Communication encryption method, device and system based on quantum key distribution (QKD)

Abstract

The application provides a communication encryption method, device and system based on quantum key distribution (QKD), relates to the technical field of communication, and is used for improving the transmission efficiency of service data, and the specific technical scheme is as follows: through a quantum key distribution (QKD) channel, shared quantum entropy sources are generated between a first communication device and a second communication device at a first frequency, after each shared quantum entropy source is generated, the shared quantum entropy source is bound with a communication state identifier, and each communication state identifier is associated with a communication period; after each communication period is reached, the current communication state identifier is updated to the communication state identifier corresponding to the communication period, and in the communication period, service data is encrypted and decrypted based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication period at a second frequency; wherein the second frequency is higher than the first frequency. The application is applied to a data transmission scene.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a communication encryption method, apparatus and system based on quantum key distribution (QKD). Background Technology

[0002] To improve the security of business data during transmission, it is usually necessary to encrypt the business data.

[0003] In related technologies, the shared key stream generated in real time by the quantum key distribution (QKD) device is usually used as the keybook for one-time passwords (OTPs) to encrypt business data before transmitting the encrypted business data.

[0004] However, if there is an order of magnitude difference between the real-time key generation rate (typically Kbps to low Mbps) of a quantum key distribution (QKD) device and the service data transmission rate (Gbps), it will result in low transmission efficiency of service data. Summary of the Invention

[0005] This application provides a communication encryption method, apparatus, and system based on quantum key distribution (QKD) to improve the transmission efficiency of business data.

[0006] In a first aspect, embodiments of this application provide a communication encryption method based on quantum key distribution (QKD), executed by a first communication device. The QKD-based communication encryption method includes: generating a shared quantum entropy source between the first and second communication devices at a first frequency via a QKD channel; binding the shared quantum entropy source to a communication state identifier after each generation, with each communication state identifier associated with a communication cycle; updating the current communication state identifier to the communication state identifier corresponding to the communication cycle after each communication cycle; and encrypting / decrypting business data at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle within the communication cycle; wherein the second frequency is higher than the first frequency.

[0007] The technical solution provided in this application brings at least the following beneficial effects: This application uses a quantum key distribution (QKD) channel to generate a shared quantum entropy source between a first communication device and a second communication device at a first frequency. After each shared quantum entropy source is generated, it is bound to a communication state identifier. This allows the current communication state identifier to be updated to the communication state identifier corresponding to the communication cycle after each communication cycle. Within the communication cycle, business data is encrypted and decrypted based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle at a second frequency. Thus, by continuously generating a shared quantum entropy source at a certain frequency through the QKD channel, the seed can be automatically updated without interrupting business operations and without manual intervention, for use during communication between the first and second communication devices. Furthermore, using QKD as a background entropy source avoids the constraint of QKD key generation rate on encryption speed, maintaining the end-to-end information theory security characteristics of the system. This enables the system to support high-speed data encryption services without waiting for real-time key generation, accelerating business data transmission speed and improving business data transmission efficiency.

[0008] One possible implementation of the above-mentioned quantum key distribution (QKD) communication encryption method further includes: pre-setting at least one absolute time point, and setting an overlapping window [TX, T+X] for each of the above-mentioned absolute time points; wherein each absolute time point is the start time of a communication cycle, T is an absolute time point, and X is less than the duration of the corresponding communication cycle; within the overlapping window corresponding to the above-mentioned communication cycle, simultaneously receiving data packets obtained by encryption processing using the shared quantum entropy source corresponding to the communication state identifier before the update, and data packets obtained by encryption processing using the shared quantum entropy source corresponding to the updated communication state identifier, and performing decryption processing using the corresponding shared quantum entropy source.

[0009] Another possible implementation of the above-mentioned quantum key distribution (QKD) communication encryption method further includes: during the time period outside the above-mentioned overlapping window but within the above-mentioned communication cycle, only receiving data packets obtained by encryption using the shared quantum entropy source corresponding to the updated communication state identifier, and decrypting them using the shared quantum entropy source bound to the above-mentioned updated communication state identifier.

[0010] Another possible implementation is that, during the aforementioned communication cycle, the header of the data packets sent by the first communication device contains an updated communication status identifier.

[0011] Another possible implementation of the above-mentioned quantum key distribution (QKD) communication encryption method includes: after detecting an update to the current communication state identifier, securely erasing the shared quantum entropy source bound to the communication state identifier before the update.

[0012] Another possible implementation of the above-mentioned quantum key distribution (QKD) communication encryption method further includes: when the QKD channel failure is detected, performing at least one of the following operations: extending the effective usage time of the currently used shared quantum entropy source; using a pre-stored backup shared quantum entropy source; suspending the initiation of new encrypted communication sessions, while retaining the decryption capability of the first communication device using the shared quantum entropy source for decryption processing.

[0013] Another possible implementation, the above-mentioned quantum key distribution (QKD) communication encryption method further includes: when the recovery of the quantum key distribution (QKD) channel is detected, continuing to generate a shared quantum entropy source between the first communication device and the second communication device at a first frequency through the quantum key distribution (QKD) channel.

[0014] Secondly, embodiments of this application provide a communication encryption device based on quantum key distribution (QKD), applied to a first communication device. The aforementioned communication encryption device based on QKD includes:

[0015] A generation module is used to generate a shared quantum entropy source between the first communication device and the second communication device at a first frequency via a quantum key distribution (QKD) channel.

[0016] The binding module is used to bind the shared quantum entropy source to a communication state identifier after each shared quantum entropy source is generated, with each communication state identifier associated with a communication cycle.

[0017] The update module is used to update the current communication status identifier to the communication status identifier corresponding to the above communication cycle after each communication cycle is reached.

[0018] The encryption / decryption module is used to encrypt and decrypt service data at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the above communication period within the above communication period.

[0019] The second frequency is higher than the first frequency.

[0020] In one possible implementation, the aforementioned quantum key distribution (QKD) communication encryption device further includes: a processing module, configured to pre-set at least one absolute time point and set an overlapping window [TX, T+X] for each absolute time point; wherein each absolute time point is the start time of a communication cycle, T is an absolute time point, and X is less than the duration of the corresponding communication cycle; within the overlapping window corresponding to the aforementioned communication cycle, simultaneously receiving data packets obtained by encryption processing using the shared quantum entropy source corresponding to the communication state identifier before the update, and data packets obtained by encryption processing using the shared quantum entropy source corresponding to the updated communication state identifier, and performing decryption processing using the corresponding shared quantum entropy source.

[0021] In another possible implementation, the processing module is further configured to: receive only the data packets obtained by encryption using the shared quantum entropy source corresponding to the updated communication state identifier during a time period that exceeds the aforementioned overlapping window and is within the aforementioned communication cycle, and decrypt the data packets using the shared quantum entropy source bound to the aforementioned updated communication state identifier.

[0022] Another possible implementation is that, during the aforementioned communication cycle, the header of the data packets sent by the first communication device contains an updated communication status identifier.

[0023] In another possible implementation, the above processing module is also used to: securely erase the shared quantum entropy source bound to the communication state identifier before the update after detecting an update to the current communication state identifier.

[0024] In another possible implementation, the aforementioned processing module is also used to: when a quantum key distribution (QKD) channel failure is detected, perform at least one of the following operations: extend the effective usage time of the currently used shared quantum entropy source; use a pre-stored backup shared quantum entropy source; suspend the initiation of new encrypted communication sessions, and retain the decryption capability of the aforementioned first communication device using the shared quantum entropy source for decryption processing.

[0025] In another possible implementation, the aforementioned generation module is further configured to: upon detecting the recovery of the quantum key distribution (QKD) channel, continue to generate a shared quantum entropy source between the first communication device and the second communication device at a first frequency through the aforementioned QKD channel.

[0026] Thirdly, this application provides a communication encryption system for quantum key distribution (QKD), the aforementioned QKD communication encryption system comprising:

[0027] A quantum key distribution (QKD) entropy source supply subsystem is used to generate a shared quantum entropy source between a first communication device and a second communication device at a first frequency through a quantum key distribution (QKD) channel, and transmit the shared quantum entropy source to an enhanced seed management unit after each shared quantum entropy source is generated.

[0028] The enhanced seed management unit described above is used to receive the shared quantum entropy source, bind the shared quantum entropy source with a communication status identifier and store it, with each communication status identifier associated with a communication cycle;

[0029] The virtual keybook encryption / decryption subsystem is used to encrypt and decrypt business data at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle after each communication cycle is reached; the second frequency is higher than the first frequency.

[0030] The seed update control unit is used to update the current communication state identifier to the communication state identifier corresponding to the aforementioned communication cycle after each communication cycle, and to start using the shared quantum entropy source associated with the communication state identifier corresponding to the aforementioned communication cycle as a new seed.

[0031] Fourthly, this application provides an electronic device comprising: a processor and a memory; the memory storing a program or instructions executable on the processor, wherein the program or instructions, when executed by the processor, implement the method of the first aspect or the method of the second aspect.

[0032] Fifthly, this application provides a readable storage medium on which a program or instructions are stored, which, when executed by a computer, implement the method of the first aspect or the method of the second aspect.

[0033] Sixthly, this application provides a computer program product that is stored in a storage medium and, when executed by a computer, implements the method of the first aspect or the method of the second aspect.

