CN108270553B

CN108270553B - Trusted repeater, and secret key encryption method, device and system of quantum communication network

Info

Publication number: CN108270553B
Application number: CN201611255339.1A
Authority: CN
Inventors: 王学富; 武宏宇
Original assignee: Shandong Institute Of Quantum Science And Technology Co ltd; Quantumctek Co Ltd
Current assignee: Shandong Institute Of Quantum Science And Technology Co ltd; Quantumctek Co Ltd
Priority date: 2016-12-30
Filing date: 2016-12-30
Publication date: 2020-12-22
Anticipated expiration: 2036-12-30
Also published as: CN108270553A

Abstract

The invention discloses a key encryption method, a device and a system for a trusted repeater and a quantum communication network, wherein the key encryption method for the trusted repeater comprises the following steps: after receiving a first relay key sent by a previous node, a trusted relay decrypts the first relay key through an encrypted relay decryption key to obtain an encrypted relay key; the encrypted relay decryption key is generated by encrypting the relay decryption key by using a preset key encryption key; when the trusted repeater sends the encrypted relay key to the next node, the encrypted relay key is encrypted by using the encrypted relay encryption key to obtain a second relay key; the encrypted relay encryption key is generated by encrypting the relay encryption key by using a preset key encryption key. The invention has wide application range, has little influence on the application range of the credible repeater, and enhances the safety of the credible repeater under the condition of ensuring the expansibility of the original network.

Description

Trusted repeater, and secret key encryption method, device and system of quantum communication network

Technical Field

The invention relates to the technical field of quantum communication, in particular to a secret key encryption method and device of a trusted repeater and a secret key encryption method and system of a quantum communication network.

Background

In a quantum communication network, due to the limitations of channel deployment cost and distance, the construction of quantum channels between any nodes in the network and direct Quantum Key Distribution (QKD) cannot be realized. Therefore, in order to realize that the quantum key can be shared between any nodes in the network, a key relay method needs to be adopted to realize key distribution between two nodes which cannot directly perform quantum key distribution.

The key relay mode is firstly proposed by Elliott of BBN, and the basic idea is to encrypt and decrypt a relay key by using a quantum key shared between adjacent nodes, so as to realize encryption and transfer of the relay key among one or more relay nodes, and finally achieve a target user.

It is worth noting that since the relay key exists in the relay node in the clear, any node participating in the key relay knows the content of this secret communication (i.e. the relay key), i.e. its security is relative, provided that all relay nodes have to be trusted. Such a node is therefore called a Trusted Relay (Trusted Relay) node. On a key relay link, nodes at two ends of the link are called quantum terminal nodes (or quantum terminals for short), namely, nodes where target users of key relay are located; nodes in the middle of the link are called trusted relay nodes (or trusted relays), and are referred to as quantum terminal nodes. The key relay link comprises two quantum terminal nodes and at least one credible relay node, and each node is provided with QKD equipment; a quantum channel is built between adjacent nodes, and quantum keys can be directly distributed, so that the quantum keys are shared. The trusted repeater is a very natural and easily-realized technology, and by means of the trusted repeater, a quantum key distribution network can be easily expanded, and the range and the number of users can be infinite. Moreover, the QKD network based on the trusted repeater can be well compatible with various QKD technologies, and both an optical fiber quantum key distribution system and a free space quantum key distribution system, and a phase coding system and a polarization coding system can be conveniently integrated, so that the method is a preferred scheme for building the network at the present stage. But has the disadvantage of increasing the cost of security management since the security of the trusted repeater must be guaranteed.

At present, the flow of quantum key relay is shown in fig. 1, in this example, it is assumed that only one trusted repeater B is passed when communication is performed between a sending quantum terminal a and a receiving quantum terminal C; the sending quantum terminal A and the credible relay B share a quantum key through a QKD process, and the shared quantum key is used as a sending encryption key K at the sending quantum terminal A_ABAt trusted repeater B as a relay decryption key K_BA(ii) a The trusted relay B and the receiving quantum terminal C share a quantum key through a QKD process, and the shared quantum key is used as a relay encryption key K at the trusted relay B_BCAt the receiving quantum terminal C as a receiving decryption key K_CB. The specific flow of key relaying is as follows:

step 1, sending quantum terminal A to be sentRelay key K_RUsing a transmit encryption key K_ABObtaining a first relay secret key K after encryption_R⊕K_ABThen the first relay key K is used_R⊕K_ABSending to a trusted repeater B;

step 2, the trusted repeater B receives the first relay key K_R⊕K_ABThen, the relay decryption key K is used_BAPerform decryption (K)_R⊕K_AB⊕K_BA=K_R) Later obtain relay key K_R；

Step 3, the credible repeater B reuses the relay encryption key K_BCFor the relay key K obtained in step 2_RObtaining a second relay key K after encryption_R⊕K_BCAnd the second relay key K is used for_R⊕K_BCSending the data to a receiving quantum terminal C;

step 4, the receiving quantum terminal C receives the second relay key K_R⊕K_BCThereafter, using the received decryption key K_CBPerform decryption (K)_R⊕K_BC⊕K_CB=K_R) To obtain a relay key K_R。

The trusted repeater B may be provided with a key cache module, and a plurality of relay decryption keys, such as K, may be stored in the key cache module_BAAnd a plurality of relay encryption keys such as K_BC. The sending quantum terminal A can also be provided with a key cache module, and a plurality of sending encryption keys such as K can be stored in the key cache module_AB. The receiving quantum terminal C may also be provided with a key cache module, and the key cache module may store a plurality of receiving decryption keys, such as K_CB。

In this example, there is only one trusted repeater on the key relay link, and it can be understood by those skilled in the art that when there are n (n is a positive integer, n ≧ 1) trusted repeaters, each trusted repeater needs to perform a similar procedure as described above, that is, the encrypted relay key is relayed by using a quantum key shared with an adjacent quantum terminal or an adjacent trusted repeater.

However, the above method has the following safety defects:

in step 2, the trusted repeater B receives the first relay key K_R⊕K_ABThen, the relay decryption key K is used first_BADecrypting to obtain the relay key K_R(ii) a And in step 3 the relay key K_RRelaying the secret key K before performing the second encryption_RIs stored in clear text, thus causing the leaked relay key K to exist in the trusted relay_RThe potential safety hazard of (2).

Furthermore, the above example only describes the key relay process of the key management layer, which may be understood as a horizontal key relay process, and the key management at each node may be understood as a vertical key relay process. As shown in fig. 2, the whole quantum communication network can be divided into a key generation layer, a key management layer, and an application layer. The key generation layer performs quantum key distribution through QKD equipment deployed at each node and sends the generated quantum key to the key management layer; each node of the key management layer receives the quantum key sent by the key generation layer, uses the quantum key to realize the encryption transfer of the relay key, realizes the sharing of the relay key between quantum terminals, and sends the relay key to the application layer; and the application equipment in the application layer receives the relay key sent by the corresponding quantum terminal and uses the relay key to carry out high-security secret communication. The relay key may be a quantum key or may be generated by a true random number generator. Due to the characteristics of the quantum key distribution system, a large number of quantum keys need to be stored in a quantum terminal and a trusted repeater in a key management layer, and how to ensure the security of the part of keys and the security of the storage and longitudinal transmission of the relay keys are important problems to be solved in the field.

