rate; where: For the reference laser's normalized second-order intensity correlation function, For reference, the instantaneous intensity of light, For time average, This represents the average of the squares of the light intensity. It is the square of the average light intensity.

[0028] Step 5: During the basis vector alignment phase, in addition to publishing the used basis vectors, the transmitting end also discloses the hybrid state configuration index and the hash-signed photon number distribution commitment used in this round of communication through the classical channel. The receiving end uses the coincidence measurement data slices recorded by the continuous monitoring channel during the corresponding communication time period in step 4 to calculate the normalized second-order correlation function of the actually received hybrid state. and average photon number Simultaneously, utilizing the counting rates under different basis vectors during conventional key distribution, and combining them with a known channel loss model, the lower bound of the single-photon counting rate and the upper bound of the two-photon counting rate are estimated as auxiliary fingerprint features. These measured feature vectors are then compared with the hybrid-state fingerprint (including theoretical values) published by the sender. And the theoretical average photon number, etc., among which The normalized second-order correlation function of the mixed state (theory) is compared: if all characteristic parameters are within the secure envelope determined by the channel model and statistical fluctuations, where the envelope is the expected value of the characteristics ± 5 times the Poisson standard deviation, then it is considered that the communication has not been tampered with or attacked by a man in the middle, and proceeds to the next step of key distillation; otherwise, the receiving end issues a security alarm, discards all data, and marks the link as untrusted, realizing network-level active defense.

[0029] To eliminate the impact of inaccurate channel loss models on fingerprint verification, this method pre-configures an average photon number in the mixed-state target distribution in step 1. The vacuum channel, whose selection probability is denoted as . In step 5, during fingerprint comparison, the receiver calculates the normalized count rate of the vacuum channel. ,in It is a vacuum channel. The probability of selecting the vacuum channel. This represents the total detection count rate for this channel. This value provides the sum of background noise and dark counts in real time. For any two non-vacuum channels and The receiving end calculates their net count rate ratio. ,in This represents the net count rate ratio between non-vacuum channels i and j. , Let i and j be the selection probabilities of the i-th and j-th channels. This represents the measured total count rate for the corresponding channel. According to the hybrid model, under ideal, eavesdropping-free conditions, this ratio is always equal to the ratio of the preset strengths at the transmitting end. And with the total channel attenuation Completely irrelevant. Therefore, based on the theoretical ratio published by the sender... Based on this, the receiving end only needs to determine Fingerprint verification can be completed simply by checking whether the fingerprint falls within a confidence interval determined by statistical fluctuations, without requiring any channel model estimation. This optimization transforms the verification of hybrid fingerprints from relying on absolute loss modeling to relying solely on self-calibrated comparisons of relative strength ratios, significantly improving the reliability of parameter attack detection in real-world network environments.

[0030] Step 6: For communication rounds that pass fingerprint verification, the sender and receiver perform parameter estimation and key distillation based on a hybrid decoy state. Since the hybrid state can be viewed as a weighted combination of multiple coherent states of known strength, the system will observe a total gain... Total bit error count They are respectively represented as and ,in and For corresponding strength Gain and bit error rate of coherent states. Using vacuum state counting and historical statistics with multiple different probability configurations, a correlation is constructed regarding the single-photon count rate. and single-photon bit error rate The linear programming problem is solved jointly. The lower bound and The upper bound is then used to calculate the security key rate based on the standard decoy state formula. ,in The final extractable secure key rate, The total probability of a single-photon number state in a mixed state is defined as follows: , The single-photon count rate, For single-photon bit error rate, It is a binary entropy function. Let E be the total gain and E be the total bit error rate, defined as follows: , It is a binary entropy function. To improve error correction efficiency, since the hybrid-state distribution is always maintained near the ideal target through closed-loop locking, and network fingerprint verification eliminates parameter-level attacks, the generated key achieves enhanced security against defects in actual devices. The network control center also periodically updates the hybrid-state target distribution of each node, preventing eavesdroppers from cracking the fingerprint through long-term statistical learning. This adds a layer of statistical fingerprint protection to the quantum key distribution network, significantly enhancing its overall resilience against attacks.

[0031] The above formulas are all dimensionless calculations. Dimensionless calculations can be performed using various methods such as standardization, which will not be elaborated here. The formulas are derived from software simulations based on a large amount of collected data, and the preset parameters in the formulas can be set by those skilled in the art according to the actual situation.

[0032] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, ATA hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state ATA hard disk.

[0033] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0034] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0035] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0036] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0037] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0038] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable ATA hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0039] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network security enhancement method based on hybrid-state decoy quantum key distribution, characterized in that, The process includes the following steps: S1: The network control center assigns a mixed-state decoy target distribution containing multiple sets of average photon counts and corresponding selection probabilities to the transmitting node, and distributes the parameters to the receiving node as a fingerprint verification benchmark. S2: The transmitter randomly selects one of multiple optical paths based on the selection probability. Each path attenuates the light pulse to the corresponding average photon number and applies an independent random phase before combining the beams. After splitting, one part enters the quantum channel, and the other part is guided to the local monitoring detector. S3: The local monitoring detector detects the split light pulses, estimates the actual selection probability through statistical inference, calculates the difference between the current distribution and the target distribution, and fine-tunes the selection probability if it exceeds a threshold until the difference falls back to the allowable range. S4: The receiver receives the quantum signal and performs demodulation detection, recording the detection results to form the original key and auxiliary statistics. S5: In the basis vector comparison stage, the transmitter publishes the mixed-state configuration information, and the receiver compares the measured fingerprint features with the published fingerprint. If they are within the secure envelope, the verification passes; otherwise, the data is discarded and the link is marked as untrusted. S6: After passing the verification, both parties perform parameter estimation and key distillation based on the mixed-state decoy state to generate a secure key.