[0034] In a seventh aspect, embodiments of this application provide a chip including a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the method described in the first aspect, or to implement the method described in the second aspect above.

[0035] The beneficial effects of the second to seventh aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0036] Figure 1A schematic diagram of a network architecture for a communication encryption method based on quantum key distribution (QKD) provided in an embodiment of this application;

[0037] Figure 2 A flowchart illustrating a communication encryption method based on quantum key distribution (QKD) provided for embodiments of this application;

[0038] Figure 3 A flowchart illustrating a communication encryption method based on quantum key distribution (QKD) provided for embodiments of this application;

[0039] Figure 4 A flowchart illustrating a communication encryption method based on quantum key distribution (QKD) provided for embodiments of this application;

[0040] Figure 5 A flowchart illustrating a communication encryption method based on quantum key distribution (QKD) provided for embodiments of this application;

[0041] Figure 6 A schematic diagram of a communication encryption system based on quantum key distribution (QKD) provided in this application embodiment;

[0042] Figure 7 A schematic diagram of the structure of the virtual key encryption / decryption subsystem provided in the embodiments of this application;

[0043] Figure 8 This is a flowchart of the seed dynamic update method provided in the embodiments of this application;

[0044] Figure 9 A schematic diagram illustrating the implementation process of the communication encryption method based on quantum key distribution (QKD) provided in this application embodiment under one scenario;

[0045] Figure 10 A schematic diagram illustrating the implementation process of the communication encryption method based on quantum key distribution (QKD) provided in this application embodiment in another scenario;

[0046] Figure 11 A state diagram of system downgrade and recovery strategies provided in the embodiments of this application;

[0047] Figure 12 A schematic diagram of a communication encryption device based on quantum key distribution (QKD) provided in this application embodiment;

[0048] Figure 13 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0050] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0051] The terms "at least one," "at least one of," etc., used in the specification and claims of this application refer to any one, any two, or a combination of two or more of the included items. For example, at least one of a, b, and c can mean: "a," "b," "c," "a and b," "a and c," "b and c," and "a, b, and c," where a, b, and c can be single or multiple. Similarly, "at least two" refers to two or more items, and its meaning is similar to that of "at least one."

[0052] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0053] The embodiments of this application provide a communication encryption method, apparatus and system based on quantum key distribution (QKD), which can be applied to data transmission scenarios.

[0054] With the development of quantum computing technology, traditional public-key cryptosystems (such as RSA and ECC) based on mathematical problems such as large integer factorization and discrete logarithms face severe challenges. Shor's algorithm can solve these mathematical problems in polynomial time, leading to security risks in existing widely used encryption systems. Against this backdrop, highly secure encryption schemes that are quantum-resistant, easy to engineer, and adaptable to complex network environments have attracted widespread attention.

[0055] One-Time Password (OTP) is a mathematically proven secure encryption scheme, but its engineering implementation faces major obstacles: it requires the pre-generation, storage, and distribution of massive amounts of truly random keys (TB to PB level) equal to the total number of communications, resulting in high storage and distribution costs; at the same time, traditional OTP lacks a forward security mechanism, and once the key store is leaked, all historical communications can be decrypted; bidirectional / multi-party communication requires maintaining an O(N²) level independent keybook, resulting in poor scalability and limiting large-scale applications.

[0056] To overcome the aforementioned shortcomings of OTP, a "virtual keybook" technical solution has emerged in this field. This solution reduces the physical storage of key materials required for long-term secure communication from massive levels to manageable levels through a minimal true random seed library and a deterministic key generation algorithm. It also supports constant-time (O(1)) random access to any position in the key stream, inter-session isolation, and negotiation-free bidirectional communication. However, this solution still faces a problem in its practical engineering application: the initial establishment, distribution, and long-term updates of its security foundation—the true random seed library—still rely on physical handover or complex out-of-band protocols based on computational security assumptions, resulting in limited initial deployment flexibility and high long-term operational complexity.

[0057] To address the aforementioned seed supply problem, two technical approaches have been explored in this field:

[0058] Path 1: Online Seed Negotiation Scheme Based on Computationally Secure Protocols. This approach uses certified classical cryptographic protocols (such as TLS combined with the post-quantum cryptography algorithm PQC) to negotiate a session key in a computationally secure manner, and then uses this session key to encrypt and transmit the new seed library. The main limitation of this path is that the long-term security of the system shifts from information-theoretical security to computational security dependent on the negotiation protocol used, thus altering the foundation of security.

[0059] Path Two: Direct Encryption Scheme Using Quantum Key Distribution (QKD). This approach uses the shared keystream generated in real-time by the QKD device as the keybook for One-Time Pad (OTP) encryption or as the session key for symmetric encryption algorithms such as AES to encrypt business data. The main limitation of this path is the order-of-magnitude gap between the real-time key generation rate of QKD (typically Kbps to low Mbps) and the data communication rate (Gbps), making it difficult to meet the encryption requirements of high-speed services.

[0060] This shows that current technologies still suffer from low efficiency in transmitting business data.

[0061] To address the aforementioned technical problems, embodiments of this application provide a communication encryption method, apparatus, and system based on quantum key distribution (QKD). Through a QKD channel, a shared quantum entropy source is generated between a first communication device and a second communication device at a first frequency. After each shared quantum entropy source is generated, it is bound to a communication state identifier. This allows the current communication state identifier to be updated to the communication state identifier corresponding to the communication cycle at the end of each communication cycle. Within the communication cycle, business data is encrypted and decrypted at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle. In this way, by continuously generating a shared quantum entropy source at a certain frequency through the quantum key distribution (QKD) channel, the seed can be automatically updated without interrupting the service and without manual intervention, for use when communicating between the first and second communication devices. At the same time, using QKD as a background entropy source can also avoid the constraint of QKD key generation rate on encryption speed, maintain the end-to-end information theory security characteristics of the system, enable it to support high-speed data encryption services without waiting for real-time key generation, accelerate the data transmission rate of business data, and thus improve the transmission efficiency of business data.

[0062] The following description, in conjunction with the accompanying drawings, details the communication encryption method, apparatus, and system based on quantum key distribution (QKD) provided in the embodiments of this application.

[0063] It should be noted that the following will explain the technical terms involved in the communication encryption method, device and system based on quantum key distribution (QKD) provided in this application, so as to facilitate subsequent understanding.

[0064] Device Identifier: Both communicating parties are assigned a fixed and distinct device identifier, with one party having a value of 0 and the other having a value of 1.

[0065] Position counter: Used to indicate the current position in the key stream, updated according to the parity rule.

[0066] Information-theoretic security refers to security that cannot be cracked even if an attacker has unlimited computing power, as opposed to computational security, which relies on assumptions about computational complexity.

[0067] Figure 1 This illustration shows a network architecture for a communication encryption method based on quantum key distribution (QKD) provided in an embodiment of this application. For example... Figure 1 As shown, the network architecture includes a communication encryption device 101 based on quantum key distribution (QKD) and a terminal device 102. The communication encryption device 101 and the terminal device are interconnected.

[0068] In some embodiments, the communication encryption device 101 based on quantum key distribution (QKD) can be a server, a computer, or a processor or processing unit within a server or computer. The server can be a single server or a server cluster consisting of multiple servers. It should be noted that the embodiments of this application do not limit the specific device form of the communication encryption device 101 based on quantum key distribution (QKD). Figure 1 The example shown is a communication encryption device 101 based on quantum key distribution (QKD) as a single server.

[0069] In some embodiments, the terminal device may be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, mobile internet device (MID), augmented reality (AR) / virtual reality (VR) device, robot, wearable device, personal computer (PC), ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc., and the embodiments of this application do not specifically limit it. Figure 1 The example shown is a mobile phone as the terminal device.

[0070] In some embodiments, the communication encryption device 101 based on quantum key distribution (QKD) generates a shared quantum entropy source between the first terminal device 102 and the second terminal device 103 at a first frequency through a QKD channel. After each shared quantum entropy source is generated, it is bound to a communication status identifier, and each communication status identifier is associated with a communication cycle. After each communication cycle, the current communication status identifier is updated to the communication status identifier corresponding to the communication cycle. Within the communication cycle, the business data is encrypted and decrypted based on the shared quantum entropy source associated with the communication status identifier corresponding to the communication cycle at a second frequency. The second frequency is higher than the first frequency.

[0071] It should be noted that the network architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As network architectures evolve, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0072] See Figure 2 This is a flowchart illustrating a communication encryption method based on quantum key distribution (QKD) provided in an embodiment of this application. Figure 2 As shown, the communication encryption method based on quantum key distribution (QKD) provided in this application embodiment can be implemented by the above-mentioned communication encryption device based on quantum key distribution (QKD), specifically including the following steps 201 to 202.

[0073] Step 201: The communication encryption device based on quantum key distribution (QKD) generates a shared quantum entropy source between the first communication device and the second communication device at a first frequency through the QKD channel. After each shared quantum entropy source is generated, the shared quantum entropy source is bound to a communication status identifier.

[0074] Each communication status identifier is associated with a communication cycle.

[0075] In some embodiments, the communication status identifier is used to uniquely identify a communication status cycle, and can be based on Coordinated Universal Time (UTC), session ID, event ID or pre-assigned sequence number. This application uses UTC time as an example for illustration, but it does not constitute a limitation.