Disclosure of Invention

Aiming at the security defect existing when the relay key is forwarded by the trusted repeater in the quantum communication network, the invention provides the trusted repeater, and the key encryption method, device and system of the quantum communication network, which can eliminate the security defect of the relay key plaintext falling to the ground at the trusted repeater.

In order to achieve the above object, the present invention provides a key encryption method for a trusted repeater, including:

step 101, after receiving a first relay key sent by a previous node, a trusted relay decrypts the first relay key through an encrypted relay decryption key to obtain an encrypted relay key; the encrypted relay decryption key is generated by encrypting a relay decryption key by using a preset key encryption key, and the first relay key is generated by encrypting the relay key by using a sending encryption key corresponding to the relay decryption key by the previous node;

step 102, when the trusted relay sends the encrypted relay key to the next node, encrypting the encrypted relay key by using the encrypted relay encryption key to obtain a second relay key; the encrypted relay encryption key is generated by encrypting a relay encryption key by using the preset key encryption key, and the relay encryption key corresponds to a receiving decryption key at the next node.

Preferably, the sending encryption key and the relay decryption key are shared quantum keys generated through a QKD process, and are in one-to-one correspondence; the relay encryption key and the receiving decryption key are shared quantum keys generated through a QKD process, and the relay encryption key and the receiving decryption key correspond to each other one by one.

Preferably, the key encryption key is pre-stored in a hardware chip of the trusted repeater for updating, encrypting and decrypting operations, and the key encryption key in the chip cannot be derived.

Preferably, the key encryption key is periodically updated by a quantum key.

Meanwhile, the embodiment of the invention also provides a key encryption device of the trusted repeater, which comprises the following steps:

the key encryption module is used for storing a preset key encryption key and encrypting the relay decryption key through the preset key encryption key to obtain an encrypted relay decryption key; the relay encryption key is further used for encrypting the relay encryption key through the preset key encryption key to obtain an encrypted relay encryption key;

the key relay forwarding module is used for decrypting the first relay key through the encrypted relay decryption key after receiving the first relay key from the previous node so as to obtain an encrypted relay key; the first relay key is generated after the previous node encrypts a relay key by using a sending encryption key corresponding to the relay decryption key; the relay node is further configured to encrypt the encrypted relay key using the encrypted relay encryption key to obtain a second relay key when the encrypted relay key is sent to a next node; wherein the relay encryption key corresponds to a receive decryption key at the next node;

and the key cache module is used for storing the encrypted relay decryption key and the encrypted relay encryption key.

Preferably, the key encryption module is a hardware chip, and a key encryption key in the chip cannot be derived.

Preferably, the key encryption module is further configured to receive a quantum key, and periodically update the key encryption key through the quantum key.

Meanwhile, the embodiment of the invention also provides a secret key encryption method of the quantum communication network, which comprises the following steps:

step 701, the sending quantum terminal encrypts the relay key to be sent by using a sending encryption key to obtain a first relay key, and then sends the first relay key to the next node; wherein the transmit encryption key corresponds to a relay decryption key at the next node;

step 702, after receiving a first relay key sent by a previous node, a trusted relay decrypts the first relay key through an encrypted relay decryption key to obtain an encrypted relay key; the encrypted relay decryption key is generated by encrypting the relay decryption key by using a preset key encryption key;

step 703, when the trusted relay sends the encrypted relay key to the next node, encrypting the encrypted relay key by using the encrypted relay encryption key to obtain a second relay key; the encrypted relay encryption key is generated after the relay encryption key is encrypted by using the preset key encryption key, and the relay encryption key corresponds to a receiving decryption key at the next node;

step 704, after receiving the second relay key sent by the previous node, the receiving quantum terminal decrypts the second relay key by using the receiving decryption key to obtain the relay key;

when a transmitting quantum terminal in the quantum communication network transmits a relay key to be transmitted to a receiving quantum terminal, the relay key passes through one or more trusted repeaters, and when the relay key passes through a plurality of trusted repeaters, each trusted repeater performs step 702 and step 703.

Further, a sending key encryption key is preset at the sending quantum terminal to encrypt the sending encryption key so as to generate an encrypted sending encryption key; a receiving key encryption key is preset at the receiving quantum terminal to encrypt the receiving decryption key so as to generate an encrypted receiving decryption key;

the method specifically comprises the following steps:

step 801, a sending quantum terminal encrypts a sending encryption key and a relay key respectively by using a preset sending key encryption key to generate an encrypted sending encryption key and an encrypted relay key respectively;

step 802, the sending quantum terminal encrypts the encrypted relay key to be sent by using the encrypted sending encryption key to obtain a first relay key, and then sends the first relay key to the next node; wherein the transmit encryption key corresponds to a relay decryption key at the next node;

step 803, after receiving the first relay key sent by the previous node, the trusted relay decrypts the first relay key by using the encrypted relay decryption key to obtain an encrypted relay key; the encrypted relay decryption key is generated by encrypting the relay decryption key by using a preset key encryption key;

step 804, when the trusted relay sends the encrypted relay key to the next node, the encrypted relay key is encrypted by using the encrypted relay encryption key to obtain a second relay key, and then the second relay key is sent to the next node; the encrypted relay encryption key is generated after the relay encryption key is encrypted by using the preset key encryption key, and the relay encryption key corresponds to a receiving decryption key at the next node;

step 805, after receiving the second relay key sent by the previous node, the receiving quantum terminal decrypts the second relay key by using the encrypted receiving decryption key to obtain an encrypted relay key; and the encrypted receiving decryption key is generated by encrypting the receiving decryption key by the receiving quantum terminal by using a preset receiving key encryption key.

Preferably, the key encryption key is pre-stored in a hardware chip for updating, encrypting and decrypting operations, and the key encryption key in the chip cannot be derived.

Preferably, the key encryption key is periodically updated by a quantum key.

Meanwhile, the invention also provides a security enhancement method of the quantum key management layer, so as to realize the processing of the key management layer without a plaintext key and enhance the security of the whole key management system. The whole quantum communication network can be divided into a key generation layer, a key management layer and an application layer.

The working flow of the quantum terminal is as follows:

step 1701, presetting a sending key encryption key for encrypting the sending encryption key on a key generation device of the sending quantum terminal, and then synchronizing the sending key encryption key to an application device of the sending quantum terminal by the key generation device;

1702, after quantum key distribution is performed between a key generation device of the sending quantum terminal and a key generation device of a next node to generate a sending encryption key of the sending quantum terminal, encrypting the sending encryption key by using the sending encryption key to obtain an encrypted sending encryption key; transmitting the encrypted sending encryption key to a key management device of a sending quantum terminal for storage, so that when the sending quantum terminal sends an encrypted relay key to a device of a next node, the encrypted relay key is encrypted by using the encrypted sending encryption key to obtain the first relay key;

step 1703, the key management device of the sending quantum terminal sends the encrypted relay key to the application device of the sending quantum terminal; before using a service key, an application device of a sending quantum terminal decrypts the encrypted key by using the sending key to obtain a relay key, and then uses the relay key as the service key;

and the sending quantum terminal synchronizes and updates the sending key encryption key through the mobile storage equipment.