2. The network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In S1: the complete parameters of the target distribution include the average photon number vector of each path, the path selection probability vector of each path, and the photon number distribution commitment signed by hash; the selection probability vector satisfies that the sum of the selection probabilities of all paths is 1, and the average photon number is determined by the attenuation of the precision fixed optical attenuator in each path, and is independent of the analog voltage.

3. The network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In S2: the random phases of each path are uniformly distributed and independent of each other in the range of 0 to 2π; the phase randomness of each pulse is provided by the same high-speed true random number generator to provide independent random phase values ​​for the phase modulators of each path, ensuring that true incoherent mixing is achieved after beam combining.

4. The network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In S2: each optical path undergoes preliminary coarse matching to control the time difference of each pulse arriving at the combiner within the pulse width order of magnitude; each path is also connected in series with an adjustable fiber delay line driven by piezoelectric ceramic to form an active time delay compensation loop. By coupling part of the optical signal from the input end of the combiner and monitoring the envelope overlap factor between each pulse and the reference pulse, the voltage of the delay line is dynamically adjusted using a proportional-integral control algorithm to initially control the time difference of each pulse arriving at the combiner within one-tenth of the pulse width. Moreover, this locking process is performed in the system's idle time slot or within a dedicated calibration frame, without interfering with the normal generation of the quantum signal.

5. A network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In S3: the Dirichlet distribution is used as the prior distribution of the selection probability vector. The posterior distribution of the probability vector is obtained by using the Metropolis-Hastings sampling algorithm and the Markov chain Monte Carlo method. The maximum posterior estimate is taken as the estimate of the actual selection probability. The actual selection probability and the known average photon number are substituted into the photon number distribution formula to obtain the current actual mixed state distribution. The Kullback-Leibler divergence between the current distribution and the target distribution in S1 is calculated as a measure of difference. If the cumulative selection probability correction of a certain channel exceeds the preset safety threshold within multiple consecutive calibration cycles, it is determined that the fixed optical attenuator of that channel has aged significantly. The system automatically suspends the quantum signal transmission of that channel and triggers the out-of-band attenuator recalibration process to re-measure the actual value of the average photon number of that channel and update the system parameters.

6. A network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In S4: the receiver is equipped with a programmable switchable photon statistics monitoring module, which includes an optical switch, a beam splitter and two single-photon detectors; during the fingerprint verification window or communication idle period, the receiver switches the input light to this module and obtains the normalized second-order correlation function of the mixed state and the average photon number estimate through Hanbury Brown-Twiss coincidence measurement.

7. A network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In S4: after the beam splitter, the transmitting end also couples a weak reference laser with a wavelength several nanometers different from the quantum signal wavelength to be transmitted along the same path as the quantum signal. The power of this reference light is constant and much lower than the single photon level. The receiving end is equipped with a wavelength division multiplexer to separate the reference light to a dedicated monitoring channel. By monitoring the normalized second-order correlation function and average photon number of the reference light in real time and comparing them with a preset reference security fingerprint, continuous monitoring of parameter attacks is performed throughout the entire communication period without consuming quantum signal pulses.

8. A network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In step S5: the fingerprint features include a normalized second-order correlation function of the mixed state and the average photon count; the security envelope is defined as an interval near the expected value of each fingerprint feature under attack-free conditions, with a half-width consisting of multiples of the standard deviation of statistical fluctuations. The statistical fluctuations are approximated by Poisson counting, and the standard deviation is estimated by the square root of the measured count rate; if all feature parameters are within the security envelope, the verification is passed; otherwise, the receiver issues a security alarm and discards all data in this round.

9. A network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In step S5: the target distribution also includes a vacuum channel with an average photon count of approximately zero; during fingerprint verification, the receiver calculates the normalized count rate of the vacuum channel to obtain the sum of background noise and dark count in real time, calculates the net count rate ratio between different non-vacuum channels, and compares it with the theoretical intensity ratio published by the transmitter. The net count rate ratio is always equal to the theoretical intensity ratio under ideal eavesdropping conditions and is completely independent of the total channel attenuation, thereby achieving self-calibrated fingerprint verification without relying on channel loss model estimation.

10. A network security enhancement method based on hybrid-state decoy quantum key distribution according to claim 1, characterized in that, In S6: the network control center periodically updates the mixed-state target distribution of each node, and different nodes are assigned different target distributions, so that eavesdroppers cannot crack the fingerprint through long-term statistical learning, and a statistical fingerprint protection layer is superimposed on the quantum key distribution network.

Images