[0076] Step 202: After each communication cycle, the communication encryption device based on quantum key distribution (QKD) updates the current communication state identifier to the communication state identifier corresponding to the communication cycle, and within the communication cycle, performs encryption and decryption processing on the business data at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle.

[0077] The second frequency is higher than the first frequency.

[0078] In some embodiments, the communication period is the time agreed upon between the communication devices for transmitting and receiving encrypted data packets.

[0079] In some embodiments, the communication status identifier is updated dynamically based on changes in the associated communication period.

[0080] The communication encryption method based on Quantum Key Distribution (QKD) provided in this application generates a shared quantum entropy source between a first communication device and a second communication device at a first frequency through a QKD channel. After each shared quantum entropy source is generated, it is bound to a communication state identifier. This allows the current communication state identifier to be updated to the communication state identifier corresponding to the communication cycle at the end of each communication cycle. Within the communication cycle, the service data is encrypted and decrypted based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle at a second frequency. Thus, by continuously generating shared quantum entropy sources at a certain frequency through the QKD channel, the seed can be automatically updated without interrupting service or requiring manual intervention for use during communication between the first and second communication devices. Furthermore, using QKD as a background entropy source avoids the constraint of QKD key generation rate on encryption speed, maintaining the end-to-end information theory security characteristics of the system. This enables the system to support high-speed data encryption services without waiting for real-time key generation, accelerating service data transmission speed and improving service data transmission efficiency.

[0081] In some embodiments, such as Figure 3 As shown in the embodiments of this application, a communication encryption method based on quantum key distribution (QKD) may further include the following steps 301 and 302.

[0082] Step 301: The communication encryption device based on quantum key distribution (QKD) pre-sets at least one absolute time point and sets an overlapping window [TX, T+X] for each absolute time point.

[0083] Each absolute time point is the start time of a communication cycle, T is an absolute time point, and X is less than the duration of the corresponding communication cycle.

[0084] In some embodiments, an overlapping window refers to a sliding segmentation mechanism that involves segmenting and windowing consecutive time periods, with adjacent time periods overlapping.

[0085] Step 302: Within the overlapping window corresponding to the communication cycle, the communication encryption device based on quantum key distribution (QKD) simultaneously receives data packets obtained by encryption using the shared quantum entropy source corresponding to the communication state identifier before the update, and data packets obtained by encryption using the shared quantum entropy source corresponding to the updated communication state identifier, and performs decryption using the corresponding shared quantum entropy source.

[0086] In some embodiments, encryption processing refers to encrypting the plaintext to be transmitted, and decryption processing refers to decrypting the ciphertext in the received data packet to obtain the plaintext to be transmitted.

[0087] Thus, by setting an overlapping window, the shared quantum entropy source can be dynamically updated according to the update of the communication state identifier when transmitting data within the overlapping window corresponding to the communication cycle, thereby ensuring data security.

[0088] It should be noted that the execution order of steps 301 and 202 described above is not limited in this embodiment. Figure 3 This example illustrates the process of executing step 202 first, followed by step 301.

[0089] In some embodiments, such as Figure 4 As shown in the embodiment of this application, a communication encryption method based on quantum key distribution (QKD) may further include the following step 401.

[0090] Step 401: During the time period outside the overlap window but within the communication cycle, the communication encryption device based on quantum key distribution (QKD) only receives data packets encrypted using the shared quantum entropy source corresponding to the updated communication state identifier, and decrypts them using the shared quantum entropy source bound to the updated communication state identifier.

[0091] In some embodiments, the time period exceeding the overlap window but within the communication cycle refers to a time period that exceeds the duration set by the overlap window but is still within the communication cycle agreed upon by both parties.

[0092] Thus, by setting an overlapping window, when data is transmitted outside the overlapping window corresponding to the communication cycle, the communication status identifier is updated. The communication encryption device based on quantum key distribution (QKD) can only receive data packets decrypted using the dynamically updated shared quantum entropy source, thereby ensuring data security.

[0093] In some embodiments, during the aforementioned communication cycle, the header of the data packet sent by the first communication device contains an updated communication status identifier.

[0094] In some embodiments, the packet header includes a communication status identifier, a device identifier, ciphertext, etc.

[0095] In some embodiments, the ciphertext is obtained by XORing the device identifier with the plaintext to be transmitted.

[0096] In this way, when transmitting data packets, the updated communication status identifier is also transmitted at the same time. The communication encryption device based on quantum key distribution (QKD) can dynamically adjust the shared quantum entropy source according to the updated communication status identifier, thereby ensuring the security and stability of the data.

[0097] It should be noted that the execution order of steps 401 and 202 described above is not limited in this embodiment. Figure 4 This example illustrates the process of executing step 202 first, followed by step 401.

[0098] In some embodiments, such as Figure 5 As shown in the embodiment of this application, a communication encryption method based on quantum key distribution (QKD) may further include the following step 501.

[0099] Step 501: After detecting an update to the current communication state identifier, the communication encryption device based on quantum key distribution (QKD) securely erases the shared quantum entropy source bound to the communication state identifier before the update.

[0100] In some embodiments, secure erasure refers to using physical destruction to bind a shared quantum entropy source to the communication state identifier before the update.

[0101] In this way, through dynamic seed updates and proactive security erasure of old seeds, the shared quantum entropy source before the update is physically destroyed, thereby ensuring the security and stability of the data.

[0102] It should be noted that the execution order of steps 501 and 202 described above is not limited in this embodiment. Figure 5 This example illustrates the process of executing step 202 first, followed by step 501.

[0103] In some embodiments, when the above-mentioned communication encryption device based on quantum key distribution (QKD) detects that the QKD channel has failed, it performs at least one of the following operations: extends the effective usage time of the currently used shared quantum entropy source; uses a pre-stored backup shared quantum entropy source; suspends the initiation of new encrypted communication sessions, and retains the decryption capability of the first communication device using the shared quantum entropy source for decryption processing.

[0104] In some embodiments, quantum key distribution (QKD) failure means that QKD can no longer generate a shared quantum entropy source.

[0105] Thus, by extending the effective usage time of the currently used shared quantum entropy source, using a pre-stored backup shared quantum entropy source, or pausing the initiation of new encrypted communication sessions, the decryption capability of the communication encryption device based on quantum key distribution (QKD) using the shared quantum entropy source for decryption processing is preserved, so that when the supply of shared quantum entropy source is insufficient, the communication encryption device based on quantum key distribution (QKD) can still perform data transmission, thereby improving the efficiency of data transmission.

[0106] In some embodiments, when the above-mentioned communication encryption device based on quantum key distribution (QKD) detects that the QKD channel has been restored, it continues to generate a shared quantum entropy source between the first communication device and the second communication device at a first frequency through the QKD channel.

[0107] In some embodiments, quantum key distribution (QKD) recovery refers to the ability of QKD to continue generating a shared quantum entropy source.

[0108] Thus, when the quantum key distribution (QKD) channel is restored, it continues to generate a shared quantum entropy source for data transmission, thereby improving the efficiency of data transmission.

[0109] The following specific embodiments illustrate the communication encryption method based on quantum key distribution (QKD) of this application.

[0110] This embodiment will elaborate on the core architecture, module design, core process, and robustness strategy of this application. It should be noted that the specific implementation of the virtual key book encryption engine involved in this application has been described in detail later in this section. This application improves upon this encryption engine by introducing Quantum Key Distribution (QKD) as an entropy source supply infrastructure. Furthermore, the QKD protocol and device, as the physical implementation of the entropy source, are mature technologies well-known in the art. The scope of protection of this application does not lie in creating or improving these components themselves, but in systematically reconstructing and integrating them in a specific and innovative manner, introducing a completely new system architecture and interaction process to solve specific technical problems.

[0111] The core inventive concept and system architecture of this application are explained below.

[0112] The table below shows the correspondence between the core essential technical features and the technical problems they solve:

[0113] Table 1

[0114]

[0115] The core inventive concept of this application: the role reconstruction and entropy source supply paradigm of quantum key distribution (QKD).

[0116] The core inventive concept of this application lies in fundamentally reconstructing the role and function of quantum key distribution (QKD) technology. Unlike the conventional understanding of existing technologies that regard QKD as a "low-speed key stream generator," this application proposes and defines a new role for QKD for the first time—"secure entropy source supply infrastructure."

[0117] Under this new paradigm, the core value of Quantum Key Distribution (QKD) is redefined as providing downstream, high-performance virtual keybook encryption engines with a low-frequency (e.g., once a day), small-scale (e.g., 256 bits) but information-theoretically secure source of fresh, truly random entropy (i.e., seeds) in an information-theoretically secure manner. This concept systematically circumvents the rate bottleneck of QKD while perfectly aligning its strongest capability (secure distribution) with the strongest capability of virtual keybooks (efficient encryption).

[0118] This application defines the system architecture.

[0119] Based on the above concept, this application proposes a quantum key distribution (QKD) enhanced virtual keybook system. For example... Figure 3 The diagram illustrates the logical architecture of the system, which consists of two peer-to-peer communication nodes, each logically comprising four layers:

[0120] 1) Entropy source supply subsystem (bottom layer): includes quantum key distribution (QKD) hardware and quantum key management unit, which is responsible for generating information-theoretically secure shared entropy sources through quantum channels in cooperation with the peer.