The working flow of the quantum receiving terminal is as follows:

step 1801, presetting a receiving key encryption key for encrypting a receiving decryption key on a key generation device of the receiving quantum terminal, and then synchronizing the receiving key encryption key to an application device of the receiving quantum terminal by the key generation device;

step 1802, after quantum key distribution is performed on a key generation device of a receiving quantum terminal and a key generation device of a previous node to generate a receiving decryption key of the receiving quantum terminal, encrypting the receiving decryption key by using the receiving key encryption key to obtain an encrypted receiving decryption key; transmitting the encrypted receiving decryption key to a key management device of a receiving quantum terminal for storage, so that when the receiving quantum terminal receives the second relay key sent by the previous node device, the second relay key is decrypted by using the encrypted receiving decryption key to obtain an encrypted relay key;

step 1803, the key management device of the receiving quantum terminal sends the encrypted relay key to the application device of the receiving quantum terminal; before using a service key, an application device of a receiving quantum terminal decrypts the encrypted key by using the receiving key to obtain a relay key, and then uses the relay key as the service key;

and the receiving quantum terminal synchronizes and updates the receiving key encryption key through the mobile storage equipment.

Meanwhile, the embodiment of the invention also provides a secret key encryption system of the quantum communication network, which comprises at least one sending quantum terminal, at least one receiving quantum terminal and at least one credible repeater;

the sending quantum terminal is used for encrypting the relay key to be sent by using the sending encryption key to obtain a first relay key and then sending the first relay key to the next node; wherein the transmit encryption key corresponds to a relay decryption key at the next node;

each trusted repeater includes:

the key relay forwarding module is used for decrypting the first relay key through the encrypted relay decryption key after receiving the first relay key from the previous node so as to obtain an encrypted relay key; the relay node is further configured to encrypt the encrypted relay key using the encrypted relay encryption key to obtain a second relay key when the encrypted relay key is sent to a next node; wherein the relay encryption key corresponds to a receive decryption key at the next node;

a key cache module for storing the encrypted relay decryption key and the encrypted relay encryption key;

and the receiving quantum terminal is used for decrypting by using the receiving decryption key after receiving the second relay key sent by the previous node to obtain the relay key.

Further, a sending key encryption key is preset at the sending quantum terminal to encrypt the sending encryption key so as to generate an encrypted sending encryption key; a receiving key encryption key is preset at the receiving quantum terminal to encrypt the receiving decryption key so as to generate an encrypted receiving decryption key; the system specifically comprises;

the transmitting quantum terminal is used for encrypting the transmitting encryption key and the relay key respectively by using a preset transmitting key encryption key so as to generate an encrypted transmitting encryption key and an encrypted relay key respectively; the relay node is further configured to encrypt the encrypted relay key to be sent by using the encrypted sending encryption key to obtain a first relay key, and then send the first relay key to a next node; wherein the transmit encryption key corresponds to a relay decryption key at the next node;

wherein each of the trusted repeaters comprises:

the receiving quantum terminal is used for encrypting the receiving decryption key by using a preset receiving key encryption key so as to generate an encrypted receiving decryption key; and the relay node is further configured to decrypt, after receiving the second relay key sent by the previous node, by using the encrypted reception decryption key, to obtain an encrypted relay key.

The technical scheme provided by the invention has the beneficial effects that:

a. the application range is wide, the realization scheme has little influence on the application range of the credible repeater, the safety of the credible repeater is enhanced under the condition of ensuring the expansibility of the original network, and the realization scheme is suitable for building various relay networks;

b. the safety of the relay key is enhanced, the falling of the plaintext of the relay key is avoided in the key relay process, the risk of relay key leakage is reduced, and the safety of the key relay process is ensured;

c. the security of the quantum key is enhanced, and the quantum key in the key cache module of the key management layer is encrypted and stored by using the key encryption key, so that the security of the quantum key is enhanced;

d. the method and the system have the advantages that the flows are consistent, the realization is convenient, the scheme can be suitable for all the nodes, the consistency of the flows of all the nodes is ensured, the realization is simple, and the maintenance is convenient.

Drawings

FIG. 1 is a schematic diagram of a key relay process in the prior art;

FIG. 2 is a schematic diagram of a prior art quantum communication network;

FIG. 3 is a schematic diagram of a workflow of an embodiment of the present invention when a trusted repeater is used;

FIG. 4 is a schematic diagram of a workflow when multiple trusted repeaters are employed in an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a trusted repeater according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of a workflow of full-node security enhancement according to an embodiment of the present invention;

fig. 7 is a schematic diagram of a workflow of security enhancement at a trusted relay node and a sending node (sending quantum terminal) in an embodiment of the present invention;

fig. 8 is a schematic view of a workflow of security enhancement at a trusted relay node and a receiving node (receiving quantum terminal) in an embodiment of the present invention;

FIG. 9 is a key relay diagram of a star network with enhanced security of trusted repeaters in an embodiment of the present invention;

fig. 10 is a schematic key relay diagram of a star network with enhanced full-node security in an embodiment of the present invention;

FIG. 11 is a key relay diagram for central distribution in an embodiment of the invention;

FIG. 12 is a key relay diagram of a multi-node shared key according to an embodiment of the present invention;

FIG. 13 is a diagram illustrating a system for enhancing security of a key management layer according to an embodiment of the present invention;

the related symbols in the whole text explain:

K_R: a relay key;

K_AB: sending an encryption key;

K_R⊕K_AB: a first relay key;

K_BA: relayDecrypting the key;

K_BC: a relay encryption key;

K_R⊕K_BC: a second relay key;

K_CB: receiving a decryption key;

K_B: a preset key encryption key;

K_R⊕K_A: an encrypted relay key;

K_R⊕K_B: an encrypted relay key;

K_R⊕K_C: an encrypted relay key;

K_BA⊕K_B: an encrypted relay decryption key;

K_BC⊕K_B: an encrypted relay encryption key;

K_A: a preset sending key encryption key;

K_AB⊕K_A: an encrypted transmit encryption key;

K_C: a preset receiving key encryption key;

K_CB⊕K_C: the encrypted receive decryption key.

Detailed Description

The key point of the technical scheme of the invention is that a key encryption key is preset at the trusted repeater and used for encrypting the key stored in the key cache module, so that the key stored in the key cache module is the encrypted key. Therefore, after the trusted repeater receives the encrypted relay key, the relay key cannot be stored in a plaintext form between two processes of decryption and re-encryption, and the safety of the quantum communication network is improved. In a preferred embodiment of the present invention, a key encryption key for encrypting the relay key may be input to a hardware chip for updating, encrypting, and decrypting operations by a preset method, so as to ensure the security of the key encryption key. Meanwhile, the key encryption key can be updated regularly according to needs, so that the freshness and the safety of the key are further enhanced. Preferably, the key encryption key is periodically updated by the quantum key.

The security enhancement method of the invention can also be used for security enhancement of all nodes on the relay process (or relay link), is not limited to a trusted relay, and is also suitable for a relay initiating node and a relay destination node. The security enhancement method can be used for key relay of a linear network structure and key relay of a star network structure, and after the security enhancement scheme is used, the key relay process is basically consistent with the original process, and the implementation of the key relay process of the star network structure cannot be influenced.

The security enhancement method can also be used for a key relay process of distributing relay keys from the trusted relay nodes to the quantum terminal nodes at two ends, can be suitable for a full-node security enhancement network, and can also be suitable for a network only with the security enhancement of the trusted relay. The same applies to key distribution of multi-node shared keys.

The security enhancement method is also suitable for security enhancement of the key management layer, realizes no-plaintext key processing of the key management layer, and enhances the security of the whole key management system.