[0121] 2) Enhanced Seed Management Unit (a core addition in this application): As a dedicated adaptation layer between entropy source supply and encryption core, it includes entropy source receiving and binding functions, seed on-demand supply functions, and internal maintenance of the state-entropy source mapping table.

[0122] 3) Seed update control unit (a core addition in this application): As the central scheduler for system updates, it includes trigger decision-making, state switching management, and peer coordination functions.

[0123] 4) Virtual Keybook Encryption / Decryption Subsystem (Top Level): Includes status management, location management, and encryption / decryption modules. The only change is that the seed acquisition interface is now requested from the enhanced seed management unit.

[0124] In the diagram, solid arrows represent data flows (entropy source flow, seed supply flow, and encrypted data flow), while dashed arrows represent control flows. Node A and Node B are connected via a quantum channel (between quantum key distribution (QKD)) and a classical channel (encrypted data and control coordination).

[0125] like Figure 6 As shown, the system consists of two peer communication nodes, each of which logically contains the following core modules:

[0126] 1. Entropy Source Supply Subsystem 601

[0127] 1) Composition: It includes quantum key distribution (QKD) hardware devices and quantum key management units.

[0128] 2) Function: Through the collaboration of quantum and classical channels, a quantum key distribution protocol is completed, and after post-processing such as information harmonization and privacy amplification, a high-quality, information-theoretic-secure shared true random number (i.e., the aforementioned shared entropy source) is finally output.

[0129] 3) Position in this application: Its only functional output is to serve as a "safety entropy source" to provide seed materials for the upper layer.

[0130] It should be noted that the information reconciliation and privacy amplification process performed by the quantum key management unit is an essential component of the protocol of any quantum key distribution (QKD) system. The classical channel interaction required in this process does not rely on computational complexity assumptions for security (the selection of error-correcting codes does not affect the information-theoretical security properties of the final key), and this interaction occurs within the QKD subsystem, transparent to the higher-level architecture of this application. Therefore, the QKD subsystem, as a whole, still provides the upper layers with a shared entropy source of information-theoretical security.

[0131] 2. Enhanced Seed Management Unit 602 (Core New Module in this Application)

[0132] 1) Technical positioning: As a dedicated adaptation and coupling layer between the entropy source supply subsystem and the virtual keybook encryption and decryption subsystem.

[0133] 2) Core functional interfaces:

[0134] (1) Entropy source receiving and binding function: Receives a secure entropy source R from the quantum key management unit and uniquely binds and encrypts R with a pre-determined communication state identifier (such as State_ID_next) representing a future communication cycle.

[0135] (2) Seed supply function: In response to the request of the virtual keybook encryption and decryption subsystem, query and return the entropy source that is correctly bound to it as a seed according to the current communication status identifier (such as State_ID_current) carried in the request.

[0136] 3) Internal Mechanism: This unit maintains a secure state-entropy source mapping table (such as a hash table). The binding operation creates or updates the mapping record of State_ID_next -> R in the table; the supply operation looks up the table based on State_ID_current and returns the corresponding entropy source R.

[0137] 4) Key Function: It decouples the encryption engine from the entropy source supply mechanism. The virtual keybook encryption / decryption subsystem does not need to care whether the seed comes from a pre-stored static library or is dynamically injected from quantum key distribution (QKD); it only needs to request the seed based on the communication status identifier. This lays the foundation for seamless dynamic updates of the system.

[0138] From a functional perspective, this unit can be broadly categorized as a key material management device for a secure communication system, and its configuration includes:

[0139] 5) First logic unit: used to receive the first key material from an external security entropy source and associate the first key material with a first communication status identifier representing a future communication cycle.

[0140] 6) Second logical unit: used to respond to the request from the encryption core and return the second key material associated with it based on the second communication status identifier carried in the request.

[0141] 3. Seed update control unit 604 (a core new module in this application)

[0142] 1) Core function: Serves as the central scheduler for the system update process.

[0143] 2) Specific responsibilities:

[0144] (1) Trigger decision: Based on the preset strategy (such as timing, usage threshold), a new round of entropy source acquisition process is started.

[0145] (2) Process control: Sending start instructions to the quantum key distribution (QKD) hardware; coordinating the timing of entropy source injection into the enhanced seed management unit.

[0146] (3) State switching management: When appropriate, instruct the virtual keybook encryption and decryption subsystem to perform atomic state switching.

[0147] (4) Optional coordination: exchange lightweight synchronization signals with the peer node to ensure that the update rhythm of both parties is consistent.

[0148] 4. Virtual Keybook Encryption / Decryption Subsystem 603

[0149] The aforementioned virtual keybook encryption / decryption subsystem is used for high-speed data encryption based on a seed. Its structure and working principle are described in detail below. Figure 4 The diagram shows the internal architecture of the virtual keybook encryption / decryption subsystem.

[0150] Figure 7 The internal module structure and data flow relationship of the virtual keybook encryption / decryption subsystem 603 are illustrated. It should be noted that the architecture and internal algorithms of this virtual keybook encryption / decryption subsystem 603 are known technologies in the art. The improvement of this application lies not in these aspects, but in its integration with the quantum key distribution (QKD) entropy source supply subsystem. This core is logically divided into four layers:

[0151] 1) State and Session Management Layer: Includes a state management module and a location management module, responsible for generating the communication state identifier State_ID and maintaining the local location counter LP. The initialization and updating of LP follow the parity separation rule to ensure the isolation of the two-way key space.

[0152] 2) Key generation layer: includes key derivation module F1 and key stream generation module F2. F1 derives encryption key K and initialization vector IV by binding seed S with State_ID based on HKDF-HMAC-SHA256; F2 generates key stream KS of specified length based on AES-256-CTR mode according to K, IV and LP values.

[0153] 3) Encryption / decryption processing layer: This layer includes an encryption module, a decryption module, and a self-synchronization encapsulation module. During encryption, key bytes are taken from KS at intervals based on the parity of Sender_ID, XORed with the plaintext to generate ciphertext, and then encapsulated in a self-synchronization header containing information such as State_ID, Sender_ID, and LP.

[0154] 4) External interfaces: including seed request interface (requesting seeds from the enhanced seed management unit) and data input / output interface.

[0155] The following provides a detailed explanation of the 603 logical layer of the virtual keybook encryption / decryption subsystem.

[0156] Status Management Module

[0157] 1) Core function: Generate and output a unique communication state identifier State_ID for the current communication session according to a preset strategy to achieve intrinsic isolation between sessions.

[0158] 2) Input: Preset state division dimension (optional: UTC time, session ID, event ID, pre-assigned sequence number, etc., time is only a preferred embodiment).

[0159] 3) Output: State_ID, typically implemented as a UTC date string (e.g., "20260520").

[0160] 4) Design principle: Continuous communication is divided into independent session states by State_ID. Different states correspond to completely independent seeds. Even if the key of the current state is leaked, it is impossible to decrypt the historical communication of other states. Forward security can be achieved without additional protocols.

[0161] Local location and two-way pairing management module

[0162] 1) Core function: Maintain a monotonically increasing local location counter LP for each (State_ID, Sender_ID) pair, and mathematically guarantee zero-conflict key pairing for bidirectional communication through parity separation rules.

[0163] 2) Input: State_ID, local fixed identity identifier Sender_ID, plaintext length L.

[0164] 3) Output: Current LP value (64-bit unsigned integer), updated LP value.

[0165] Core rule design:

[0166] 4) Fixed identity rule: In a two-way communication link, both parties are assigned a fixed and distinct Sender_ID during system initialization. One party is permanently assigned 0, and the other party is permanently assigned 1. This cannot be changed throughout the entire process.

[0167] 5) Initialization rules: When each new State_ID is activated, LP sets an initial value based on Sender_ID: when Sender_ID=0, the initial value of LP is 0 (even number); when Sender_ID=1, the initial value of LP is 1 (odd number).

[0168] 6) Update rule: After each plaintext of length L bytes is sent, LP is updated according to the formula: New LP value = Old LP value + 2 × L.

[0169] 7) Mathematical guarantee: The parity of the initial value is completely consistent with Sender_ID, and the update increment 2×L is always even. Therefore, the parity of the LP value is always consistent with Sender_ID and remains unchanged throughout the entire communication process.

[0170] Key Derivation Module (F1)

[0171] 1) Core function: Cryptographically bind the seed S with the State_ID to derive a key parameter for stream encryption, thereby strengthening isolation between sessions.

[0172] 2) Input: Seed S, State_ID.

[0173] 3) Output: 256-bit encryption key K (32 bytes), 128-bit initialization vector IV (16 bytes).

[0174] 4) Algorithm implementation: The NIST-standardized HKDF-HMAC-SHA256 key derivation function is adopted. S is used as the input key material, a fixed string is used as the salt value, and State_ID is used as the context information. After the extraction and expansion stages, 48 ​​bytes of derivation material are output, with the first 32 bytes being K and the last 16 bytes being IV.

[0175] 5) Design principle: By using State_ID as the derived context, even if the same seed is under different State_IDs, completely different (K, IV) pairs will be generated, which further strengthens the cryptographic isolation between sessions.