As an example, in the embodiment of the present invention, an exclusive or algorithm is used as an encryption and decryption algorithm, which specifically includes: 0 ≦ 0=0, 1 ≦ 0=1, 0 ≦ 1=1, 1 ≦ 1= 0.

The following detailed description of the embodiments of the present invention is provided with reference to the accompanying drawings, so that how to apply the technical means to solve the technical problems and achieve the technical effects can be fully understood and implemented.

Example 1

The embodiment of the invention provides a secret key encryption method of a trusted repeater. In order to make the whole process clearer, fig. 3 and 4 are schematic diagrams of the trusted repeater applied to a quantum communication network. FIGS. 3 and 4 show the application of the above scheme to one trusted repeater and the application of the above scheme to a plurality of trusted repeaters (n is a positive integer in FIG. 4, n ≧ 2), respectively. As can be seen from fig. 3 and 4, compared with the prior art, a preset key encryption key is added to each trusted repeater for encrypting the key stored in the key cache module. Since the workflow of each trusted repeater is the same, the specific steps shown in fig. 3 are:

step 101, the trusted relay B receives a first relay key K sent by a previous node_R⊕K_ABThereafter, the key K is decrypted by the encrypted relay_BA⊕K_BFor the first relay key K_R⊕K_ABDecrypting to obtain an encrypted relay key K_R⊕K_B(ii) a Wherein the encrypted relay decryption key K_BA⊕K_BIs to encrypt a secret key K by using a preset secret key_BDecrypting the key K for the relay_BAGenerated after encryption, the first relay key K_R⊕K_ABThe last node utilizes the relay decryption key K_BACorresponding transmission encryption key K_ABFor relay key K_RGenerated after encryption, the encrypted relay key K_R⊕K_BObtained by the following formula: k_R⊕K_AB⊕K_BA⊕K_B=K_R⊕K_B；

102, the trusted relay B sends the encrypted relay key K to the next node_R⊕K_BThen, the encrypted relay encryption key K is reused_BC⊕K_BFor the encrypted relay key K_R⊕K_BEncrypting to obtain a second relay key K_R⊕K_BC(ii) a Wherein the encrypted relay encryption key K_BC⊕K_BIs to encrypt a secret key K by using the preset secret key_BEncrypting the key K to the relay_BCGenerated after encryption, the relay encryption key K_BCWith a receive decryption key K at the next node_CBCorrespondingly, the second relay key K_R⊕K_BCObtained by the following formula: k_R⊕K_B⊕K_BC⊕K_B=K_R⊕K_BC。

Specifically, in step 101 and step 102, the key K may be encrypted by using a preset key_BDecrypting the Relay Key K in the Key cache Module of trusted repeater B_BAAnd a relay encryption key K_BCRespectively pre-encrypted to obtain the encrypted relay decryption key K in the above example_BA⊕K_BAnd encrypted relay encryption key K_BC⊕K_B. Preferably, the sending encryption key K_ABWith said relay decryption key K_BAThe method comprises the steps of generating a shared quantum key through a QKD process, wherein the shared quantum key and the quantum key are in one-to-one correspondence; the relay encryption key K_BCAnd the receiving decryption key K_CBAre shared quantum keys generated by the QKD process, one-to-one correspondence. Of course, those skilled in the art will understand that the sending encryption key K in the embodiment of the present invention_ABAnd relay decryption key K_BARelay encryption key K_BCAnd receiving a decryption key K_CBCan be obtained in any way, and the embodiment of the invention does not limit the invention.

Preferably, the key encrypts a key K_BPre-stored in the hardware chip of the trusted repeater B for updating, encrypting and decrypting operations, and the key in said chip encrypts the key K_BCannot be derived to ensure that the key encrypts the key K_BThe safety of (2). At the same time, the key encrypts a key K_BAnd the key can be updated regularly as required, so that the freshness and the safety of the key are further enhanced. Preferably, the key K may be encrypted by a quantum key_BPeriodic updates are performed. For quantum communication networks with multiple trusted repeaters, a different key encryption key may be set for each trusted repeater.

Specifically, as shown in fig. 3, there is only one trusted relay, so the last node in the foregoing method must be the sending relay key K_RAnd the next node is necessarily the receiving relay key K_RReceiving quantum terminal C. For multiple trusted repeaters as shown in fig. 4, the last node in the foregoing method may be to send the relay key K_RThe sending quantum terminal a of (2) may also be another trusted repeater; and the next node may be the receiving relay key K_RMay also be a further trusted repeater.

It should be noted that, as can be understood by those skilled in the art, the sending encryption key and the relay encryption key, and the relay decryption key and the receiving decryption key in the embodiment of the present invention are all relative concepts, and are all encryption keys and decryption keys participating in the encryption and the transfer of the relay key, and there is no substantial difference. When the last node of the credible repeater is a sending quantum terminal, the sending encryption key at the last node corresponds to the relay decryption key at the credible repeater; and when the last node of the trusted repeater is another trusted repeater, the relay encryption key at the last node corresponds to the relay decryption key at the trusted repeater. Similarly, when the next node of the trusted repeater is a receiving quantum terminal, the relay encryption key at the trusted repeater corresponds to the receiving decryption key at the next node; when the next node of the trusted repeater is another trusted repeater, the relay encryption key at the trusted repeater corresponds to the relay decryption key at the next node. Of course, those skilled in the art can also understand that the first relay key and the second relay key in the embodiment of the present invention are also relative concepts, and are encrypted relay keys generated according to encryption keys participating in relay key encryption relay, and there is no substantial difference.

Thus, the first relay key K is received at the trusted relay B_R⊕K_ABThereafter, the key K is decrypted using the encrypted relay_BA⊕K_BWhen decryption is carried out, the encrypted relay key K can be directly obtained_R⊕K_BRather than the relay key K in the clear_R. So that the trusted repeater B does not store the clear relay key K before subsequent encryption is performed_RAnd the safety of the whole system is improved. While the change is to all other nodesIs transparent and therefore does not require changes to the existing system topology.

In the above embodiment, as shown in fig. 3, the entire transmission flow passes through only one trusted repeater (i.e., the trusted repeater B). As shown in fig. 4, the whole transmission flow passes through a plurality of trusted repeaters (e.g. trusted repeater B shown in fig. 4)_1……Trusted repeater B_n) Thus, in the method shown in fig. 4, each trusted repeater B needs to perform a method similar to steps 101 and 102.

Example 2

Meanwhile, an embodiment of the present invention further provides a key encryption device of a trusted repeater corresponding to embodiment 1, where the structure of the key encryption device is shown in fig. 5, and the key encryption device includes a key encryption module, a key relay forwarding module, and a key caching module;

a key encryption module for storing a preset key encryption key K_BAnd encrypting the secret key K by a preset secret key_BDecrypting the key K for the relay_BAEncryption to obtain an encrypted relay decryption key K_BA⊕K_B(ii) a And also for encrypting a secret key K by means of said preset secret key_BEncrypting the key K to the relay_BCEncrypting to obtain an encrypted relay encryption key K_BC⊕K_B；

A key relay forwarding module for receiving a first relay key K from a previous node_R⊕K_ABThereafter, the key K is decrypted by said encrypted relay_BA⊕K_BFor the first relay key K_R⊕K_ABDecrypting to obtain an encrypted relay key K_R⊕K_B(ii) a Wherein the first relay key K_R⊕K_ABThe last node utilizes the relay decryption key K_BACorresponding transmission encryption key K_ABFor relay key K_RGenerated after encryption, the encrypted relay key K_R⊕K_BObtained by the following formula: k_R⊕K_AB⊕K_BA⊕K_B=K_R⊕K_B(ii) a Also for the nextThe node sends the encrypted relay key K_R⊕K_BThen, the encrypted relay encryption key K is reused_BC⊕K_BFor the encrypted relay key K_R⊕K_BEncrypting to obtain a second relay key K_R⊕K_BC(ii) a Wherein the relay encryption key K_BCWith a receive decryption key K at the next node_CBCorrespondingly, the second relay key K_R⊕K_BCObtained by the following formula: k_R⊕K_B⊕K_BC⊕K_B=K_R⊕K_BC；

A key cache module for storing the encrypted relay decryption key K_BA⊕K_BAnd encrypted relay encryption key K_BC⊕K_B。

Preferably, the sending encryption key K_ABWith said relay decryption key K_BAThe method comprises the steps of generating a shared quantum key through a QKD process, wherein the shared quantum key and the quantum key are in one-to-one correspondence; the relay encryption key K_BCAnd the receiving decryption key K_CBAre shared quantum keys generated by the QKD process, one-to-one correspondence.

Preferably, the key encryption module is a hardware chip, and a key encryption key K in the chip_BCannot be derived to ensure that the key encrypts the key K_BThe safety of (2). At the same time, the key encrypts a key K_BAnd the key can be updated regularly as required, so that the freshness and the safety of the key are further enhanced. Preferably, the key encryption module is further configured to receive a quantum key and encrypt the key K with the quantum key_BPeriodic updates are performed.

Example 3

Meanwhile, the embodiment of the invention also provides a secret key encryption method for the quantum communication network, which comprises one or more trusted repeaters as shown in fig. 3 and fig. 4. Compared with the prior art, each trusted repeater is added with a preset key encryption key for encrypting the relay encryption key and the relay decryption key. Since the workflow of each trusted repeater is the same, the method shown in fig. 3 is specifically as follows:

step 701, sending a relay key K to be sent by the quantum terminal A_RUsing a transmit encryption key K_ABObtaining a first relay secret key K after encryption_R⊕K_ABThen the first relay key K is used_R⊕K_ABSending to the next node; wherein the sending encryption key K_ABRelay decryption key K with the next node_BACorresponding;

step 702, the trusted relay B receives the first relay key K sent by the previous node_R⊕K_ABThereafter, the key K is decrypted by the encrypted relay_BA⊕K_BFor the first relay key K_R⊕K_ABDecrypting to obtain an encrypted relay key K_R⊕K_B(ii) a Wherein the encrypted relay decryption key K_BA⊕K_BIs to encrypt a secret key K by using a preset secret key_BDecrypting the key K for the relay_BAGenerated after encryption, the encrypted relay key K_R⊕K_BObtained by the following formula: k_R⊕K_AB⊕K_BA⊕K_B=K_R⊕K_B；

Step 703, the trusted relay B sends the encrypted relay key K to the next node_R⊕K_BThen, the encrypted relay encryption key K is reused_BC⊕K_BFor the encrypted relay key K_R⊕K_BEncrypting to obtain a second relay key K_R⊕K_BCThen the second relay key K is used_R⊕K_BCSending to the next node; wherein the encrypted relay encryption key K_BC⊕K_BIs to encrypt a secret key K by using the preset secret key_BEncrypting the key K to the relay_BCGenerated after encryption, the relay encryption key K_BCWith a receive decryption key K at the next node_CBCorrespondingly, the second relay key K_R⊕K_BCObtained by the following formula: k_R⊕K_B⊕K_BC⊕K_B=K_R⊕K_BC；

Step 704, the receiving quantum terminal C receives the second relay key K sent by the previous node_R⊕K_BCThereafter, using said received decryption key K_CBPerform decryption (K)_R⊕K_BC⊕K_CB=K_R) Obtaining the relay key K_R。

In the above method, if there are a plurality of trusted repeaters, each trusted repeater needs to perform a method similar to steps 702 and 703. Specifically, as shown in fig. 3, there is only one trusted relay, so the last node in the foregoing method must be the sending relay key K_RAnd the next node is necessarily the receiving relay key K_RQuantum terminal C of (1). For multiple trusted repeaters as shown in fig. 4, the last node in the foregoing method may be to send the relay key K_RMay also be another trusted repeater. And the next node may be the receiving relay key K_RMay also be a further trusted repeater.

Example 4

Based on embodiment 3, embodiment 4 proposed by the embodiment of the present invention is as shown in fig. 6, and a preset sending key encryption key K may be added to the sending quantum terminal a_ATo transmit an encryption key K_ABEncrypting to generate an encrypted transmission encryption key K_AB⊕K_A. The preset receiving key encryption key K can be added to the receiving quantum terminal C_CTo receive a decryption key K_CBEncrypting to generate an encrypted reception decryption key K_CB⊕K_C。

Then, the specific process is as shown in fig. 8, and includes:

step 801, the sending quantum terminal A encrypts the secret key K by using a preset sending secret key_ARespectively for transmitting the encryption key K_ABAnd a relay key K_REncrypting to generate encrypted transmission encryption keys K_AB⊕K_AAnd encrypted relay key K_R⊕K_A；

Step 802, sending the encrypted relay key K to be sent by the quantum terminal A_R⊕K_ASending an encryption key K using said encryption_AB⊕K_AObtaining a first relay secret key K after encryption_R⊕K_ABThen the first relay key K is used_R⊕K_ABSending to the next node; wherein the sending encryption key K_ABRelay decryption key K with the next node_BACorresponding;

step 803, the trusted relay B receives the first relay key K sent by the previous node_R⊕K_ABThereafter, the key K is decrypted by the encrypted relay_BA⊕K_BFor the first relay key K_R⊕K_ABDecrypting to obtain an encrypted relay key K_R⊕K_B(ii) a Wherein the encrypted relay decryption key K_BA⊕K_BIs to encrypt a secret key K by using a preset secret key_BDecrypting the key K for the relay_BAGenerated after encryption, the encrypted relay key K_R⊕K_BObtained by the following formula: k_R⊕K_AB⊕K_BA⊕K_B=K_R⊕K_B；

Step 804, the trusted relay B sends the encrypted relay key K to the next node_R⊕K_BThen, the encrypted relay encryption key K is reused_BC⊕K_BFor the encrypted relay key K_R⊕K_BEncrypting to obtain a second relay key K_R⊕K_BCThen the second relay key K is used_R⊕K_BCSending to the next node; wherein the encrypted relay encryption key K_BC⊕K_BIs to encrypt a secret key K by using the preset secret key_BEncrypting the key K to the relay_BCGenerated after encryption, the relay encryption key K_BCWith a receive decryption key K at the next node_CBCorrespondingly, the second relay key K_R⊕K_BCObtained by the following formula: k_R⊕K_B⊕K_BC⊕K_B=K_R⊕K_BC；

Step 805, the receiving quantum terminal C receives the second relay key K sent by the previous node_R⊕K_BCThereafter, the encrypted reception decryption key K is used_CB⊕K_CPerform decryption (K)_R⊕K_BC⊕K_CB⊕K_C=K_R⊕K_C) Obtaining an encrypted relay key K_R⊕K_C(ii) a Wherein the encrypted reception decryption key K_CB⊕K_CThe receiving quantum terminal C encrypts a secret key K by using a preset receiving secret key_CDecrypting the key K for the reception_CBGenerated after encryption.