[0176] Keystream generation module (F2)

[0177] 1) Core function: Based on K, IV and starting position, generate key stream segments of specified length in real time, and support constant-time random access at any position.

[0178] 2) Input: Encryption key K, initialization vector IV, starting offset start (i.e., current LP value), required length len (fixed to 2×L, where L is the plaintext length).

[0179] 3) Output: A continuous key stream byte sequence KS of length len.

[0180] 4) Implementation of the algorithm: Based on the NIST-standardized AES-256-CTR mode. The algorithm execution steps are as follows: (1) Interpret the IV as a 128-bit big-endian unsigned integer BASE_COUNTER; (2) Calculate the starting block index START_BLOCK_INDEX = floor(start / 16); (3) Calculate the byte offset within the block INTRA_BLOCK_OFFSET = start mod 16; (4) Starting from CURRENT_COUNTER = BASE_COUNTER + START_BLOCK_INDEX, perform AES-256 encryption to generate encrypted blocks in a loop, copying bytes to the output buffer as needed, until len bytes are generated. The time complexity of the algorithm is only related to len and not to start, achieving O(1) time random access.

[0181] Encryption and self-synchronization encapsulation module

[0182] 1) Core function: Apply parity separation rules to retrieve key bytes, complete plaintext encryption, and construct transmission data packets with self-synchronization information.

[0183] 2) Input: plaintext, key stream KS, sender_ID, state_ID, current LP value, plaintext length L.

[0184] 3) Output: Complete encrypted data packet.

[0185] Core execution steps:

[0186] 4) Key retrieval: Based on the parity of Sender_ID, L key bytes are retrieved at intervals from the 2L keystream KS:

[0187] (1) When Sender_ID=0, use KS[0], KS[2], KS[4]……KS[2L-2] (all even-numbered index bytes);

[0188] (2) When Sender_ID=1, KS[1], KS[3], KS[5]……KS[2L-1] (all odd index bytes) are used.

[0189] 5) Encryption operation: XOR the L key bytes with the L plaintext bytes one by one to generate ciphertext C.

[0190] 6) Self-synchronous encapsulation: Construct a data packet header containing the core triple {State_ID, Sender_ID, logic_pos} (logic_pos is the LP value used this time) and payload_len (plaintext length L); concatenate the packet header and ciphertext C to form a complete transmission data packet.

[0191] 7) Design principle: The packet header carries all the information for key positioning. The receiver can completely reconstruct the corresponding key stream based solely on the packet header. There is no need for pre-synchronization of the state or any online negotiation, thus achieving true self-synchronizing encrypted communication.

[0192] Decryption module

[0193] The receiver parses the header field and ciphertext payload from the network data packet, extracting the parameters {State_ID, Sender_ID, logic_pos, payload_len}. The receiver uses the same State_ID to obtain the corresponding seed, calculates (K, IV) pairs using the same F1 algorithm, generates a keystream KS' using the same F2 algorithm with logic_pos as the start and 2 × payload_len as the length, and extracts the key bytes according to the same parity separation rule based on Sender_ID. These bytes are then XORed byte-by-byte with the ciphertext to recover the plaintext.

[0194] Interface changes of the virtual keybook encryption / decryption subsystem in this application

[0195] In this application, the interface for obtaining seeds by the aforementioned virtual keybook encryption / decryption subsystem has been changed from "accessing the local static seed library file" in the original scheme to "sending a request to the enhanced seed management unit." Specifically:

[0196] 1) Original solution: After the state management module determines the State_ID, it directly accesses the pre-shared local seed library file, retrieves and reads the corresponding seed.

[0197] 2) In this application: After the state management module determines the State_ID, it sends a request to the enhanced seed management unit with the State_ID as the request parameter; the enhanced seed management unit returns the seed bound to the State_ID.

[0198] Apart from this interface change, all algorithms, processes, and logic within the virtual keybook encryption and decryption subsystem remain unchanged.

[0199] The following is the seed dynamic update method flow provided in this application.

[0200] based on Figure 6 Based on the existing architecture, this application defines a complete method for dynamic seed updates. Its core is the combination of secure injection of entropy sources with atomic transitions of communication states. For example... Figure 8 The diagram illustrates the specific process of this method, which consists of three consecutive stages:

[0201] 1) Phase One (Entropy Source Acquisition and Secure Injection): Starting from the control logic trigger, through quantum key distribution (QKD) generation and post-processing, until the enhanced seed management unit binds the fresh entropy source with the future communication state identifier. This phase is completely transparent to the current business.

[0202] 2) Phase Two (Atomized State Transition): At a preset absolute time point T, the system performs a state switch. Core operations include waiting for synchronization conditions, sending a switch command, atomically updating the state, and using a new seed for encrypted communication. The overlapping window design [T-Δ, T+Δ] ensures communication continuity during the switch.

[0203] 3) Phase Three (Security Cleanup): After the new state is running stably, all key materials of the old state are securely erased to achieve enhanced forward security based on physical destruction.

[0204] Phase 1: Entropy Source Acquisition and Security Injection

[0205] Trigger: The seed update control unit 604 sends a start command to the quantum key distribution (QKD) device of this node according to a preset strategy (e.g., daily UTC 23:50).

[0206] Generation: The quantum key distribution (QKD) device collaborates with the peer to complete a key distribution session through a quantum channel, generating the original shared random bit stream.

[0207] Processing: The quantum key management unit performs standard post-processing (information harmonization, privacy amplification) on the original random numbers, and finally outputs a high-quality, information-theoretic-secure shared entropy source, denoted as R.

[0208] Delivery: The quantum key management unit outputs the entropy source R to the enhanced seed management unit.

[0209] Binding (core operation): After receiving the entropy source R, the enhanced seed management unit stores it securely and establishes a unique binding relationship between R and a communication state identifier State_ID_next (such as "20260520") representing the next day's communication cycle in its internal state-entropy source mapping table.

[0210] Confirmation: The enhanced seed management unit returns an operation completion confirmation to the control logic. At this point, the fresh entropy source R is ready as the proprietary seed of State_ID_next, but currently active communication still uses the old State_ID_prev and its seed, and the update process is completely transparent to the business.

[0211] Phase Two: Atomization State Transition

[0212] Synchronization Wait: The control logic waits for the synchronization condition for state switching to be met. A preferred embodiment is to wait for a pre-synchronized absolute time point T (e.g., UTC 00:00:00). To tolerate microsecond-level clock skew and network latency, a short overlapping window [T-Δ, T+Δ] (e.g., Δ=1 second) can be set.

[0213] Switching instruction: When the local clock reaches time T, the control logic sends a state switching instruction to the virtual keybook encryption / decryption subsystem. The instruction contains State_ID_next.

[0214] State Update: The virtual keybook encryption and decryption subsystem atomically updates the currently active communication state identifier maintained internally from State_ID_prev to State_ID_next.

[0215] Seed Supply: Subsequently, when the virtual keybook encryption / decryption subsystem needs to generate a key for a new data packet, it requests the seed corresponding to State_ID_next from the enhanced seed management unit. The enhanced seed management unit returns an entropy source R based on the bound record. Encryption and decryption operations are then performed based on the new key material derived from R.

[0216] Sending and receiving behavior rules: After time T, the state_id field in the header of new data packets generated by the sender must be State_ID_next. Within the overlapping window [T-Δ, T+Δ], the receiver can simultaneously accept valid data packets with state_id as either State_ID_prev or State_ID_next, and decrypt them using the corresponding seeds; after the window period, it only accepts data packets with state_ID_next. This rule ensures a smooth and secure handover.

[0217] Phase Three: Safety Cleanup

[0218] Erase command: After confirming that State_ID_next is running stably and that all communication sessions of State_ID_prev have timed out, the control logic sends a safe cleanup command to the enhanced seed management unit.

[0219] Secure Erasure: The enhanced seed management unit performs a secure erasure operation, completely destroying all key material associated with State_ID_prev from storage media and memory, including its bound entropy source R_prev and any intermediate keys derived from it. This step achieves enhanced forward security based on physical entropy source destruction, ensuring that even if an attacker gains system control in the future, the destroyed historical seed cannot be recovered.

[0220] To fully demonstrate the application of this application in real-world communication scenarios, this application will provide a complete implementation of two-way encrypted communication in different scenarios based on the above-mentioned dynamic update mechanism.

[0221] Figure 9 This illustrates the normal encrypted communication process between Party A and Party B.

[0222] Prerequisites: Both parties, Party A (fixed Sender_ID=0) and Party B (fixed Sender_ID=1), have completed the deployment of this system. Both parties have completed the remote distribution and binding of the initial entropy source through the quantum key distribution (QKD) channel. The current active communication status is identified as State_ID="20260520", and the corresponding seed is ready.

[0223] Scenario 1: Party A sends 100 bytes of plaintext to Party B.

[0224] S1. The encryption and decryption subsystem of Party A's virtual keybook obtains the current State_ID="20260520" from the state management module.

[0225] S2. Request the seed corresponding to State_ID="20260520" from the enhanced seed management unit to obtain the entropy source R.

[0226] S3. Party A uses R to execute the key derivation (F1) and key stream generation (F2) processes to generate a key stream of 200 bytes in length.

[0227] S4. Party A retrieves the even-numbered index key byte based on Sender_ID=0, and XORs it with 100 bytes of plaintext to generate ciphertext C1.

[0228] S5. Party A encapsulates the data packet, with the header containing {State_ID:"20260520", Sender_ID:0, logic_pos:0, payload_len:100}, and sends it to Party B through the classic channel.

[0229] S6. After receiving the packet, Party B parses the header, requests a seed with the same State_ID from its enhanced seed management unit, obtains the same entropy source R, and executes the same process to recover the plaintext.

[0230] Figure 10 This illustrates the communication process when Party A conducts encrypted communication with Party B, with the corresponding seed dynamically updated.

[0231] Scenario 2: Communication Example During State Transition

[0232] Assume that the state transition time agreed upon by both parties is UTC 00:00:00, and the transition overlap window Δ = 1 second.

[0233] S7. At T-0.5 seconds: The data packets sent by Party A still use State_ID="20260520".

[0234] S8. At time T: The control logic of both parties synchronously triggers the state switch, and the current state of the virtual key book encryption and decryption subsystem is updated to State_ID="20260521".

[0235] S9. At T+0.3 seconds: Party A encrypts and sends the data packet using the seed corresponding to the new state State_ID="20260521". Party B, because its receiving window is in the overlap period [T-1s, T+1s], can correctly identify and process the data packets of both the old and new states simultaneously, and decrypt them using the corresponding seed.

[0236] S10. At T+2 seconds: the overlapping window closes, and Party B only accepts data packets with State_ID="20260521". Old state data packets are discarded.

[0237] Thus, the two implementation methods described above verify that, in real communication scenarios, the dynamic seed update process of this application demonstrates the transparency of encrypted services and the continuity of communication.

[0238] The following describes the implementation process of the degradation and recovery strategy to explain the robust design.

[0239] To address potential failures in quantum key distribution (QKD) links, this application designs an intrinsic hierarchical degradation and self-healing strategy. For example... Figure 11 The state machine of this strategy is shown in the figure.

[0240] Figure 11 illustrate: Figure 11 The behavior patterns and transition relationships of the system under different states of the quantum key distribution (QKD) link are illustrated using a state machine. The system has four operating modes:

[0241] 1) Normal mode: Initial state, the quantum key distribution (QKD) link is normal, and seed updates are automatically performed according to the preset strategy.

[0242] 2) Time-Tolerant Mode: Level 1 Degradation, Quantum Key Distribution (QKD) is temporarily interrupted, and the service is maintained by extending the validity period of the current seed.

[0243] 3) Backup entropy source mode: Second-level degradation. If the interruption time of quantum key distribution (QKD) is too long, the pre-stored backup entropy source is consumed to maintain the service.

[0244] 4) Security Pause Mode: Level 3 downgrade, backup resources are exhausted, transmission capability is suspended but reception capability is retained.

[0245] Strategy Explanation:

[0246] 1. Normal Mode

[0247] 1) Entry conditions: The system is in its initial state or the quantum key distribution (QKD) link has returned to normal.

[0248] 2) System Action: The seed update control unit triggers the generation of the quantum key distribution (QKD) entropy source according to a preset strategy (such as daily timed execution), and performs actions such as... Figure 11 The complete update process is shown below.

[0249] 3) System status: Encrypted communication is proceeding at full speed, and security is at its best.

[0250] 2. Time Tolerance Mode

[0251] 1) Entry condition: The quantum key distribution (QKD) link is temporarily interrupted, and a new entropy source cannot be generated as planned.

[0252] 2) System Action: Automatically extend the maximum allowed usage time of the current valid seed and its associated State_ID (e.g., from the standard 24 hours to 72 hours). Encrypted communication is completely unaffected, and the system logs an alarm.

[0253] 3) System status: Maintain full-speed encryption capability, security is maintained but the time security margin is reduced.

[0254] 3. Backup Entropy Source Mode

[0255] 1) Entry condition: The interruption time of quantum key distribution (QKD) exceeds the set threshold of the "time tolerance mode".

[0256] 2) System Action: Switch to using the pre-shared standby entropy source chain. The enhanced seed management unit binds the next entropy source in the standby chain to State_ID_next and drives the state transition.

[0257] 3) System status: Continue to maintain full-speed encryption, but consume the pre-stored emergency entropy source reserve.

[0258] 4. Safe pause mode

[0259] 1) Entry conditions: The backup entropy source chain is exhausted, or the current seed usage has reached the preset limit safety boundary.

[0260] 2) System Action: The system actively stops initiating new encrypted communication sessions, but still retains the ability to receive and decrypt data packets from the other end, entering a security-prioritized silent state.

[0261] 3) System status: Transmission capability is suspended, only reception and decryption capability is retained, awaiting manual intervention or resumption by quantum key distribution (QKD).

[0262] Recovery mechanism:

[0263] 1) In any degraded mode, once the recovery of the quantum key distribution (QKD) link is detected, the seed update control unit will automatically re-trigger the complete entropy source update process. Figure 5 ).

[0264] 2) If the system is in "backup entropy source mode", the recovery process will prioritize replenishing the consumed backup entropy source location with a new quantum key distribution (QKD) entropy source to restore the emergency reserve.

[0265] 3) After recovery, the system smoothly transitions back to "normal mode" to achieve automatic healing.

[0266] The time thresholds for each of the above modes (e.g., extending from 24 hours to 72 hours) and the length of the backup entropy source chain (e.g., pre-storing 7 backup entropy sources) are system parameters that can be configured according to the security strategy and risk assessment of the specific deployment scenario. The values ​​given in this application are for illustrative purposes only and do not constitute a limitation of this application.

[0267] The beneficial effects of this application will be explained in detail below.

[0268] Enables remote automated key provisioning: Reduces the need for the virtual key system to rely on physical handover for initialization and long-term maintenance, facilitating remote deployment and long-term operation.

[0269] Alleviating the performance bottleneck of quantum key distribution (QKD): By adjusting its role, QKD is used as a background entropy source, which avoids the limitation of its key generation rate on the encryption rate, enabling it to support higher-speed data encryption services.

[0270] Enhanced forward security: A forward security guarantee based on physical destruction is provided through dynamic seed updates and proactive security erasure of old seeds.

[0271] Enhanced system robustness: The inherent hierarchical degradation and recovery strategy enables the system to maintain business continuity under different security levels when the quantum key distribution (QKD) link fails.

[0272] A complementary solution is formed: This solution combines the information-theoretic secure distribution capability of Quantum Key Distribution (QKD) with the high-performance encryption capability of a virtual keybook, providing a solution that combines information-theoretic security, high encryption performance, remote deployment capability, and a certain degree of robustness. The physical protocol of quantum key distribution (QKD), the key post-processing flow, and the encryption algorithms (such as HKDF, AES-CTR) and their working principles (such as state management, modular N partitioning) of the virtual keybook encryption and decryption subsystem involved in the method and system described in this application are all known technologies in the art. The improvement of this application lies not in these technical components themselves, but in their systematic integration in a specific way and the introduction of a new system architecture and interaction process.

[0273] The key points of this application will be explained in detail from different perspectives below.

[0274] 1. System Architecture Level: Role Adjustment and Entropy Source Supply Positioning in Quantum Key Distribution (QKD)

[0275] Key points described: This application adjusts the role of quantum key distribution (QKD) technology in the system. Unlike methods that directly use QKD as a cryptographic key source, this application positions it as a "secure entropy source supply infrastructure" that provides seeds to the virtual keybook cryptographic engine. Under this positioning, QKD is used to provide a low-frequency, small-quantity source (seed) of true random entropy to the virtual keybook cryptographic engine in an information-theory-secure manner.

[0276] Effect description:

[0277] Since quantum key distribution (QKD) only requires intermittent provision of a small number of seeds, its key generation rate no longer constitutes a constraint on the overall performance of the system, and can support higher data encryption rates.

[0278] The seeds required by the virtual key system can be remotely established and updated through the quantum key distribution (QKD) channel, reducing the need for initialization and long-term maintenance relying on physical handover.

[0279] The information-theoretic secure distribution capability of quantum key distribution (QKD) is combined with the encryption capability of the virtual keybook.

[0280] 2. Module Level: Enhanced Seed Management Unit

[0281] Key points described: This application establishes an enhanced seed management unit between the quantum key distribution (QKD) entropy source supply subsystem and the virtual key book encryption core. This unit has the following functions:

[0282] 1) Receive a fresh entropy source from the quantum key distribution (QKD) subsystem and bind and store the entropy source with a future communication state identifier;

[0283] 2) In response to the request from the virtual keybook encryption / decryption subsystem, return the entropy source bound to it as a seed based on the current communication status identifier carried in the request.

[0284] From a functional perspective, this unit can be described as a key material management device, configured to include:

[0285] 3) First logic unit: used to receive the first key material from an external security entropy source and associate the first key material with a first communication status identifier representing a future communication cycle;

[0286] 4) Second logical unit: used to respond to the request from the encryption core and return the second key material associated with it based on the second communication status identifier carried in the request.

[0287] Effect description:

[0288] 1) This unit separates the acquisition and use of entropy source in the architecture, so the encryption core does not need to care about the source of the seed, which provides the conditions for dynamic updating of the seed.

[0289] 2) This unit serves as a standardized interface between the two major subsystems, allowing both sides to evolve or be replaced relatively independently.