Example 5

Further, on the basis that the key encryption key is added to the trusted relay node, a preset sending key encryption key K may be added only to the sending quantum terminal a_ATo transmit an encryption key K_ABCarrying out encryption, wherein the specific flow is shown in FIG. 7; in addition, on the basis that the key encryption key is added to the trusted relay node, a preset receiving key encryption key K may be added only to the receiving quantum terminal C_CTo receive a decryption key K_CBThe specific flow of encryption is shown in fig. 8.

Example 6

Preferably, in embodiments 3 to 5, the transmission encryption key K_ABWith said relay decryption key K_BAThe method comprises the steps of generating a shared quantum key through a QKD process, wherein the shared quantum key and the quantum key are in one-to-one correspondence; the relay encryption key K_BCAnd the receiving decryption key K_CBAre shared quantum keys generated by the QKD process, one-to-one correspondence.

As a further improvement to the foregoing embodiment, the key encryption key may be pre-stored in a hardware chip for updating, encrypting and decrypting operations, and it is ensured that the key encryption key in the chip cannot be derived to ensure the security of the key encryption key. For quantum communication networks, different key encryption keys may be set for each node. Meanwhile, the key encryption key of each node can be updated regularly according to needs, so that the freshness and the safety of the key are further enhanced. Preferably, the key encryption key is periodically updated by a quantum key.

Example 7

Meanwhile, an embodiment of the present invention further provides a key encryption system of a quantum communication network corresponding to the foregoing embodiments 3 to 6, including at least one sending quantum terminal a, at least one receiving quantum terminal C, and at least one trusted repeater B;

a transmitting quantum terminal A for transmitting the relay key K_RUsing a transmit encryption key K_ABObtaining a first relay secret key K after encryption_R⊕K_ABThen the first relay key K is used_R⊕K_ABSending to the next node; wherein the sending encryption key K_ABRelay decryption key K with the next node_BACorresponding;

each trusted repeater B includes:

A key relay forwarding module for receiving a first relay key K from a previous node_R⊕K_ABThereafter, the key K is decrypted by said encrypted relay_BA⊕K_BFor the first relay key K_R⊕K_ABDecrypting to obtain an encrypted relay key K_R⊕K_B(ii) a The encrypted relay key K_R⊕K_BObtained by the following formula: k_R⊕K_AB⊕K_BA⊕K_B=K_R⊕K_B(ii) a And is also used for sending the encrypted relay key K to the next node_R⊕K_BThen, the encrypted relay encryption key K is reused_BC⊕K_BFor the encrypted relay key K_R⊕K_BEncrypting to obtain a second relay key K_R⊕K_BC(ii) a Wherein the relay encryption key K_BCWith a receive decryption key K at the next node_CBCorrespondingly, the second relay key K_R⊕K_BCObtained by the following formula: k_R⊕K_B⊕K_BC⊕K_B=K_R⊕K_BC；

A receiving quantum terminal C for receiving the second relay key K sent by the previous node_R⊕K_BCThereafter, using said received decryption key K_CBPerform decryption (K)_R⊕K_BC⊕K_CB=K_R) Obtaining the relay key K_R。

Example 8

On the basis of embodiment 7, a preset sending key encryption key K can be added to the sending quantum terminal a_AFor encrypting the transmission key K_ABEncrypting to generate an encrypted transmission encryption key K_AB⊕K_A(ii) a The preset receiving key encryption key K can be added to the receiving quantum terminal C_CFor decrypting a key K on reception_CBEncrypting to generate an encrypted reception decryption key K_CB⊕K_C. Namely, the system specifically includes:

a transmitting quantum terminal A for encrypting the secret key K by using a preset transmitting secret key_ARespectively for transmitting the encryption key K_ABAnd a relay key K_REncrypting to generate encrypted transmission encryption keys K_AB⊕K_AAnd encrypted relay key K_R⊕K_A(ii) a And also for the encrypted relay key K to be transmitted_R⊕K_ASending an encryption key K using said encryption_AB⊕K_AObtaining a first relay secret key K after encryption_R⊕K_ABThen the first relay key K is used_R⊕K_ABSending to the next node; wherein the sending encryption key K_ABRelay decryption key K with the next node_BACorresponding;

wherein each of the trusted repeaters B comprises:

A key cache module for storing the encrypted relay decryption key K_BA⊕K_BAnd encrypted relay encryption key K_BC⊕K_B；

A receiving quantum terminal C for encrypting the secret key K by using a preset receiving secret key_CDecrypting the key K for the reception_CBEncrypting to generate an encrypted reception decryption key K_CB⊕K_C(ii) a And is also used for receiving a second relay key K sent by the last node_R⊕K_BCThen, the encrypted reception decryption key K is used_CB⊕K_CPerform decryption (K)_R⊕K_BC⊕K_CB⊕K_C=K_R⊕K_C) Obtaining an encrypted relay key K_R⊕K_C。

Example 9

Based on embodiment 7, as shown in fig. 7, in embodiment 9 provided in this embodiment of the present invention, on the basis that the trusted relay node adds the key encryption key, a preset transmission key encryption key K may be added only to the transmission quantum terminal a_AFor encrypting the transmission key K_ABEncrypting to generate an encrypted transmission encryption key K_AB⊕K_A. As shown in fig. 8, in addition to the addition of the key encryption key by the trusted relay node, a preset receiving key encryption key K may be added only to the receiving quantum terminal C_CFor decrypting a key K on reception_CBEncrypting to generate an encrypted reception decryption key K_CB⊕K_C。

Preferably, in embodiments 7 to 9, the transmission encryption key K_ABWith said relay decryption key K_BAThe method comprises the steps of generating a shared quantum key through a QKD process, wherein the shared quantum key and the quantum key are in one-to-one correspondence; the relay encryption key K_BCAnd the receiving decryption key K_CBAre shared quantum keys generated by the QKD process, one-to-one correspondence.

As a further improvement to the foregoing embodiment, the key encryption module is a hardware chip, and a key encryption key K in the chip is used for encrypting the key_BCannot be derived to ensure that the key encrypts the key K_BThe safety of (2). At the same time, the key encrypts a key K_BAnd can be updated periodically according to the need to further strengthen the secret keyFreshness and safety. Preferably, the key encryption module is further configured to receive a quantum key and encrypt the key K with the quantum key_BPeriodic updates are performed.

Example 10

The foregoing embodiments are all described by taking a one-to-one linear network topology as an example. The embodiment of the invention can also be applied to a quantum communication network with a star network topology structure. As shown in fig. 9, the security of the intermediate point of the star-type 4-node network structure is enhanced, and after the security enhancement scheme is used, the key relay flow is basically consistent with the original flow, and the implementation of the key relay flow of the star-type network is not affected. If the sending quantum terminal A distributes the keys to the receiving quantum terminal C and the receiving quantum terminal D respectively, relay processes are consistent, and the process differentiation caused by the fact that a plurality of quantum terminals are connected through the trusted relay is avoided, and the implementation difficulty is increased. The key encryption method of the trusted repeater B corresponds to that of embodiment 1 one-to-one, but it is only necessary to encrypt the relay key K for each received one_R1⊕K_ABOr K_R2⊕K_ABAll adopt respectively encrypted relay decryption keys K_BA⊕K_BCarrying out decryption; the encrypted relay encryption key K is also adopted for each sent encrypted relay key_BC⊕K_BAnd K_BD⊕K_BEncryption is performed.