[0290] 3. Methodological Level: Seed Dynamic Update and State Switching Process

[0291] Key points: This application defines a seed dynamic update and state switching process driven by a seed update control unit. This process includes:

[0292] 1) Obtain the entropy source through the quantum key distribution (QKD) process;

[0293] 2) Bind the acquired entropy source to a future communication state identifier;

[0294] 3) When the predetermined conditions are met, the current state of the encryption system will be switched to the future communication state identifier;

[0295] 4) Use the bound entropy source as the seed for the new state for encryption.

[0296] In practice, the predetermined condition for state switching can be reaching a pre-agreed absolute time point, with an overlapping window set near that time point. Within this window, the receiver can process data packets from both the old and new states. After the state switch, the key material associated with the old state is erased.

[0297] Effect description:

[0298] 1) This process links the acquisition, binding, switching, and cleaning of seeds into an automated process, reducing the need for manual intervention.

[0299] 2) The design of overlapping windows helps reduce communication interruptions caused by clock skew.

[0300] 3) Erasing old state key material helps enhance forward security.

[0301] 4. Engineering Level: Layered Degradation and Recovery Strategies

[0302] Key points described: To address potential interruptions in the quantum key distribution (QKD) link, this application incorporates a tiered degradation and recovery strategy in the system control logic, including:

[0303] 1) When the quantum key distribution (QKD) link is temporarily interrupted, extend the effective usage period of the current seed;

[0304] 2) When the interruption time exceeds the threshold, switch to the pre-stored backup entropy source;

[0305] 3) When the backup entropy source is exhausted or the security boundary is reached, pause the initiation of new encrypted sessions, while retaining the ability to receive decryption;

[0306] 4) When the quantum key distribution (QKD) link is restored, the seed update process is automatically re-executed.

[0307] Effect description:

[0308] 1) This strategy provides a tiered response to QKD link anomalies, which helps to ensure the continuity of communication services while maintaining security.

[0309] 2) After the link is restored, the system can automatically return to normal working status, reducing the complexity of manual restoration.

[0310] Based on the above key points, the points to be protected in this application will be explained in detail.

[0311] First layer: System-level protection

[0312] Subject 1 (Method): A method for dynamically updating the seed for a virtual keybook system, the method using quantum key distribution (QKD) technology as a security entropy source to remotely provide and update the seed used for encryption by the virtual keybook system.

[0313] Subject 2 (System): A secure communication system comprising:

[0314] 1) Quantum Key Distribution (QKD) entropy source supply subsystem, used to generate and supply secure entropy sources;

[0315] 2) Virtual keybook encryption subsystem, used for seed-based data encryption;

[0316] 3) An enhanced seed management unit, connected between the two subsystems, is used to receive the entropy source and configure it as a seed that can be used by the encryption subsystem.

[0317] Second layer: Module-level protection

[0318] Enhanced Seed Management Unit: Protects a key material management device for a secure communication system, the configuration including:

[0319] (1) A first logic unit, used to receive a first key material from an external security entropy source and associate the first key material with a first communication status identifier representing a future communication cycle;

[0320] (2) The second logic unit is used to respond to the request of the encryption core and return the second key material associated with it based on the second communication status identifier carried in the request.

[0321] Subsystem Combination: Protects the system as described in the first layer, wherein the enhanced seed management unit is configured such that its entropy source receiving and binding function receives the output from the quantum key distribution (QKD) entropy source supply subsystem, and its seed-on-demand supply function provides seeds to the virtual keybook encryption subsystem.

[0322] Third layer: Process-level protection

[0323] Update process: Protect a method for dynamic seed update, including the following steps:

[0324] (1) Obtain the entropy source through the quantum key distribution (QKD) process;

[0325] (2) Bind and store the entropy source with a future communication state identifier;

[0326] (3) When the predetermined conditions are met, the current state of the encryption system is switched to the future communication state identifier;

[0327] (4) Encryption is performed using the bound entropy source as the seed for the new state.

[0328] Switching and fault tolerance: In the above method, the predetermined condition is reaching a pre-synchronized absolute time point; and within a preset overlapping window around that time point, the communication receiver is compatible with processing data packets with both old and new communication state identifiers.

[0329] Security cleanup: The above update method also includes the step of erasing the key material associated with the previous communication state identifier after a state switch.

[0330] Fourth layer: Robust protection

[0331] Degradation strategy: Protecting the operation of a secure communication system such that, when a quantum key distribution (QKD) link fails, the system performs at least one of the following operations:

[0332] (1) Extend the current seed shelf life;

[0333] (2) Switch to the backup entropy source;

[0334] (3) Pause the initiation of new encrypted sessions.

[0335] Recovery Procedure: A method to automatically re-execute the seed dynamic update procedure when the quantum key distribution (QKD) link recovers from a failure.

[0336] Protection Strategy Description

[0337] The protection points of this application revolve around four aspects: the positioning of "Quantum Key Distribution (QKD) as an entropy source supply infrastructure", the architectural design of "Enhanced Seed Management Unit", the method implementation of "Dynamic Update and Atomic Switching Process", and the engineering guarantee of "Hierarchical Degradation Strategy".

[0338] Thus, through the above implementation process, it has been verified that the dynamic seed update process of this solution is transparent to encrypted services and maintains the continuity of communication in real communication scenarios, thereby improving the transmission efficiency of business data.

[0339] It should be noted that the above-described method embodiments, or the various possible implementations of the method embodiments, can be executed individually, or, provided there is no conflict, they can be combined with each other. The specific implementation can be determined according to actual usage requirements, and this application embodiment does not impose any restrictions on this.

[0340] Figure 6 This is a schematic diagram of a communication encryption system based on quantum key distribution (QKD) provided in an embodiment of this application. Figure 6As shown, the communication encryption system 600 of the quantum key distribution (QKD) may include: a quantum key distribution (QKD) entropy source supply subsystem 601, an enhanced seed management unit 602, a virtual keybook encryption / decryption subsystem 603, and a seed update control unit 604.

[0341] The aforementioned quantum key distribution (QKD) entropy source supply subsystem 601 is used to generate a shared quantum entropy source between a first communication device and a second communication device at a first frequency through a quantum key distribution (QKD) channel, and transmit the shared quantum entropy source to the enhanced seed management unit after each shared quantum entropy source is generated.

[0342] For example, the aforementioned quantum key distribution (QKD) entropy source supply subsystem 601 can complete the quantum key distribution protocol through cooperation between quantum and classical channels, and after post-processing such as information reconciliation and privacy amplification, it finally outputs a high-quality, information-theoretic-secure shared entropy source.

[0343] The enhanced seed management unit 602 described above is used to receive the shared quantum entropy source, bind the shared quantum entropy source with a communication status identifier and store it, with each communication status identifier associated with a communication cycle.

[0344] For example, the enhanced seed management unit 602 described above is used to receive a secure entropy source R from the quantum key management unit, and uniquely bind and encrypt R with a predetermined time identifier representing a future communication cycle. In response to a request from the virtual keybook encryption / decryption subsystem 603, it queries and returns the entropy source correctly bound to it as a seed based on the current time identifier carried in the request.

[0345] The aforementioned virtual keybook encryption / decryption subsystem 603 is used to encrypt and decrypt service data at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle after each communication cycle is reached; the second frequency is higher than the first frequency.

[0346] For example, the virtual keybook encryption / decryption subsystem 603 can perform high-speed data encryption and decryption based on the seed, and can be applied to the relevant schemes in steps S1 to S6 above.

[0347] The seed update control unit 604 is used to update the current communication state identifier to the communication state identifier corresponding to the communication cycle after each communication cycle, and to start using the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle as a new seed.

[0348] For example, the seed update control unit 604 can determine and start a new round of entropy source acquisition process according to a preset strategy (such as timing, usage threshold), send a start command to the quantum key distribution (QKD) hardware; coordinate the timing of entropy source injection into the enhanced seed management unit, and at the appropriate time, instruct the virtual keybook encryption and decryption subsystem 603 to perform an atomic state switch, exchange lightweight synchronization signals with the peer node, and ensure that the update rhythm of both parties is consistent, which is applied to the relevant schemes of steps S7 to S10 above.

[0349] It should be noted that for a detailed explanation of the steps performed by each module and their beneficial effects, please refer to the description in the above embodiments, which will not be repeated here.

[0350] This application embodiment can divide the communication encryption device based on quantum key distribution (QKD) into functional modules according to the above method example. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0351] In some embodiments, this application also provides a communication encryption device based on quantum key distribution (QKD). This QKD-based communication encryption device may include one or more functional modules for implementing the QKD-based communication encryption method described in the above embodiments.

[0352] For example, Figure 12 This is a schematic diagram of a communication encryption device based on quantum key distribution (QKD) provided in an embodiment of this application. Figure 12 As shown, the above-mentioned communication encryption device based on quantum key distribution (QKD) is applied to the first communication device and includes: a generation module 1201, a binding module 1202, an update module 1203, and an encryption / decryption module 1204.

[0353] The generation module 1201 is used to generate a shared quantum entropy source between the first communication device and the second communication device at a first frequency through a quantum key distribution (QKD) channel.

[0354] The binding module 1202 is used to bind the shared quantum entropy source to a communication status identifier after each shared quantum entropy source is generated, with each communication status identifier associated with a communication cycle.