Example 11

In the quantum communication network with the star network topology in the foregoing embodiment 10, a preset transmission key encryption key K may be added to the transmission quantum terminal a by using the method as in embodiment 4_AFor encrypting the transmission key K_ABEncrypting to generate an encrypted transmission encryption key K_AB⊕K_A. Preset receiving key encryption keys K can be respectively added to the receiving quantum terminal C and the receiving quantum terminal D_CAnd K_DFor decrypting the secret key K separately from the reception_CBAnd K_DBEncrypting to generate encrypted reception decryption keys K_CB⊕K_CAnd K_DB⊕K_D. The specific flow is shown in FIG. 10, whereAnd will not be described in detail.

Example 12

In the system shown in fig. 11 and 12, the relay key K can be shared by a plurality of quantum terminals_R. As shown in fig. 12, the trusted repeater B connects the quantum terminal a, the quantum terminal C, and the quantum terminal D at the same time, and relays the key K_RTo the three quantum terminals. The method comprises the following specific steps:

step 1601, at the quantum terminal a, first use the key encryption key K_AFor receiving decryption key K_ABEncrypting and storing; at the trusted repeater B, a preset secret key is used for encrypting a secret key K_BFor sending an encryption key K_BA、K_BC、K_BDEncrypting and storing; on the quantum terminal C, firstly, the secret key K is encrypted by using the secret key_CFor receiving decryption key K_CBEncrypting and storing; on the quantum terminal D, firstly, the secret key K is encrypted by using the secret key_DFor receiving decryption key K_DBEncrypting and storing;

step 1602, respectively sending relay keys K to the sub-terminal A, the sub-terminal C and the sub-terminal D in the trusted repeater B_RThe trusted repeater B then encrypts the relay key K_R⊕K_BUsing respectively encrypted transmission encryption keys K_BA⊕K_B、K_BC⊕K_BAnd K_BD⊕K_BAfter being encrypted, the data are respectively sent to a quantum terminal A, a quantum terminal C and a quantum terminal D; the specific process is the same as the process for transmitting a single quantum terminal in the foregoing implementation, but is repeated 3 times, and is not described herein again;

step 1603, the quantum terminal A receives the encrypted relay key K_R⊕K_BAUsing the encrypted receive decryption key K_AB⊕K_AAfter decryption, obtaining an encrypted relay key K_R⊕K_A(ii) a Quantum terminal C receives encrypted relay key K_R⊕K_BCUsing the encrypted receive decryption key K_CB⊕K_CAfter decryption, obtaining an encrypted relay key K_R⊕K_C(ii) a Quantum terminal D receives encrypted relay key K_R⊕K_BDUsing the encrypted receive decryption key K_DB⊕K_DAfter decryption, obtaining an encrypted relay key K_R⊕K_D。

Example 13

The embodiment of the invention also provides a security enhancement method of the quantum key management layer, so as to realize the processing of the key management layer without a plaintext key and enhance the security of the whole key management system. Specifically, as shown in fig. 13, the entire quantum communication network may be divided into a key generation layer, a key management layer, and an application layer. The application layer can comprise an application device A and an application device C, and the key management layer comprises a key management device A and at least one key management device B_n(n is a positive integer, n is not less than 1), and a key management device C. Wherein, if the example shown in fig. 3 is taken as an example, the key management device a and the key management device C are respectively used for managing the keys of the transmitting quantum terminal a and the receiving quantum terminal C, and the key management device B₁May be used to manage the relay decryption key and the relay encryption key of the trusted repeater B.

The working process is as follows:

step 1701, the key generation device a1 is preset with a key K for sending encryption_ABEncrypted transmission key encryption key K_AThen, the key generation device a1 encrypts the transmission key with the key K_ASynchronizing to the application device A; k can be realized, for example, by means of a removable memory_ASynchronization and update;

step 1702, the key generation device A1 and the key generation device B1 perform Quantum Key Distribution (QKD) to generate the sending encryption key K_ABThereafter, the key K is encrypted using the transmission key_AObtaining an encrypted transmission encryption key K after encryption_AB⊕K_A(ii) a Sending encrypted encryption key K_AB⊕K_ATransmitted to the key management device A for storage as a relay key K for sending encryption to the device of the next node_R⊕K_AThen, the encrypted transmission encryption key K is used_AB⊕K_ATo the encrypted relay key K_R⊕K_AEncrypting to obtain an encrypted relay key K_R⊕K_AB。

Step 1703, the key sent by the key management device a to the application device a is the encrypted relay key K_R⊕K_A(ii) a Before using service key, application equipment A uses transmission key to encrypt key K_ADecrypting to obtain the relay key K_RThen the relay key K is transmitted_RAs a traffic key.

The workflow of the node C is identical to that of the node A, as shown in step 1701 and 1703.

Through the reconstruction of the key storage and key relay processes in the above way, the system of the key management layer can ensure that:

a. the key stored on the key management device is an encrypted key, and neither the generated key nor the relayed key is a plaintext key;

b. the key management device does not need to store a key encryption key, and does not need to restore the encrypted key into a plaintext key, so that the security of the key is enhanced;

c. in the key relay process, the relayed keys are in an encrypted state from the beginning to the end, and no plaintext keys are needed to participate in the relay process, and the specific process is shown in fig. 6. The key for completing the relay exists in an encrypted form, such as: key management devices A and B₁The last relay key obtained above is respectively K_R⊕K_A、K_R⊕K_B1；

d. When the key is transmitted among the devices of the key management layer, the key generation layer and the application layer, the keys are encrypted, so that the secure transmission of the keys is ensured.

The above description is only for the purpose of illustrating the preferred embodiments of the present invention and is not to be construed as limiting the invention, and any modifications, equivalents, improvements and the like that fall within the spirit and principle of the present invention are intended to be included therein.

Claims

1. A key encryption method for a trusted repeater, comprising:

step 101, after receiving a first relay key sent by a previous node, a trusted relay decrypts the first relay key through an encrypted relay decryption key to obtain an encrypted relay key; the encrypted relay decryption key is generated by encrypting a relay decryption key by using a preset key encryption key, and the first relay key is generated by encrypting the relay key by using a sending encryption key corresponding to the relay decryption key by the previous node; the relay decryption key and the sending encryption key are symmetric keys;

step 102, when the trusted relay sends the encrypted relay key to the next node, encrypting the encrypted relay key by using the encrypted relay encryption key to obtain a second relay key; the encrypted relay encryption key is generated after the relay encryption key is encrypted by using the preset key encryption key, corresponds to the receiving decryption key at the next node and is a symmetric key;

the algorithm adopted by the encryption and the decryption is an exclusive-or algorithm.

2. The key encryption method for the trusted repeater according to claim 1, wherein the sending encryption key and the relay decryption key are shared quantum keys generated through a QKD process, and are in one-to-one correspondence; the relay encryption key and the receiving decryption key are shared quantum keys generated through a QKD process, and the relay encryption key and the receiving decryption key correspond to each other one by one.

3. The key encryption method of the trusted repeater according to claim 1, wherein the key encryption key is pre-stored in a hardware chip of the trusted repeater for updating, encrypting and decrypting operations, and the key encryption key in the chip cannot be derived.