[0355] The update module 1203 is used to update the current communication status identifier to the communication status identifier corresponding to the above communication cycle after each communication cycle is reached.

[0356] The encryption / decryption module 1204 is used to encrypt and decrypt service data at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication period during the aforementioned communication cycle.

[0357] The second frequency is higher than the first frequency.

[0358] The aforementioned communication encryption device based on quantum key distribution (QKD) further includes: a processing module, configured to pre-set at least one absolute time point and set an overlapping window [TX, T+X] for each absolute time point; wherein each absolute time point is the start time of a communication cycle, T is an absolute time point, and X is less than the duration of the corresponding communication cycle; within the overlapping window corresponding to the aforementioned communication cycle, simultaneously receiving data packets obtained by encryption processing using the shared quantum entropy source corresponding to the communication state identifier before the update, and data packets obtained by encryption processing using the shared quantum entropy source corresponding to the updated communication state identifier, and performing decryption processing using the corresponding shared quantum entropy source.

[0359] The aforementioned processing module is further configured to: during a time period exceeding the aforementioned overlapping window but within the aforementioned communication cycle, receive only the data packets obtained by encryption using the shared quantum entropy source corresponding to the updated communication state identifier, and decrypt them using the shared quantum entropy source bound to the aforementioned updated communication state identifier.

[0360] During the aforementioned communication cycle, the header of the data packets sent by the first communication device contains an updated communication status identifier.

[0361] The aforementioned processing module is also used to: securely erase the shared quantum entropy source bound to the communication state identifier before the update after detecting an update to the current communication state identifier.

[0362] The aforementioned processing module is also configured to: when a quantum key distribution (QKD) channel failure is detected, perform at least one of the following operations: extend the effective usage time of the currently used shared quantum entropy source; use a pre-stored backup shared quantum entropy source; suspend the initiation of new encrypted communication sessions, and retain the decryption capability of the aforementioned first communication device using the shared quantum entropy source for decryption processing.

[0363] The aforementioned generation module 1201 is further configured to: upon detecting the recovery of the quantum key distribution (QKD) channel, continue to generate a shared quantum entropy source between the first communication device and the second communication device at a first frequency through the aforementioned QKD channel.

[0364] It should be noted that the communication encryption device based on quantum key distribution (QKD) can implement all the processes implemented in the above method embodiments and achieve the same beneficial effects. To avoid repetition, it will not be described again here.

[0365] In the case where the functions of the integrated modules described above are implemented in hardware, this application provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 13 As shown, the electronic device 130 includes: a processor 132, a communication interface 133, and a bus 134. Optionally, the electronic device 130 may also include a memory 131.

[0366] Processor 132 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 132 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 132 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0367] Communication interface 133 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0368] The memory 131 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0369] As one possible implementation, the memory 131 can exist independently of the processor 132. The memory 131 can be connected to the processor 132 via a bus 134 and is used to store instructions or program code. When the processor 132 calls and executes the instructions or program code stored in the memory 131, it can implement the communication encryption method based on quantum key distribution (QKD) provided in this application embodiment.

[0370] In another possible implementation, the memory 131 can also be integrated with the processor 132.

[0371] Bus 134 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 134 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 13 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0372] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0373] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described communication encryption method embodiment based on quantum key distribution (QKD) and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0374] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0375] This application also provides a readable storage medium storing a program or instructions. When executed by a computer, the program or instructions implement the communication encryption method based on quantum key distribution (QKD) provided in the above embodiments. It is understood that all or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The readable storage medium can be any of the foregoing embodiments or memory. The readable storage medium can also be an external storage device of the service invocation device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the service invocation device. Further, the readable storage medium can include both internal storage units of the service invocation device and external storage devices. The readable storage medium is used to store the computer program and other programs and data required by the service invocation device. The readable storage medium can also be used to temporarily store data that has been output or will be output.

[0376] This application also provides a computer program product, which is stored in a storage medium and, when executed by a computer, implements the communication encryption method based on quantum key distribution (QKD) provided in the above embodiments.

[0377] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a communication encryption method, apparatus, or system based on quantum key distribution (QKD) includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0378] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0379] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A communication encryption method based on quantum key distribution (QKD), characterized in that, The communication encryption method of the quantum key distribution (QKD), executed by the first communication device, includes: A shared quantum entropy source is generated between the first and second communication devices at a first frequency through a quantum key distribution (QKD) channel. After each shared quantum entropy source is generated, the shared quantum entropy source is bound to a communication status identifier, and each communication status identifier is associated with a communication cycle. After each communication cycle, the current communication status identifier is updated to the communication status identifier corresponding to the communication cycle. Within the communication cycle, the service data is encrypted and decrypted at a second frequency based on the shared quantum entropy source associated with the communication status identifier corresponding to the communication cycle. The second frequency is higher than the first frequency.

2. The communication encryption method based on quantum key distribution (QKD) according to claim 1, characterized in that, The communication encryption method of the quantum key distribution (QKD) also includes: At least one absolute time point is preset, and an overlapping window [TX, T+X] is set for each absolute time point; wherein, each absolute time point is the start time of a communication cycle, T is an absolute time point, and X is less than the duration of the corresponding communication cycle; Within the overlapping window corresponding to the communication cycle, data packets obtained by encrypting the data packets using the shared quantum entropy source corresponding to the communication state identifier before the update, and data packets obtained by encrypting the data packets using the shared quantum entropy source corresponding to the communication state identifier after the update, are simultaneously received and decrypted using the corresponding shared quantum entropy source.

3. The communication encryption method based on quantum key distribution (QKD) according to claim 1, characterized in that, The communication encryption method of the quantum key distribution (QKD) also includes: During the time period outside the overlapping window but within the communication cycle, only data packets encrypted using the shared quantum entropy source corresponding to the updated communication state identifier are received, and decryption is performed using the shared quantum entropy source bound to the updated communication state identifier.

4. The communication encryption method based on quantum key distribution (QKD) according to any one of claims 1 to 3, characterized in that, During the communication cycle, the header of the data packet sent by the first communication device contains an updated communication status identifier.

5. The communication encryption method based on quantum key distribution (QKD) according to claim 1, characterized in that, The communication encryption method of the quantum key distribution (QKD) also includes: Upon detecting an update to the current communication state identifier, securely erase the shared quantum entropy source bound to the communication state identifier prior to the update.

6. The communication encryption method based on quantum key distribution (QKD) according to claim 1, characterized in that, The communication encryption method of the quantum key distribution (QKD) also includes: When a quantum key distribution (QKD) channel failure is detected, perform at least one of the following operations: Extend the effective usage time of the currently used shared quantum entropy source; Use a pre-stored backup shared quantum entropy source; Suspend the initiation of new encrypted communication sessions, while retaining the decryption capability of the first communication device using the shared quantum entropy source for decryption processing.

7. The communication encryption method based on quantum key distribution (QKD) according to claim 6, characterized in that, The communication encryption method of the quantum key distribution (QKD) also includes: Upon detection of the recovery of the quantum key distribution (QKD) channel, a shared quantum entropy source continues to be generated between the first communication device and the second communication device at a first frequency through the QKD channel.

8. A communication encryption device based on quantum key distribution (QKD), characterized in that, The communication encryption device based on quantum key distribution (QKD) and applied to a first communication device includes: A generation module is used to generate a shared quantum entropy source between the first communication device and the second communication device at a first frequency through a quantum key distribution (QKD) channel. The binding module is used to bind the shared quantum entropy source to a communication status identifier after each shared quantum entropy source is generated, with each communication status identifier associated with a communication cycle; The update module is used to update the current communication status identifier to the communication status identifier corresponding to the communication cycle after each communication cycle is reached. An encryption / decryption module is used to encrypt and decrypt service data at a second frequency based on a shared quantum entropy source associated with the communication state identifier corresponding to the communication period during the communication cycle. The second frequency is higher than the first frequency.

9. A communication encryption system based on quantum key distribution (QKD), characterized in that, The communication encryption system of the quantum key distribution (QKD) includes: A quantum key distribution (QKD) entropy source supply subsystem is used to generate a shared quantum entropy source between a first communication device and a second communication device at a first frequency through a quantum key distribution (QKD) channel, and transmit the shared quantum entropy source to an enhanced seed management unit after each shared quantum entropy source is generated. The enhanced seed management unit is used to receive the shared quantum entropy source, bind the shared quantum entropy source with a communication status identifier and store it, with each communication status identifier associated with a communication cycle; The virtual keybook encryption / decryption subsystem is used to encrypt and decrypt business data at a second frequency based on the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle after each communication cycle is reached; the second frequency is higher than the first frequency. The seed update control unit is used to update the current communication state identifier to the communication state identifier corresponding to the communication cycle after each communication cycle, and to start using the shared quantum entropy source associated with the communication state identifier corresponding to the communication cycle as a new seed.

10. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the communication encryption method based on quantum key distribution (QKD) as described in any one of claims 1-7.

11. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions, which, when executed by a computer, implement the communication encryption method based on quantum key distribution (QKD) as described in any one of claims 1-7.

12. A computer program product, characterized in that, The computer program product is stored in a storage medium, and when executed by a computer, the computer program product implements the communication encryption method based on quantum key distribution (QKD) as described in any one of claims 1-7.

Images