4. The key encryption method of the trusted repeater according to any one of claims 1 to 3, wherein the key encryption key is periodically updated by a quantum key.

5. A key encryption apparatus of a trusted repeater, comprising:

the key relay forwarding module is used for decrypting the first relay key through the encrypted relay decryption key after receiving the first relay key from the previous node so as to obtain an encrypted relay key; the first relay key is generated after the previous node encrypts a relay key by using a sending encryption key corresponding to the relay decryption key; the relay decryption key and the sending encryption key are symmetric keys; the relay node is further configured to encrypt the encrypted relay key using the encrypted relay encryption key to obtain a second relay key when the encrypted relay key is sent to a next node; wherein the relay encryption key corresponds to the receive decryption key at the next node and is a symmetric key;

6. The key encryption apparatus of a trusted repeater according to claim 5, wherein the transmission encryption key and the relay decryption key are shared quantum keys generated through a QKD process, in one-to-one correspondence; the relay encryption key and the receiving decryption key are shared quantum keys generated through a QKD process, and the relay encryption key and the receiving decryption key correspond to each other one by one.

7. The key encryption apparatus of the trusted repeater according to claim 5, wherein the key encryption module is a hardware chip, and a key encryption key in the chip cannot be derived.

8. The key encryption device of the trusted repeater according to any one of claims 5 to 7, wherein the key encryption module is further configured to receive a quantum key and periodically update the key encryption key through the quantum key.

9. A key encryption method for a quantum communication network, comprising:

step 701, the sending quantum terminal encrypts the relay key to be sent by using a sending encryption key to obtain a first relay key, and then sends the first relay key to the next node; wherein the sending encryption key corresponds to the relay decryption key at the next node and is a symmetric key;

step 702, after receiving a first relay key or a second relay key sent by a previous node, a trusted relay decrypts the first relay key or the second relay key through an encrypted relay decryption key to obtain an encrypted relay key; the encrypted relay decryption key is generated by encrypting the relay decryption key by using a preset key encryption key;

step 703, when the trusted relay sends the encrypted relay key to the next node, encrypting the encrypted relay key by using the encrypted relay encryption key to obtain a second relay key; the encrypted relay encryption key is generated after the relay encryption key is encrypted by using the preset key encryption key, when the next node is a trusted repeater, the relay encryption key corresponds to the relay decryption key at the next node and is a symmetric key, and when the next node is a receiving quantum terminal, the relay encryption key corresponds to the receiving decryption key at the next node and is a symmetric key;

when a transmitting quantum terminal in the quantum communication network transmits a relay key to be transmitted to a receiving quantum terminal, the relay key passes through one or more trusted repeaters, and when the relay key passes through a plurality of trusted repeaters, each trusted repeater performs step 702 and step 703;

10. The key encryption method for a quantum communication network according to claim 9, wherein a transmission key encryption key is preset at the transmission quantum terminal to encrypt the transmission encryption key to generate an encrypted transmission encryption key; a receiving key encryption key is preset at the receiving quantum terminal to encrypt the receiving decryption key so as to generate an encrypted receiving decryption key;

the method specifically comprises the following steps:

step 802, the sending quantum terminal encrypts the encrypted relay key to be sent by using the encrypted sending encryption key to obtain a first relay key, and then sends the first relay key to the next node; wherein the sending encryption key corresponds to the relay decryption key at the next node and is a symmetric key;

step 803, after receiving the first relay key or the second relay key sent by the previous node, the trusted relay decrypts the first relay key or the second relay key by using the encrypted relay decryption key to obtain an encrypted relay key; the encrypted relay decryption key is generated by encrypting the relay decryption key by using a preset key encryption key;

step 804, when the trusted relay sends the encrypted relay key to the next node, the encrypted relay key is encrypted by using the encrypted relay encryption key to obtain a second relay key, and then the second relay key is sent to the next node; the encrypted relay encryption key is generated after the relay encryption key is encrypted by using the preset key encryption key, when the next node is a trusted repeater, the relay encryption key corresponds to the relay decryption key at the next node and is a symmetric key, and when the next node is a receiving quantum terminal, the relay encryption key corresponds to the receiving decryption key at the next node and is a symmetric key;

11. The key encryption method for a quantum communication network according to claim 9 or 10, wherein the sending encryption key and the corresponding relay decryption key are shared quantum keys generated by QKD process, and they are in one-to-one correspondence; the relay encryption key and the corresponding relay decryption key or the receiving decryption key are shared quantum keys generated through a QKD process, and the relay encryption key and the corresponding relay decryption key or the receiving decryption key are in one-to-one correspondence.

12. The key encryption method of a quantum communication network according to claim 9, wherein the key encryption key is pre-stored in a hardware chip for update, encryption and decryption operations, and the key encryption key in the chip cannot be derived.

13. The key encryption method for a quantum communication network according to claim 9, wherein the key encryption key is periodically updated by a quantum key.

14. The key encryption method for a quantum communication network according to claim 9 or 10, wherein the method further comprises:

15. The key encryption method for a quantum communication network according to claim 9 or 10, wherein the method further comprises:

16. A secret key encryption system of a quantum communication network comprises at least one sending quantum terminal, at least one receiving quantum terminal and at least one trusted repeater;

the sending quantum terminal is used for encrypting the relay key to be sent by using the sending encryption key to obtain a first relay key and then sending the first relay key to the next node; wherein the sending encryption key corresponds to the relay decryption key at the next node and is a symmetric key;

each trusted repeater includes:

the key relay forwarding module is used for decrypting the first relay key or the second relay key through the encrypted relay decryption key after receiving the first relay key or the second relay key from the previous node to obtain an encrypted relay key; the relay node is further configured to encrypt the encrypted relay key using the encrypted relay encryption key to obtain a second relay key when the encrypted relay key is sent to a next node; when the next node is a trusted repeater, the relay encryption key corresponds to a relay decryption key at the next node and is a symmetric key, and when the next node is a receiving quantum terminal, the relay encryption key corresponds to a receiving decryption key at the next node and is a symmetric key;

the receiving quantum terminal is used for decrypting by using the receiving decryption key after receiving the second relay key sent by the previous node to obtain the relay key;

17. The key encryption system of a quantum communication network of claim 16, wherein the system specifically comprises;

the transmitting quantum terminal is used for encrypting the transmitting encryption key and the relay key respectively by using a preset transmitting key encryption key so as to generate an encrypted transmitting encryption key and an encrypted relay key respectively; the relay node is further configured to encrypt the encrypted relay key to be sent by using the encrypted sending encryption key to obtain a first relay key, and then send the first relay key to a next node; wherein the sending encryption key corresponds to the relay decryption key at the next node and is a symmetric key;

wherein each of the trusted repeaters comprises:

18. The key encryption system of a quantum communication network according to claim 16 or 17, wherein the sending encryption key and the corresponding relay decryption key are shared quantum keys generated by QKD process, one-to-one correspondence; the relay encryption key and the corresponding relay decryption key or the receiving decryption key are shared quantum keys generated through a QKD process, and the relay encryption key and the corresponding relay decryption key or the receiving decryption key are in one-to-one correspondence.

19. The key encryption system of the quantum communication network according to claim 16 or 17, wherein the key encryption module is a hardware chip, and a key encryption key in the chip cannot be derived.

20. The key encryption system of the quantum communication network according to claim 16 or 17, wherein the key encryption module is further configured to receive a quantum key and periodically update the key encryption key through the quantum key.